1. Definition

This Privacy Policy aims to provide information regarding the privacy and security measures adopted for the personal information of visitors and members. The Policy explains the methods for processing, collecting, storing, and using the personal information of visitors and members.

2. Purpose

The purpose of this Privacy Policy is to explain which personal data of Başkent's visitors and members are collected, for what purposes and by which methods such data are processed, the legal basis for such processing, the methods of collection, and the purposes for which such data may be shared with third parties.

3. Information Collected and Methods of Collection

Başkent processes the personal data of website visitors and members in accordance with Articles 5 and 6 of the Personal Data Protection Law No. 6698, the applicable legislation, and the decisions of the Personal Data Protection Board. During website visits, certain general information, such as the user's location and the referring website, may be collected automatically; however, such information is not used for identification purposes.

In addition to automatically collected data, identity, contact, and professional information, as well as photographs and video recordings contained in the shared content, may also be collected. Furthermore, records of interviews conducted with Başkent employees, messages, comments, and opinions are among the data that may be collected. Where necessary and in compliance with the applicable legislation, special categories of personal data may also be processed.

3.1 What Is Personal Data?

Personal data means any information relating to an identified or identifiable natural person. As the data controller, Başkent may record, store, process, disclose, and transfer your personal data in accordance with the Law.

3.2 Methods and Legal Basis for the Collection of Personal Data

Personal data may be collected verbally, in writing, or electronically, through automated or non-automated methods, via contact and membership forms on the website, shared content, authorized natural or legal persons acting as data processors, e-mail, telephone, the website, various agreements, paper forms, and official records.

3.3 General Principles Regarding the Processing of Personal Data

Any operation performed on personal data, including collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, classification, and prevention of use, falls within the scope of “data processing.”

Your personal data collected may be processed for the following purposes:

• Fulfilling notification obligations
• Managing information security processes
• Conducting audit, compliance, and ethics activities
• Managing outsourced services and supplier processes
• Managing finance and accounting operations
• Managing legal processes and dispute resolution
• Conducting internal audit, internal control, and risk management activities
• Ensuring business continuity
• Providing information to legally authorized persons and institutions
• Managing customer relations and customer satisfaction
• Conducting know-your-customer, identity verification, and beneficial ownership identification processes
• Carrying out retention and archiving activities
• Providing investment services and ancillary services within the scope of capital markets legislation
• Establishing and performing contracts
• Planning products and services tailored to individuals and carrying out marketing activities
• Managing requests and complaints
• Managing sales and after-sales support processes

Types of Data That May Be Processed	Sample Content
Identity and Identification Information	Name, surname, profession, job title, employer, education and employment history, gender, marital status, citizenship status, and tax residency status.
Identity Document Data	Date of birth, place of birth, identity number, blood type, religion, and photograph.
Contact Information	Home, business, or temporary residence address, telephone number, e-mail address, and fax number.
Financial and Investment Information	Investment objectives, risk and return preferences, markets and products traded, transaction frequency, and transaction volume.
Communication Records	Telephone conversations, e-mail correspondence, and other audio/visual records.
Digital Footprint and Technical Data	IP address, device ID, unique identifier, device type, log records, traffic information, referral URL, and location information.

3.4 To Whom and For What Purposes Are Personal Data Transferred?

The personal data collected may be shared with third parties where necessary and in accordance with the conditions set forth in Articles 8 and 9 of the Law.

3.5 Rights of the Personal Data Subject Under the Law

• To learn whether personal data are processed
• To request information if personal data have been processed
• To learn the purpose of processing and whether the data are used in accordance with such purpose
• To know the third parties to whom personal data are transferred, whether domestically or abroad
• To request the correction of incomplete or inaccurate personal data
• To request the deletion or destruction of personal data under the conditions set forth in the Law
• To object to any adverse outcome resulting from the analysis of personal data exclusively through automated systems
• To request compensation for damages arising from unlawful processing of personal data

You may submit your requests in writing to the Company's address or to denetim@baskentmenkul.com.tr via registered electronic mail (KEP), secure electronic signature, mobile signature, or the e-mail address registered in our systems.

4. Security and Confidentiality

Başkent exercises reasonable care to ensure the security and confidentiality of personal data. However, no absolute guarantee of security can be provided against third parties seeking to circumvent security measures or interfere with data over the internet.

5. Sharing Personal Data Belonging to Third Parties

Personal data relating to third parties shared with Başkent through the website shall also be processed in accordance with this Privacy Policy. Where personal data of third parties are shared, it is deemed that the person sharing such data has fulfilled the obligations imposed by the applicable legislation.

6. Notices and Amendments

Any amendments to this Privacy Policy shall be announced on the website. The most current version shall be published on the website in a manner accessible to everyone and shall enter into force as of the date of publication.

7. Contact

You may contact Başkent using the contact information available on the website.

This notice is provided by Başkent Menkul Değerler A.Ş. (“Company”), in its capacity as the data controller, in accordance with the Personal Data Protection Law No. 6698 (“Law”), which entered into force to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, in the processing of personal data, in order to inform you.

As the Company, we hereby inform you that we process your personal data in accordance with the Law, based on the principles of processing lawfully and fairly, ensuring accuracy and, where necessary, keeping data up to date, processing for specific, explicit and legitimate purposes, ensuring that processing is relevant, limited and proportionate to such purposes, and securely retaining personal data for the periods stipulated by the applicable legislation or required for the purposes for which they are processed.

1. What Is Personal Data?

Personal data refers to any information relating to an identified or identifiable natural person. By way of example, information such as name, surname, Turkish ID number, address, telephone number, e-mail address, date of birth, IP address, and transaction-related information falls within the scope of personal data. Furthermore, under the Personal Data Protection Law, data such as race, ethnic origin, political opinion, religious belief, health, sexual life, criminal convictions, biometric data, and genetic data are classified as special categories of personal data.

2. What Does the Processing of Personal Data Mean?

The processing of personal data refers to any operation performed on personal data, whether wholly or partly by automated means or, provided that they form part of a data recording system, by non-automated means, including the collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, classification, or prevention of the use of such data.

3. Identity of the Data Controller

Under the Personal Data Protection Law, the data controller refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

4. Your Personal Data Processed

The personal data processed by the Company are processed in line with the general principles set out in the Law, for specific, explicit, and legitimate purposes, and in a manner that is relevant, limited, and proportionate to such purposes.

5. Methods and Legal Grounds for Collecting Your Personal Data

Your personal data are collected verbally, in writing, physically and/or electronically, through automated or non-automated methods, and retained for reasonable periods as specified under the applicable legislation.

Pursuant to Articles 5/1 and 6/2 of the Law, certain personal data may be processed based on your explicit consent following the information provided to you.

• Biometric data obtained during the remote identity verification process, including video interviews, facial biometric verification, liveness detection, and verification of security features.
• Identity, contact, professional experience, financial, marketing, and customer transaction data processed for product and service development, improvement of service quality, market research, customer satisfaction activities, and campaign and marketing activities in line with your commercial electronic communication preferences.

6. Purposes for Processing Your Personal Data

• Fulfilling notification obligations
• Managing information security processes
• Conducting audit, compliance, and ethics activities
• Managing finance and accounting operations
• Managing legal processes and resolving disputes
• Conducting internal audit, internal control, and risk management activities
• Managing customer relations and customer satisfaction
• Carrying out identity verification and know-your-customer processes
• Performing investment services and capital market activities within the scope of capital markets legislation
• Establishing contracts and fulfilling contractual obligations
• Managing communication, advertising, promotion, marketing, and campaign activities relating to products and services
• Managing requests and complaints
• Managing sales and after-sales support processes

7. Transfer of Your Processed Personal Data

Your personal data may be shared with the following parties, limited to the purposes specified below, in accordance with Articles 8 and 9 of the Law and subject to the implementation of the necessary administrative and technical security measures:

Within the scope of Article 9 of the Law, certain personal data may be transferred, based on your explicit consent, to overseas service providers and organizations providing services in remote identity verification processes.

8. Your Rights Under the Law

• To learn whether your personal data are being processed
• To request information if your personal data have been processed
• To learn the purpose of processing and whether your personal data are used in accordance with that purpose
• To know the third parties to whom your personal data are transferred, whether domestically or abroad
• To request the correction of incomplete or inaccurate personal data
• To request the deletion or destruction of your personal data under the conditions set forth in the Law
• To object to a result arising against you through the analysis of your personal data exclusively by automated systems
• To request compensation for damages incurred due to the unlawful processing of your personal data

9. Procedure for Exercising Your Rights

You may submit your requests within the scope of Article 11 of the Law to the Company in writing, via your registered electronic mail (KEP) address, by secure electronic signature, mobile signature, or through the electronic mail address previously notified to the Company and registered in its systems.

Your application must include your name and surname, signature, Turkish ID number (or passport/identity number for foreign nationals), notification address, if available your e-mail address, telephone and fax number, and the subject of your request. Applications will be concluded as soon as possible and, in any event, within thirty (30) days at the latest. Applications are free of charge as a rule; however, if a fee has been determined by the Personal Data Protection Board, the relevant fee may be charged.

Within the scope of the Personal Data Protection Law No. 6698, I hereby acknowledge and declare that I consent to the collection, recording, processing, and storage of my personal data by Başkent Menkul Değerler A.Ş. (“Başkent Menkul”) within the legal framework for the purposes of signing the investor account opening agreement, opening a new account, order transmission, clearing, custody, transfer, and carrying out similar capital market activities.

Within the scope of this service relationship, I expressly consent to the transfer of my personal data belonging to the data categories specified in the Başkent Menkul Değerler A.Ş. Privacy Notice, for the stated purposes, to Başkent Menkul’s domestic and international business partners, subcontractors, auxiliary service providers, cloud service providers, institutions and organizations providing e-mail services, suppliers providing technical infrastructure services, legally authorized public authorities located abroad, as well as third parties including independent audit firms, lawyers, banks, certified public accountants, and sworn-in certified public accountants.

Data Categories Subject to Consent

The information for which consent is provided for processing pursuant to the Personal Data Protection Law No. 6698 and the relevant legislation includes the following categories:

I hereby acknowledge and declare that I expressly consent to the use, sharing, and retention of my personal data for the required period, limited to the processing purposes described within the scope of the provision of the service; that I have been duly informed; and that I have provided my explicit consent of my own free will, regarding a specific subject, and with full knowledge of its consequences.

Explicit Consent Statement for Marketing Activities

Based on your explicit consent, your identity, contact, professional experience, financial, marketing, and customer transaction data may be processed by Başkent Menkul for the purposes of developing products and services suitable for you, improving service quality, conducting market research, surveys, statistical analyses, behavioral modeling, customer satisfaction activities, and carrying out offer, marketing, promotional, advertising, and campaign activities in line with your commercial electronic communication preferences.

Explicit Consent Statement for Cross-Border Data Transfer

Within the scope of managing processes with service providers engaged by Başkent Menkul whose system servers are located abroad, your identity, contact, financial, customer transaction, and marketing data may be transferred abroad and stored outside Türkiye for the purposes of managing customer relations and request and complaint processes. In addition, other personal data that you share within the scope of your requests submitted through communication channels may also be processed and transferred within this scope.

Investor Information

Commercial Electronic Communication Consent

I hereby consent to receiving commercial electronic communications from Başkent Menkul Değerler A.Ş. regarding its products, services, and campaigns, provided that such communications are sent in accordance with the provisions of the Personal Data Protection Law No. 6698 and the Law No. 6563 on the Regulation of Electronic Commerce. I approve the sending of advertising, promotional, campaign, and similar commercial communications to the contact details I have provided via SMS, e-mail, automated calling systems, intelligent voice recording systems, telephone, call center, fax, and similar audio and visual communication channels, and I consent to being contacted through these channels.

Within this scope, I consent to the recording and retention of the content of the commercial electronic communications to be sent to me, as well as other records relating to such communications, for submission to public institutions and organizations, particularly the Capital Markets Board of Türkiye, where required. I acknowledge that I reserve the right to withdraw my consent at any time.

Scope of Consent

Customer Information