Papel Commercial Customer Clarification Text
PAPEL COMMERCIAL CUSTOMER CLARIFICATION TEXT ON THE PROTECTION AND
PROCESSING OF PERSONAL DATA
Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi ("Our Company" or "Papel"), residing at Residing at Maslak Mah. Eski Büyükdere Cad. Link Plaza Sitesi Link Plaza Blok No: 3-5 Interior Door No: 33 Sarıyer/İstanbul, as the data controller, may process, transfer and store your general or special categories of personal data within the framework of the following purposes and conditions in accordance with the Personal Data Protection Law No. 6698 ("KVKK"). This Papel POS Customer Clarification Text on the Protection and Processing of Personal Data ("Clarification Text") has been prepared to inform Papel POS ("POS") users about how and why we collect, process, store and transfer your personal data and to whom and for what reason. 1. Methods of Collection of Personal Data In the following cases, we may collect your personal data from you, from the information and documents you have submitted to Papel, through the website, our call centre, public platforms or through other persons and institutions we have contracted with or through authorised public institutions and organisations, digitally or physically, in written, verbal or voice recording form, automatically or non-automatically:
(i) When you contact us via our customer service or other communication channels,
(ii) When you apply for Papel POS,
(iii)through the contracts, instructions, information and documents you submit, your payment order instructions and the applications you use when you become a Papel POS Customer.
2. Processed Personal Data Papel will process your personal data for the purposes specified in this Clarification Text. In case of any change in your personal data and/or purposes, Papel will update this Clarification Text and publish the current version separately. The personal data belonging to you as a Customer collected and used by Papel are as follows: Data Category Personal Data Identity Data Name-surname, previous surname, Turkish ID number, date of birth of the applicant and/or the person making the application, name-surname, previous surname, Turkish ID number, date of birth, nationality, identity information on the identity card and/or driving licence of the authorised person and/or company partners, VKN and title of the person who is the customer, Foreigner ID number. Contact Data Telephone number, e-mail, address of the applicant, mobile phone and e-mail address of the authorised person, workplace address, workplace/mobile phone number of the workplace, mobile phone and e-mail address of the card customer. Financial Data Customer's IBAN and card number information, bank account information. Audio and Visual Data Voice recording data. Occupational Data Job and occupational data. Customer Transaction Data Call centre voice recordings, past transaction records, invoice information. Marketing Data Your information obtained through marketing activities. Legal Transaction Data KVKK and IYS permission and judicial administrative authority requests.
3. Purposes of Processing Personal Data Your personal data may be recorded, stored, preserved, modified, reorganised, disclosed, transferred, made available, classified or prevented from being used by automatic or non-automatic methods in order to achieve the following purposes in accordance with the applicable legislation and KVKK. The main processing purposes of your personal data are as follows, and our processing purposes may be updated due to changes in our company policies and legislation:
(i) To fulfil our legal obligations expressly stipulated in the laws, particularly the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions ("Law No. 6493"), the Law No. 5651 on Regulation of Publications on the Internet and Combating Crimes Committed through These Publications and MASAK Legislation,
(ii) To ensure the establishment and performance of the contract to which you are a party by accepting the framework agreement regarding the payment service offered by Papel,
(iii) Completing the registration stages, creating users and accounts, carrying out customer and identity verification processes, ensuring secure access to the Papel POS panel,
(iv) Benefiting from the products and services offered by Papel and the relevant company, making informative and guiding communications, providing information on transactions and transaction follow-up, providing and/or renting a POS device in companies with a website, representative office or in cooperation,
(v) Carrying out finance and accounting transactions, keeping current accounts and following up the processes, ensuring financial reconciliation with the companies we cooperate with,
(vi) Storing the information as required by the legislation, copying and backing up the information in order to prevent loss of information, ensuring that the data is accurate and up-to-date, checking the consistency of the information and planning and execution of audit activities,
(vii) Ensuring information and operational security, assessing, determining and managing risk levels, performing suspicious transaction and user controls, and taking necessary actions in inappropriate situations,
(viii) Keeping systematic records, reporting, planning and conducting analyses, and carrying out strategy and business development processes,
(ix) Receiving complaints, opinions, suggestions and error notifications communicated to the call centre and support team or shared publicly; providing necessary information and providing guidance; collecting and evaluating customer evaluations,
(x) Sharing with regulatory and supervisory authorities such as the Central Bank of the Republic of Turkey, as required or obliged by legal regulations, in order to ensure the fulfilment of legal obligations, follow-up of contractual processes and/or legal requests,
(xi) To perform internal purposes such as quality control, call centre and operations,
(xii) To ensure and improve coordination, co-operation and efficiency among the units within our Company, and to inform you about changes in our Company's policies and procedures,
(xiii) To detect, prevent, investigate suspicious or unlawful transactions, to provide information to the relevant authorities in this regard, to manage the necessary administrative and legal processes,
(xiv) To ensure the security of our Company's electronic systems and physical environments, At the same time, your personal data in the category of Identity, Customer Transaction and Contact Information such as turnover, business opening date, business name, authorised person phone and e-mail, authorised person name may also be processed for the following purposes in the presence of your explicit consent:
(i) Carrying out data, customer and marketing analysis studies and creating campaigns by analysing this data and contacting you to inform you about these campaigns and ensuring product use,
(ii) Collecting information through questionnaires/searches/forms to ensure your satisfaction,
(iii) I can be assigned the most appropriate service package or be directed to a higher/lower package,
(iv) Carrying out activities to increase my usage experience in order to provide me with the easiest use while using Papel POS products and ensuring that business processes are carried out by following my usage habits/behaviours and customising them according to my needs,
(v) Transfer of personal data to our service providers at home and abroad in order to process personal data for the purposes listed in the above paragraphs. If you withdraw your explicit consent, Papel will cease to process and transfer data for the specified purposes.
4. Legal Grounds for Processing Personal Data We process your personal data only if there is a valid legal reason in accordance with the KVKK and, where necessary, in the presence of your explicit consent. We process your personal data in accordance with our purpose of collecting your personal data and on the basis of the legal reasons stated below. Explicitly stipulated in the Laws In case it is explicitly stipulated in the laws, your personal data is processed in accordance with the law. Law No. 6493 and its secondary regulations and Law No. 5549 on the Prevention of Laundering Proceeds of Crime and its secondary regulations, your identity data, communication data, financial data, audio-visual data, professional data, legal transaction data, customer transaction data, etc. within the framework of the provisions stipulated in the Law and its secondary regulations. Establishment and Performance of the Contract When you accept the framework agreement regarding the payment service offered by Papel, a contract is established between you and Papel. Papel processes your identity data, communication data, financial data, visual and audio data, professional data, legal transaction data, customer transaction data in order to establish the aforementioned contract and to fulfil its obligations arising from this contract. Fulfilment of Our Legal Obligations Your personal data is processed in order to comply with the regulations that impose obligations on Papel in accordance with the legislation in force. For example, upon the request of the Chief Public Prosecutor's Office or courts, your data such as your identity and contact information and customer transaction data may be shared. Presence of Legitimate Interest of the Data Controller Provided that it does not harm your fundamental rights and freedoms, we may process your personal data for our legitimate interests such as ensuring more efficient and effective operation of the POS payment service and protecting the security of our electronic systems. Necessity for the Establishment, Exercise or Protection of a Right Your personal data may be processed because it is mandatory for the establishment, exercise or protection of a right. Publicised by the Relevant Person Your data made public by you as the data subject can be processed by Papel. For example, data such as your contact data made public through Papel's communication channels can be processed to solve your problems and complaints and to contact you. Explicit Consent Personal Data may be processed for the reasons listed under "explicit consent" under the heading "Purposes of Processing Personal Data".
5. Transfer of Personal Data to Third Parties We may transfer your personal data to group companies, shareholders, authorised institutions and organisations, suppliers, affiliates, representatives, external service providers, other payment service providers, official institutions and judicial authorities such as the Central Bank of the Republic of Turkey, Information Technologies and Communication Authority, Financial Crimes Investigation Board, Revenue Administration, Public Prosecutor's Offices and courts, consultants and law offices or independent audit companies for the purposes specified in Article 3 above, provided that we comply with the conditions stipulated in Articles 4 and 8 of the KVKK and take the necessary security measures. Third parties with whom we share your personal data may only process your personal data limited to the purpose of transfer, unless there is another regulation in the legislation. In addition, in the presence of your explicit consent, your personal data in the category of identity, communication, customer transaction, finance and marketing will be transferred to the domestic and foreign service providers of our Company in order to design, plan and execute campaigns, promotions, product service promotion processes and to communicate for these purposes. 6. Your Rights as a Personal Data Owner Pursuant to Article 11 of the KVKK, you have the following rights as a personal data owner.
(i) To learn whether your personal data is being processed or not,
(ii) Requesting information if your personal data has been processed,
(iii) To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
(iv) To know the third parties to whom your personal data are transferred domestically or abroad,
(v) To request correction of your personal data in case of incomplete or incorrect processing,
(vi) To request the deletion or destruction of your personal data in case the reasons requiring their processing disappear,
(vii) Request notification of correction and deletion to third parties to whom your personal data are transferred,
(viii) Object to the occurrence of a result that is to your detriment by analysing personal data exclusively through automated systems,
(ix) In case you suffer damage due to unlawful processing of your personal data, to demand compensation for your damage Pursuant to Article 13 of the KVKK, if you wish to exercise any of your rights mentioned above as a personal data owner, you may submit your request in the following ways by filling out your request in accordance with the instructions written in the data owner application form on our Company's website.
(i) "Maslak Mah. Eski Büyükdere Cad. Link Plaza Site Link Plaza Block No: 3-5 Interior Door No: 33 Sarıyer/İstanbul" in person or through a notary public or
(ii) by registered electronic mail (KEP) to our registered e-mail address "papelelektronik@hs01.kep.tr" or
(iii) by using secure electronic signature, mobile signature or your e-mail address previously notified to us and registered in our system to our e-mail address "destek@papel.com.tr" Sincerely,
Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi
