Informative Text on the Protection and Processing of Personal Data

Alternatifbank A.Ş. Informative Text on the Protection and Processing of Personal Data

This text has been prepared under our obligation to inform the data subjects whose personal data are processed by Alternatifbank A.Ş. ("our Bank") under our capacity as the Data Controller pursuant to article 10 of the Law no. 6698 on Protection of Personal Data ("KVKK").

Your personal data may be recorded, stored, or updated by our Bank within the framework explained below, or disclosed or transferred to third persons under the conditions permitted by the legislation, or classified and processed in the forms and manner listed in KVKK.

The purposes and legal reasons for processing your personal data; Your personal data are processed for use in any services related to any kind of banking products and services such as deposits, loans, and bank transfer transactions, as well as capital market, insurance agency and other products and services, including those that may be offered by our Bank under its capacity as the intermediary or agent within the scope of Law no. 4358 on Generalization of the Usage of Tax Identity Numbers; the Banking Law no. 5411, the Law no. 5549 on Prevention of Laundering of Proceeds of Crime, the Insurance Law no. 5684, the Turkish Commercial Code no. 6102, the Capital Markets Law no. 6362, the secondary regulations issued in relation to such laws and the provisions of other laws that are of interest in terms of our Bank’s activities; to identify and record the identity, address and other necessary information and data related with the transaction owner; to execute the transactions electronically (SWIFT, internet / mobile banking, etc.) or in papers; to comply with the data storage, reporting and informing obligations stipulated by the related legislation, the Banking Regulation and Supervision Agency (BRSA), the Ministry of Customs and Trade, the Central Bank of Republic of Turkey, the Banks Association of Turkey and the other competent authorities; and to be able to offer the requested / other Bank products and services and to establish and fulfil the requirements of the agreements that the Bank is a party to.

If you have given consent, your personal data may also be processed and used by our Bank for the purpose of presenting and promoting our products and services beyond the purpose for which you have become a client of our Bank under the applicable legislation; for planning and implementing special product, service and proposal activities that are customized for you; for developing product, service and working model proposals; for usage in profiling, segmentation, intra-bank target setting, scoring, risk analysis, client relations management, intra-Bank performance monitoring and analyses; and for conducting statistical studies, market researches, and customer satisfaction surveys.

Your camera images may be recorded at our branches, electronic banking machines (ATMs), regional offices, head office and the buildings used by our Bank for the legitimate interests of our Bank and as required by the workplace security practices.

The persons / entities to whom/which your personal data may be transferred for the abovementioned purposes; the persons or entities permitted by the Banking Law and the provisions of other applicable laws; including, without limitation, the financial institutions and other third persons as specified in article 73/4 of the Banking Law no. 5411 ; public legal entities such as BRSA, Capital Markets Board, Financial Crimes Investigation Board (MASAK), the Ministry of Finance of the Republic of Turkey, CBRT, etc.; our Bank’s main shareholder The Commercial Bank (P.S.Q.C.) and the direct / indirect domestic / overseas subsidiaries of our Bank including our subsidiaries Alternatif Finansal Kiralama A.Ş. and Alternatif Menkul Değerler A.Ş.; domestic and overseas banks and custody institutions intermediating in the related transfers / providing custodian services in relation to domestic and international fund and security transfers and the requests for security custodian services, the Risk Centre of the Banks Association of Turkey, and the institutions, domestic / overseas banks and financial institutions and other third persons that we receive services from, cooperate with, or become a program partner with in order to perform banking activities.

The method of and legal reason for the collection of personal data; Your personal data are collected by our Bank in order to completely fulfil its legal and contractual obligations through any and all agreements/information forms and other documents related with banking transactions and arranged with your consent and/or signature, your notifications that you will send with your electronic consent and/or signature, via the channels like the Head Office, our Branches, ATMs, Internet Banking, Call Centre, etc., and through various methods that may be utilised outside our Bank, including our domestic/overseas subsidiaries, the agencies and institutions that we cooperate with, public agencies and institutions, domestic/overseas Banks and other 3rd persons, whether verbally, in writing or electronically, and whether by automated means, in part or in whole, or non-automated means that are a part of any data recording system, pursuant to the Banking Law no. 5411 and the other related laws and legislation specified above.

Your rights as a customer pursuant to article 11 of KVKK; You are entitled to apply to our Bank with respect to the processing of your personal data; and

• To learn whether your personal data are processed or not;

• And if processed, to request information regarding such processing;

• To learn the purpose of processing and whether or not data is being processed in a way compatible with its collection purposes

• To know the third parties to whom such data are transferred within the country or abroad;

• To request for correction of your personal data if they are processed incompletely / inaccurately;

• To request for erasure / destruction of such data under the conditions stipulated in article 7 of KVKK;

• To request for notification of the actions taken pursuant to the aforesaid sub-paragraphs (d) and (e) to the third parties to whom such data are transferred;

• To object to any results that may arise to your detriment through analysis of such data exclusively via automatic systems;

• To claim for indemnification of any loss or damages that you may incur because of unlawful processing of your personal data.