Notification on the Protection of Personal Data with Regard to Personal Lending Products

At HSBC Bank A.Ş. (“HSBC” or the “Bank”) the information security of data subjects, in particular, our Customers is one of our top priorities. In this respect, we would like to inform you about personal data processed by our Bank in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) legislated in order to protect the fundamental rights and freedoms of individuals, as well as to protect personal data.

Our Personal Lending Products include personal, house and vehicle loans, overdraft accounts and individual letters of guarantee.

1. IDENTITY OF DATA CONTROLLER

Under the Law, HSBC Bank A.Ş. acts as a “Data Controller”. You can contact us using the contact details provided below:

Address : Esentepe Mah. Büyükdere Cad. No: 128 34394 Şişli / İstanbul

MERSİS No : 0621002428200197

Registration No : Trade Registry Office of Istanbul - 268376

Website : www.hsbc.com.tr/

2. PURPOSES OF AND LEGAL GROUND FOR PERSONAL DATA PROCESSING

Your personal data are processed for the purposes as set out below and in accordance with legal terms of data processing (“legal ground”) as part of the processes regarding personal lending products with our Bank:

Personal Data Categories	Purpose of Processing Personal Data	Legal Ground
Identity Communication Customer transaction Risk management Finance Professional experience	Authentication to ensure the security of customers, Bank and data; carrying out, recording and reporting controls regarding money laundering, bribery, fraud, financial crime and sanctions, raising suspicious activity reports Performing credibility assessments; following up and controlling credit monitoring and repayment processes Exchanging information with institutions and organizations, banks, prospective buyers or risk center stipulated within the framework of the provisions of the Banking Law No. 5411, drawing up consolidated financial statements of the main partnerships, executing risk management and internal audit activities, executing valuation activities to sell Bank assets or securities based on them, including but not limited to loans, executing valuation, rating or assistance services, executing independent audit activities and service purchases	Based on the legal grounds that processing is required in order for the Bank to fulfill its legal obligation as the data controller
Identity Communication Risk management Customer transaction Finance Professional experience	Arrangement and execution of the banking transactions agreement and loan agreement pursuant to your loan request Carrying out loan and guarantee assessment, intelligence and information surveys, loan sale, allocation, drawdown, follow-up and monitoring processes Determining and negotiating the conditions of your loan agreement Drafting and executing pledge agreements Restructuring the loan if necessary Provision of credit products and services/transactions through online banking and our mobile application	Based on a legal ground that requires processing of personal data belonging to the agreement parties, provided that it is directly related to the execution and fulfilment of an agreement
Identity Communication Customer transaction Risk management Finance Professional experience	Contract management, initiating legal transactions and following up on legal processes, conducting debt follow-up through contracted law firms and/or performing transfer of receivables to the asset management company Managing the legal, financial, commercial, compliance and reputational risks faced by our Bank, taking necessary steps to protect our rights in disputes to which we are a party	Based on a legal ground that requires data processing to establish, exercise or protect a right

2.1. If You Provide Guarantee or if You are a Guarantor for the Individuals Utilizing a Product or Service:

Personal data of persons who provide guarantee or act as guarantor for individuals already using our products or services are processed for the purposes as set forth below and in accordance with legal terms of data processing (“legal ground”). The guarantee in question is deposit, securities or vehicle pledge:

Personal Data Categories	Purpose of Processing Personal Data	Legal Ground
Identity Communication Risk management Finance Professional experience	Meeting the requirements of authorized agencies and organizations Performing reporting and auditing services Performing credibility assessments; following up and controlling credit monitoring and repayment processes	Based on a legal ground that requires processing in order for the Bank to fulfill its legal obligation as the data controller
Identity Communication Risk management Finance Professional experience	Drafting and executing sections regarding surety together with the loan agreement Drafting and executing the pledge agreement Establishing any pledge through the e-pledge system of the Notaries Union of Turkey for vehicle loans Collection of debt pursuant to the surety agreement accompanying the loan agreement in cases such as delayed client payments, being unable to pay or having inadequate income	Based on a legal ground that requires processing of personal data belonging to the agreement parties, provided that it is directly related to the execution and fulfilment of an agreement
Identity Communication Risk management Finance Professional experience	Following financial and accounting transactions, generating financial and business reports Ensuring the continuity of security and activities; performing activity analyses, enhancements and performance measurements Management and recording of communications with our Bank Conducting effectiveness and expediency analyses for our commercial operations, planning and execution of such operations	Based on a legal ground that requires data processing for legitimate interests of our Bank acting as data controller, provided that no harm is caused to the fundamental rights and freedom of the relevant person
Identity Communication Risk management Finance Professional experience	Contract management, initiating legal transactions and following up on legal processes, conducting debt follow-up through contracted law firms and/or performing transfer of receivables to the asset management company Planning and/or execution of activities related to establishing, sustaining and/or discharging collaterals Managing the legal, financial, commercial, compliance and reputational risks faced by our Bank, taking necessary steps to protect our rights in disputes to which we are a party	Based on a legal ground that requires data processing to establish, exercise or protect a right

2.2. If You Happen to Be the Owner of the Real Estate Forming the Subject of the House Loan or the Mortgagor in Case of Loans with Housing / Workplace Mortgage as Collateral:

Due to statutory requirements, for the loan calculation of customers using the house loan facilities of our Bank, an appraisal report is to be obtained for the real estates that form the subject of the loan and the real estate needs to be mortgaged as collateral. For the appraisal report to be created, the owner (seller / mortgagor) of the real estate in question is required to be registered using the online title deed system and provide their approval. To enable these transactions, the name, last name and phone number of the seller / mortgagor are shared by the client applying for the loan with our Bank at the time of applying for the loan. The personal data is shared with the appraisal firm in order for the appraisal report to be issued and the necessary information about the process to be provided to the seller / mortgagor, who is then contacted by the appraisal firms. The company intermediating the creation of mortgage contacts the seller(s) / mortgagor(s) for the real estate to be mortgaged at the title deed directorates. In addition, for our inquiries at deeds submitted by customer or at the deed information accessed by online title deed system, the relevant real estate's previous owners' general categories of personal data Turkish ID number, name, surname, or father's name may be processed for credbility and risk assessment purposes in order to confirm if there is any fictitious transaction.

Accordingly, your personal data are processed for the purposes as set forth below and in accordance with legal terms of data processing (“legal ground”):

Personal Data Categories	Purpose of Processing Personal Data	Legal Ground
Identity Communication	Obtaining an appraisal report on the real estates forming the subject of the loan Providing the necessary updates regarding the appraisal reporting process Verification of the sale amount of the housing in the land registry details Obtaining letter of consent of spouse per the legislation if required Allowing the relevant company working with the bank for mortgaging the real estate to make contact regarding title deed transactions Processing of real estate's previous owners' identity data to confirm if there is any fictitious transaction	Based on a legal ground that requires data processing for legitimate interests of our Bank acting as data controller, provided that no harm is caused to the fundamental rights and freedom of the relevant person and for the Bank to fulfill its legal obligation as the data controller

3. TRANSFER OF THE PERSONAL DATA

Your personal data are transferred for the below mentioned purposes and in accordance with legal terms of data processing (“legal ground”) as part of your loan processes with our Bank:

Personal Data Categories	Persons/Organizations on the Receiving End and Purposes of Transfer	Legal Ground
Identity Communication Risk management Customer transaction Finance Professional experience	To judicial authorities and public institutions and organizations that are legally authorized to receive information, for legal reasons such as legal reporting, carrying out regulation and supervision activities and managing complaints and legal processes: The Banks Association of Turkey Risk Center CBRT Central Bank Credit Reference Agency (Kredi Kayıt Bürosu A.Ş.) Banking Regulation and Supervision Agency Capital Markets Board Ministry of Treasury and Finance, Financial Crimes Investigation Board, Revenue Administration Interbank Card Center The Banks Association of Turkey Courts, Execution Offices and Consumer Arbitration Committees Identity Information Sharing System, Address Based Registration System, e-sequestration system, e-pledge system PTT Other authorized bodies and organizations Relevant insurance companies if you request Credit-Related Insurance (please refer to the clarification on the protection of personal data as issued by the relevant insurance company for more information) Dealer/seller to whom the loan amount is to be paid if you request vehicle loan Business partners to allow printing the Account Statements if you request Printed Overdraft Account	It is required in order for the Bank to fulfill its legal obligation and it is clearly set forth in the laws
Identity Communication Risk management Customer transaction Finance Professional experience	For the purpose of following financial and accounting transactions, generating financial and business reports, Shareholders of our company Authorized business partners such as financial advisors and auditing companies For the purpose of carrying out credibility assessments; Credit Reference Agency (Kredi Kayıt Bürosu A.Ş.) Business partners Carrying out loan and guarantee assessment, intelligence and information surveys, loan sale, allocation, drawdown, follow-up and monitoring processes Business partners Law firms, parties providing collection services to us For the purpose of creating and executing the loan agreement pursuant to your loan request: Companies providing services to us, suppliers and support service provider companies and their employees, authorized persons and subcontractors For the purpose of providing products and services through online banking and our mobile application: Companies providing services to us, suppliers and support service provider companies and their employees, authorized persons and subcontractors	Data processing is necessary for the legitimate interests of the Bank, provided that no harm is caused to the fundamental rights and freedoms of the relevant person

Personal Data Categories

Persons/Organizations on the Receiving End and Purposes of Transfer

Legal Ground

Identity
Communication
Risk management
Customer transaction
Finance
Professional experience

To judicial authorities and public institutions and organizations that are legally authorized to receive information, for legal reasons such as legal reporting, carrying out regulation and supervision activities and managing complaints and legal processes:

The Banks Association of Turkey Risk Center
CBRT Central Bank
Credit Reference Agency (Kredi Kayıt Bürosu A.Ş.)
Banking Regulation and Supervision Agency
Capital Markets Board
Ministry of Treasury and Finance, Financial Crimes Investigation Board, Revenue Administration
Interbank Card Center
The Banks Association of Turkey
Courts, Execution Offices and Consumer Arbitration Committees
Identity Information Sharing System, Address Based Registration System, e-sequestration system, e-pledge system
PTT
Other authorized bodies and organizations
Relevant insurance companies if you request Credit-Related Insurance (please refer to the clarification on the protection of personal data as issued by the relevant insurance company for more information)
Dealer/seller to whom the loan amount is to be paid if you request vehicle loan
Business partners to allow printing the Account Statements if you request Printed Overdraft Account

It is required in order for the Bank to fulfill its legal obligation and it is clearly set forth in the laws

Identity
Communication
Risk management
Customer transaction
Finance
Professional experience

For the purpose of following financial and accounting transactions, generating financial and business reports,

Shareholders of our company
Authorized business partners such as financial advisors and auditing companies

For the purpose of carrying out credibility assessments;

Credit Reference Agency (Kredi Kayıt Bürosu A.Ş.)
Business partners

Carrying out loan and guarantee assessment, intelligence and information surveys, loan sale, allocation, drawdown, follow-up and monitoring processes

Business partners
Law firms, parties providing collection services to us

For the purpose of creating and executing the loan agreement pursuant to your loan request:

Companies providing services to us, suppliers and support service provider companies and their employees, authorized persons and subcontractors

For the purpose of providing products and services through online banking and our mobile application:

Companies providing services to us, suppliers and support service provider companies and their employees, authorized persons and subcontractors

Data processing is necessary for the legitimate interests of the Bank, provided that no harm is caused to the fundamental rights and freedoms of the relevant person

4. PERSONAL DATA COLLECTION METHODS AND THE LEGAL GROUNDS

Your personal data are physically collected through printed forms, phone, phone banking, branches and ATMs and electronically collected through the internet, phone, short messages (SMS), e-mail and mobile application channels. Collected personal data will be processed based on the legal data processing conditions specified under title number 2 of the text.

5. WHAT ARE YOUR RIGHTS?

You have the following rights concerning your personal data, as per the provisions in Article 11 of the Law.

To find out whether the personal data has been processed,
To request relevant information if your personal data has been processed,
To find out the purpose of the personal data processing and whether the data is used for the intended purpose,
To learn about the third parties to whom personal data is transferred at home or abroad,
To demand correction in the event of incomplete or incorrect processing of personal data,
To demand the deletion or destruction of personal data,
To demand the notification of the third parties to whom personal data was transferred, about any personal data correction, deletion or destruction,
To object to any outcome to the detriment of the person involved, through the analysis of processed data exclusively via automatic systems,
To demand damages should any losses be incurred due to the illegal processing of personal data.

6. CONTACTING US FOR YOUR RIGHTS AND REQUESTS

You can either personally submit your requests to our branches in writing or send them through a notary public as per your legal rights. You can also send an e-mail to hsbcbank@hs04.kep.tr using registered electronic mail (KEP) address, secure electronic signature, mobile signature, or to kvkkiletisim@hsbc.com.tr using the electronic mail address previously reported to our Bank and registered in our systems.

The application must include (i) name, surname and, if in writing, signature; (ii) Republic of Turkey identification number for citizens of the Republic of Turkey, and nationality, passport number or, if any, identification number for foreigners; (iii) residential area or workplace address provided for correspondence; (iv) if any, electronic mail address, telephone and fax numbers provided for notification and (v) subject of the request.

Applications made within this scope are accepted following an identification verification by us, and your requests stated in the Application are concluded as soon as possible and within 30 days at the latest depending on the type of requests.

7. THINGS YOU CAN HELP WITH

It is important that the personal data we keep about you should be correct and up-to-date. To this end, we kindly ask you to inform us of any change to your personal data using our abovementioned contact details.

If you would like to get further information regarding personal data you can always reach us via the abovementioned contact details or visit Personal Data Protection Agency’s website available at https://www.kvkk.gov.tr/.

Version: 2.0
Date: 18.01.2023