This personal data processing information document (hereinafter the “Document”) is prepared in fulfilment of “Obligation to Inform” of Borsa İstanbul A.Ş (hereinafter “Borsa”) under the  Article 11 of the Law on the Protection of Personal Data No. 6698 (hereinafter the “Law”).

In processing personal data, Borsa conducts with the awareness of the importance of and sense responsibility for personal data. In the course of processing the personal data Borsa respects good faith principle.

I- Identity of the Data Controller

In accordance with the provisions of the Law, Borsa is “Data Controller” with respect to the data it processes.

II- Processing purposes

Personal data in the Borsa is processed for performance of the obligations of the Borsa arising from the Capital Market Law and other related legislation; for market operations and market supervision and audit; to ensure that capital market instruments, debt instruments and precious metals and other gems and other contracts, documents and securities deemed appropriate by the Capital Markets Board are traded in a reliable, transparent, effective, stable, fair and competitive environment; for implementation of the Labour Law and social security legislation, for provision of social and health-related support to our employees and their families; to determine that the representatives (brokers/traders) of the institutions authorized to trade in the markets meet the necessary conditions; to enable access to the market by persons authorized to trade in the market; for transferring transaction information to the relevant clearing house for the purpose of clearing and settlement of the transactions concluded in the markets; for evaluation of applications made for authorization to trade; for use of the information of the authorized persons during the operations carried out by Borsa Istanbul; compliance with the legislation and / or instructions of the competent authorities; ensuring contact with relevant persons; informing on and sending invitations for trainings, seminars, meetings, events, organization etc. activities organized or supported by the Borsa; for enabling participation in training programs carried out by the Borsa and ensuring compliance with the principles of participation to the program in BISTEP programs and registration to the said program; to obtain company information from the relevant persons when necessary for the purpose of conducting index calculation activities and determining the companies to be included in the indices; for contacting companies within the scope of data broadcasting and distribution services; to communicate with the participants or represented enterprises of gong ceremonies and to share gong ceremonies on social media and with the press; for invoicing of the services received from the Borsa and sending invoices to those concerned; to authorise access to electronic platforms, for tracking of such authorisation - within the framework of the Information Systems activities of the Borsa Istanbul- in order to ensure effective and safe use in accordance with the corporate policies and legal arrangements ; to improve the quality of service with respect to internal and external help desk calls, to comply with the legal obligations with respect to  internet access ; for  information and marketing; to communicate with the representatives of the companies who are business partners of Borsa, who are in business relations with Borsa and those who are stakeholder in the capital markets with  Borsa; to conclude contracts and execution thereof ; due to service purchase contracts made with the suppliers  or for any other specified and explicit purposes such as  protecting  the legitimate interests and security of the Borsa , in accordance with law and rules good faith , in a limited and proportionate manner, and in connection with legitimate purposes for which the data is processed and in an updated form if so necessary.

III- Collecting Method and Legal Purposes of Personal Data Processing

Your personal data may be collected for any of the above purposes through any audio or electronic channels or in written formats; through forms previously created by the Borsa Istanbul or in free form; through security cameras or through the Public Disclosure Platform and Registered Electronic Mail Systems, or through companies that have business relations with the Borsa Istanbul.

Your personal data will be processed on the basis of legal reasons or your express consent set forth in Articles 5 and 6 of the Law.

Accordingly, your data is processed based on your explicit consent; for reasons clearly stipulated in the law, for reasons directly related to conclusion or execution of a contract with you;  to fulfil Borsa’s legal obligations, or if processing such data  is compulsory for conferring exercise  or protection of a right, or without prejudice to the fundamental rights and freedoms of the person concerned, if processing is compulsory for the legitimate interests of Borsa.

Personal data revealing a person’s race, ethnic origin, political opinions, philosophical belief, religion, sect or other beliefs, outfit, association or labour union membership, health, sex life, data concerning criminal records of the person and security measures imposed on the person, biometric and genetic data is considered as a special category of data. Such data may be processed on the basis of your express consent or in the circumstances foreseen in the law, except for data concerning health and sexual life.

IV- To whom and for what purposes personal data can be transferred

In accordance with Article 8 of the Law, your personal data may be transferred to Borsa İstanbul Group Companies in order to register and clear market transactions; to valuation institutions for valuation services, to the regulatory and supervisory authorities and other public institutions and organizations in order to fulfil the obligations arising out of Capital Markets Law and other legislation, the judicial authorities and to those who are authorised to trade on markets.

The name and contact information of the representatives of the Members of Derivatives and Options Market are shared on the Borsa İstanbul website in order to facilitate and accelerate  the access of investors to the market.

V- Your Rights

The Borsa Istanbul has necessary sensitivity for your use of  rights granted to you under the Law. Under the law you have the right to

1-  Learn whether your personal data is processed,

2- Request information, if your personal data is processed,

3- Learn the purpose of processing your personal data and to learn whether it is used in line with the purpose of processing,

4- Know the third parties located in Turkey or outside Turkey to which your personal data is transferred

5- Request correction of your personal data if it is incomplete or incorrectly processed,

6- Request deletion or destruction of your data if reasons that require their processing are no longer existing, whilst your data had been processed in accordance with the legislation,

7- Ask for service of notification to third parties to whom the data is transferred of any correction or of any deletion, destruction or anonymization of data, should the reasons for its processing ceased existing ;

8- Object drawing results through analysis made via automatic systems, and demand compensation if you suffer a loss due to the unlawful processing of your personal data

In this context, your request to exercise your rights above, your applications shall be sent in writing to the address of Reşitpaşa Mahallesi Borsa Istanbul Caddesi No: 4, 34467 Sarıyer / Istanbul or to “borsaistanbul@hs03.kep.tr” address, via secure electronic signature, mobile signature, or by using the e-mail address you exchange with us and registered in Borsa Istanbul system.

In your application;

a) Your name, surname and  signature- if application is made in writing (if the application is made by the legal representative, the name and surname of the legal representative must be specified and the application shall be signed by such legal representative)

b) For the citizens of the Republic of Turkey Turkish the identity number, for foreigners passport number or, if applicable, an identification number (if the application is made by a legal representative, such information of legal representative must also be included).

c) The address of residency or that of  place of business,

ç) E-mail address, telephone and fax number, if any

d) Subject of demand.

shall be stated.

Information and document related to the subject shall be enclosed in the application. You must make the application in person; for minors or persons lacking discernment, authorized representative must apply with document proving that he / she is the legal representative.

BORSA İSTANBUL A.Ş

In accordance with the Personal Data Protection Law No. 6698 (“Law”), your personal data may be processed by Borsa İstanbul A.Ş. (“Borsa”) as the data controller within the scope described below.

This personal data processing information document has been prepared in order to regulate the collection methods of personal data obtained from visitors to the data center located on the Borsa campuses, the legal reasons and purposes of personal data processing, the persons / institutions to which personal data are transferred and the transfer purposes, informing about the rights of natural persons whose data are processed regarding the personal data contained in the KVKK in accordance with the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Law and the Obligation to Clarify. Borsa is committed to ensuring that personal data is processed in compliance with the Law and in accordance with principles of fairness. Necessary technical and administrative security measures are taken to protect your personal data.

    1) Identity of the Data Controller

In accordance with the provisions of the Law, Borsa is “Data Controller” with respect to the data it processes.

    2) Processing Personal Data

Your personal data that you have shared with Borsa or that may be subject to processing if necessary are as follows:

    3) Purposes of Processing Personal Data

Your personal data is processed in accordance with the personal data processing conditions specified in Article 5 of the Law and the purposes specified in the Law. Within this scope, your personal data in the Borsa records;

• Detection and control of entries and exits to data centers located on the Borsa campus, ensuring the security of the data center.

• Ensuring legal, technical and commercial occupational safety,

• Execution of emergency management processes,

• Carrying out routine audit activities,

• Planning and execution of disciplinary, internal investigation and review processes,

• Carrying out occupational health / safety activities,

• Ensuring the security of movable goods and resources,

• Fulfilling the requirements of legal regulations,

• To be used as evidence in legal disputes that may arise in the future,

• Managing Borsa’s information security processes,

• Ensuring Borsa’s legitimate interests. 

are processed for the purposes. This process is carried out in a limited and proportionate manner for the purposes; in accordance with the law and the rules of honesty. Areas that may result in an intervention to your privacy in a way that exceeds security purposes are not subject to monitoring.

    4) Method and Legal Reason for Collection of Personal Data

Your personal data is obtained during your visit to the data center located at Borsa's location, through closed circuit camera systems, visitor forms and face-to-face interviews, within the scope of fulfilling the purposes stated above.

Your personal data is collected and processed by Borsa based on the purposes and legal reasons stated in the table below and the personal data processing conditions specified in Article 5 of the Law.

    5) Transfer of Personal Data

Your personal data included in the Borsa's personal data inventory will be processed within the framework of the personal data processing conditions and purposes specified in Article 8 of the Law;

• Limited to the requested purpose, fulfilling legal reporting and information requests within the scope of carrying out Borsa transactions and regulatory and auditing activities within the scope of legal authority, and carrying out legal auditing activities,

• Conducting security processes together in line with the shared use of the data center Borsa Group Companies (İstanbul Takas ve Saklama Bankası A.Ş. ve Merkezi Kayıt Kuruluşu A.Ş.) 

It may be shared with.

Borsa has the ISO 27001 Information Security Management System standard and complies with the obligation of care and diligence regarding the transfer and sharing of your data.

    6) Rights of Data Subjects and Protection of Right

Borsa has necessary sensitivity for your use of  rights granted to you under the Law.As a data subject, you are informed that you have the following rights pursuant to Article 11 of the Law:

• Learn whether your personal data is processed,

• Request information, if your personal data is processed,

• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

• Know the third parties located in Turkey or outside Turkey to which your personal data is transferred,

• Request correction of your personal data if it is incomplete or incorrectly processed,

• Request deletion or destruction of your data if reasons that require their processing are no longer existing, while your data had been processed in accordance with the legislation

• Requesting that third parties to whom personal data has been transferred be notified that the data has been corrected upon request and that the data has been deleted, destroyed or anonymized due to the elimination of the reasons for processing,

• Objection to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems.

• To request compensation in case of damages due to unlawful processing of personal data.

     7) Data Controller You Can Apply to Under the Law

According to Article 11 of the Law, which regulates the rights of the data subject, you can submit your requests in accordance with the conditions specified in the Communiqué On Principles and Prosedures For the Request to Data Controller by using a petition prepared in line with the nature of your request and your method of application to the following addresses:

• In person or through a representative, or via notary, to the Borsa location at Reşitpaşa Neighborhood, Borsa İstanbul Street, No: 4, 34467 Sarıyer/İstanbul

• Via registered electronic mail (KEP) to the address: borsaistanbul@hs03.kep.tr

• Using a secure electronic signature, mobile signature, or the electronic mail address registered in Borsa with the address: kvkk@borsaistanbul.com

Identity verification is mandatory during the application process. In applications made through a representative, the original power of attorney that includes authority for personal data requests must be presented.

Applications submitted in this context will be accepted following identity verification conducted by Borsa, and your requests will be concluded as soon as possible, and no later than 30 days, depending on the nature of the request. While applications are free of charge, if the process incurs any additional costs, the fee specified in the tariff determined by the Personal Data Protection Authority may be requested from you.