At HSBC Bank A.Ş. (“HSBC” or the “Bank”), the information security of our customers is one of our top priorities. In this respect, we would like to inform you about personal data processed by our Bank for investment products activities in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) legislated in order to protect the fundamental rights and freedoms of individuals, as well as to protect personal data.
1. IDENTITY OF DATA CONTROLLER
Under the Law, HSBC Bank A.Ş. acts as a “Data Controller”. You can contact us using the contact details provided below::
Address : Esentepe Mah. Büyükdere Cad. No: 128 34394 Şişli / Istanbul
MERSİS (Central Registration System) No. : 0621002428200197
Registration No. : Trade Registry Office of Istanbul - 268376
Website : www.hsbc.com.tr/
2. PURPOSES AND LEGAL REASONS OF PERSONAL DATA PROCESSING
Your personal data are processed for the purposes as set out below and in accordance with legal terms of data processing (“legal ground”) as part of the processes regarding investment products with our Bank.
| Categories of Processing Personal Data* |
Purpose of Processing Personal Data |
Legal Ground |
Identity Information,
Customer Transaction Information,
Financial Information,
Third- Party Information |
- Receipt of foreign currency purchase/sale order
|
- Based on a legal ground that requires processing of personal data belonging to the agreement parties, provided that it is directly related to the execution and fulfilment of an agreement
|
Identity Information,
Customer Transaction Information,
Professional Experience |
- Creating a risk profile questionnaire, execution of risk management processes
|
- Based on a legal ground that requires processing in order for the Bank to fulfill its legal obligation as the data controller
- Based on a legal ground that requires processing of personal data belonging to the agreement parties, provided that it is directly related to the execution and fulfilment of an agreement
|
Identity Information,
Customer Transaction Information,
Finance, Risk Management,
Third- Party Information |
- Execution of alternative foreign exchange transactions
- Execution of knock in and knock out option transactions
- Execution of foreign currency option transactions
- Execution of foreign currency and foreign currency swap transactions with deposits
- Execution of security and global bond transactions, HSBC and non- HSBC fund buying/selling transactions,
|
- Based on a legal ground that requires processing in order for the Bank to fulfill its legal obligation as the data controller
- Based on a legal ground that requires processing of personal data belonging to the agreement parties, provided that it is directly related to the execution and fulfilment of an agreement
- Based on a legal ground that requires data processing to establish, exercise or protect a right
|
*The datasets mentioned in this table refer to the following data categories:
Identity Information: first name, last name, Turkish ID number, signature, age,
Customer Transaction Information: customer number, transaction information such as type/amount of foreign currency subject to buying/selling, CMB customer class, option information,
collateral information, fund information, trigger practice and transaction information
Risk Management: Information on product and customer risk profile
Finance: Bank account information such as IBAN number, account number
Professional Experience: Information on education, employment status, work experience
Third-Party Information: First name, last name, signature of the parent/guardian/attorney
3. PERSONAL DATA COLLECTION METHODS AND THE LEGAL GROUNDS
Your personal data is physically collected through printed forms, phone, phone banking, branches and ATMs and electronically collected through the internet, phone, text messages (SMS), e-mail and mobile application channels. Collected personal data will be processed based on the legal data processing conditions specified under title number 2 of the text.
4. TRANSFER OF YOUR PERSONAL DATA
For the above purposes, your personal data may be disclosed to public institutions and organizations and judicial authorities authorized by law to receive information, to authorized public institutions and organizations, such as the Risk Center of the Banks Association of Turkey, the Central Bank of the Republic of Türkiye, the Banking Regulation and Supervision Agency, the Capital Markets Board, courts, law enforcement agencies, subsidiaries for legal reasons, such as legal reporting, carrying out regulatory and audit activities, handling complaints and conducting legal proceedings, and to domestic institutions and organizations from which we receive services or cooperate with to carry out our activities and manage your transactions. Your personal data is shared with third parties in accordance with Article 8 of the Law. Your personal data is not transferred abroad.
5. WHAT ARE YOUR RIGHTS?
You have the following rights concerning your personal data, as per the provisions in Article 11 of the Law.
- To find out whether the personal data has been processed,
- To request relevant information if your personal data has been processed,
- To find out the purpose of the personal data processing and whether the data is used for the intended purpose,
- To learn about the third parties to whom personal data is transferred at home or abroad,
- To demand correction in the event of incomplete or incorrect processing of personal data,
- To demand the deletion or destruction of personal data,
- To demand the notification of the third parties to whom personal data was transferred, about any personal data correction, deletion or destruction,
- To object to any outcome to the detriment of the person involved, through the analysis of processed data exclusively via automatic systems,
- To demand recovery of losses should any losses arise due to illegal processing of personal data.
6. CONTACTING US FOR YOUR RIGHTS AND REQUESTS
KYou can either personally submit your requests to our branches in writing or send them through a notary public as per your legal rights. You can also send an e-mail to hsbcbank@hs04.kep.tr using registered electronic mail (KEP) address, secure electronic signature, mobile signature, or to kvkkiletisim@hsbc.com.tr using the electronic mail address previously reported to our Bank and registered in our systems.
The application must include (i) name, surname and, if in writing, signature; (ii) Republic of Türkiye identification number for citizens of the Republic of Türkiye, and nationality, passport number or, if any, identification number for foreigners; (iii) residential area or workplace address provided for correspondence; (iv) if any, electronic mail address, telephone and fax numbers provided for notification and (v) subject of the request.
Applications made within this scope are accepted following an identification verification by us, and your requests stated in the Application are concluded as soon as possible and within 30 days at the latest depending on the type of requests.
7. THINGS YOU CAN HELP WITH
It is important that the personal data we keep about you should be correct and up-to-date. To this end, we kindly ask you to inform us of any change to your personal data using our abovementioned contact details.
If you would like to get further information regarding personal data you can always reach us via the abovementioned contact details or visit Personal Data Protection Authority’s website available at https://www.kvkk.gov.tr/.