Papel Individual Customer Clarification Text

Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi ("Our Company" or "Papel"), as the data controller residing at Maslak Mah. Eski Büyükdere Cad. Link Plaza Sitesi Link Plaza Blok No: 3-5 Interior Door No: 33 Sarıyer/İstanbul, may process, transfer and store your general or special categories of personal data within the framework of the following purposes and conditions in accordance with the Personal Data Protection Law No. 6698 ("KVKK").

This Papel Wallet Customer Clarification Text on the Protection and Processing of Personal Data ("Clarification Text") has been prepared to inform Papel Wallet ("Wallet") users about how and why we collect, process, store and transfer your personal data and to whom and for what reason.

In the following cases, we may collect your personal data from you, from the information and documents you have submitted to Papel, through the mobile application and website, from the devices you use, from public platforms and social media accounts or through other persons and institutions we have contracted with or authorised public institutions and organisations, digitally or physically, in written, verbal or voice recording form, automatically or non-automatically:

(i)    When you create a Wallet account,

(ii)   When you verify your Wallet account,

(iii) When you contact us via our customer service, social media accounts or other communication channels,

(iv)  When you log in to your account or make any payment transaction such as top-up, withdrawal or transfer of funds.

(v)    from other payment service providers in order to make open banking services available to you.

 

Papel will process your personal data for the purposes specified in this Clarification Text. In case of any change in your personal data and/or purposes, Papel will update this Clarification Text and publish the current version separately. The personal data belonging to you as a Customer collected and used by Papel are as follows:

Data Category	Personal Data
Identity Data	Identity data such as name-surname, previous surname, Turkish ID number, parents' name, gender, place and date of birth, province, district, neighbourhood, village, signature, ID serial number and expiry date on the ID card and/or driving licence, identity data such as account name (alias).
Contact Data	Contact data such as telephone number, e-mail, address, residence address, workplace address, proof of residence.
Location Data	Geolocation information of the device where the Wallet is used.
Financial Data	Financial transaction data such as monthly net income, bank account and debit/credit card information, invoice amount, invoice subscription number, Customer ID, Virtual Card data, current balance, limit information, monetary expenditure transactions, blocked transactions, cashback information.
Audio and Visual Data	Photo, video, audio recording data.
Occupational Data	Job and occupational data.
Customer Transaction Data	Customer transaction data such as call centre records, past transaction records, invoice information, automatic invoice payment instruction information, receipt information, campaign information participated in.
Transaction security	Transaction security data such as IP address, Wallet login-logout information, successful and unsuccessful login attempts to the Wallet, password information, security question.
Marketing Data	Shopping history information, segment information, information obtained through campaigns.
Legal Proceedings Data	All kinds of documents and contracts provided by individual customers or received from courts and administrative authorities.
Biometric Data	Face recognition data.

 

Your personal data may be recorded, stored, preserved, modified, reorganised, disclosed, transferred, made available, classified or prevented from being used by automatic or non-automatic methods in order to achieve the following purposes in accordance with the applicable legislation and KVKK. The main processing purposes of your personal data are as follows, and our processing purposes may be updated due to changes in our company policies and legislation:

       (i)       To fulfil our legal obligations expressly stipulated in the laws, in particular the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions ("Law No. 6493"), the Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through These Publications and MASAK Legislation,

      (ii)      To ensure the establishment and performance of the contract to which you are a party by accepting the framework agreement regarding the payment service offered by Papel,

     (iii)     Completing the registration stages, creating users and accounts, carrying out customer and identity verification processes, and ensuring secure access to the application, 

     (iv)     Personalisation of the Wallet by the user, management of the permissions in the application, 

      (v)      In companies where mobile application, website, representation or co-operation is provided, to benefit from the products and services offered by Papel and the relevant company, to make informative and guiding communications, to provide information on transactions and transaction follow-up, to print and transmit prepaid cards, 

     (vi)     Carrying out finance and accounting transactions, keeping current accounts and following up the processes, ensuring financial reconciliation with the companies we cooperate with,

     (vii)     Storing the information as required by the legislation, copying and backing up the information in order to prevent loss of information, ensuring that the data is accurate and up-to-date, checking the consistency of the information and planning and execution of audit activities, 

    (viii)    Ensuring information and operational security, assessing, determining and managing risk levels, performing suspicious transaction and user controls, and taking necessary actions in inappropriate situations, 

     (ix)     Keeping systematic records, reporting, planning and conducting analyses, and carrying out strategy and business development processes, 

      (x)      Receiving complaints, opinions, suggestions and error notifications submitted to the call centre and support team or shared publicly, providing necessary information and providing guidance; collecting and evaluating customer evaluations, performing all transactions based on user requests such as expenditure objection, user information change,

     (xi)     Sharing with regulatory and supervisory authorities such as the Central Bank of the Republic of Turkey, as required or obliged by legal regulations, in order to ensure the fulfilment of legal obligations, follow-up of contractual processes and/or legal requests,

     (xii)     To improve our website and applications, to improve user experience, to increase reliability,

    (xiii)    To perform internal purposes such as quality control, call centre and operations,

    (xiv)    To ensure and improve coordination, co-operation and efficiency among the units within the Company,

     (xv)     To ensure the healthy functioning of the Wallet and to protect users against potential or existing risks,

    (xvi)    To detect, prevent and investigate suspicious or unlawful transactions, to provide information to the relevant authorities in this regard, to manage the necessary administrative and legal processes,

   (xvii)   To inform you about changes in our Company's policies and procedures,

   (xviii)  To ensure the security of our Company's electronic systems and physical environments,

    (xix)    To be able to offer open banking services.

At the same time, your personal data may also be processed for the following purposes in the presence of your explicit consent:

       (i)       Instant campaign notification according to your location data,

      (ii)      Carrying out data, customer and marketing analyses, 

     (iii)     Ensuring participation in a lottery, special prize, competition or similar event, carrying out the processes and informing the authorised institutions,

     (iv)     Processing by Papel for the purpose of designing, planning and execution of personalised advertising, campaigns, promotions, product service promotion processes and communicating for these purposes and transferring data to Papel's domestic and foreign service providers.

      (v)      Processing of your biometric data within the scope of identification and verification processes carried out by means of remote communication.

If you withdraw your explicit consent, Papel will cease to process and transfer data for the specified purposes.

We process your personal data only if there is a valid legal reason in accordance with the KVKK and, where necessary, in the presence of your explicit consent. We process your personal data in accordance with our purpose of collecting your personal data and on the basis of the legal reasons stated below.

Explicitly stipulated in the Laws	In case it is explicitly stipulated in the laws, your personal data is processed in accordance with the law. Within the framework of the provisions stipulated in Law No. 6493 and its secondary regulations, your identity data, communication data, financial data, audio-visual data, professional data, transaction security data, legal transaction data, customer transaction data, etc. Your data must be processed.
Establishment and Performance of the Contract	When you accept the framework agreement regarding the payment service offered by Papel, a contract is established between you and Papel. Papel processes your identity data, communication data, financial data, visual and audio data, professional data, transaction security data, legal transaction data, customer transaction data in order to establish the aforementioned contract and to fulfil its obligations arising from this contract.
Fulfilment of Our Legal Obligations	Your personal data is processed in order to comply with the regulations that impose obligations on Papel in accordance with the legislation in force. For example, upon the request of the Chief Public Prosecutor's Office or courts, your data such as your identity and contact information and customer transaction and transaction security data may be shared.
Presence of Legitimate Interest of the Data Controller	Provided that it does not harm your fundamental rights and freedoms, we may process your personal data for our legitimate interests such as ensuring that our applications work more efficiently and effectively and protecting the security of our applications and electronic systems.
Necessity for the Establishment, Exercise or Protection of a Right	Your personal data may be processed because it is mandatory for the establishment, exercise or protection of a right. For example, your personal data is processed in order to file a lawsuit or to respond to a lawsuit filed by you.
Publicised by the Relevant Person	Your data made public by you as the data subject can be processed by Papel. For example, data such as your contact data made public through Papel's communication channels can be processed to solve your problems and complaints and to contact you.
Open Consent	Pursuant to Law No. 6563 on the Regulation of Electronic Commerce and the relevant legislation, the promotion of the services, special offers or campaigns offered by us is only possible with your explicit consent. In case you have given your explicit consent for sending commercial electronic messages, we may process your personal data within the framework of your consent for the purpose of promoting our services, special offers or campaigns, conducting marketing communication activities and survey applications, and in this context, we may send SMS or electronic mail, and transfer personal data to our service providers at home and abroad. In addition, your biometric data is processed within the scope of your explicit consent in order to identify and verify your identity through remote communication.

Your personal data may be disclosed to group companies, shareholders, authorised institutions and organisations, suppliers, representatives, external service providers, other payment service providers, Central Bank of the Republic of Turkey for the purposes specified in Article 3 above, provided that the conditions stipulated in Articles 4 and 8 of the KVKK are complied with and necessary security measures are taken, We may transfer your personal data to official institutions and judicial authorities such as the Information and Communication Technologies and Communications Authority, Financial Crimes Investigation Board, Revenue Administration, Chief Public Prosecutors' Offices and courts, consultants and law offices, payment service providers contracted with invoice payment institutions for intermediary transactions for invoice collection, independent audit companies. Third parties with whom we share your personal data may only process your personal data limited to the purpose of transfer, unless there is another regulation in the legislation.

In addition, in the presence of your explicit consent, your personal data in the categories of identity, communication, location, customer transaction, finance and marketing will be transferred to our Company's domestic and foreign service providers in order to design, plan and execute personalised advertising, campaign, promotion, product service promotion processes and to communicate for these purposes.

 

 

Pursuant to Article 11 of the KVKK, you have the following rights as a personal data owner:

       (i)       To learn whether your personal data is being processed or not,

      (ii)      Requesting information if your personal data has been processed,

     (iii)     To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

     (iv)     To know the third parties to whom your personal data are transferred domestically or abroad,

      (v)      To request correction of your personal data in case of incomplete or incorrect processing,

     (vi)     To request the deletion or destruction of your personal data in case the reasons requiring their processing disappear,

     (vii)     Request notification of correction and deletion to third parties to whom your personal data are transferred,

    (viii)    Object to the occurrence of a result that is to your detriment by analysing personal data exclusively through automated systems,

     (ix)     In case you suffer damage due to unlawful processing of your personal data, to request compensation for your damage

Pursuant to Article 13 of the KVKK, if you wish to exercise any of your rights mentioned above as a personal data owner, you may submit your request in the following ways by filling out your request in accordance with the instructions written in the data owner application form on our Company's website.

        (i)       "Maslak Mah. Eski Büyükdere Cad. Link Plaza Site Link Plaza Block No: 3-5 Interior Door No: 33 Sarıyer/İstanbul" in person or through a notary public or

        (ii)      by registered electronic mail (KEP) to our registered e-mail address "papelelektronik@hs01.kep.tr" or

       (iii)     by using secure electronic signature, mobile signature or your e-mail address previously notified to us and registered in our system to our e-mail address "destek@papel.com.tr"

Sincerely,

Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi