LegalPRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
As THS FİNANSAL TEKNOLOJİLER ANONİM ŞİRKETİ (hereinafter the “Company” or “Tahsildar”), we attach great importance to ensuring the security of all personal data of our corporate customers, main dealers, dealers, sub-dealers and their authorised users who transact through our B2B payment orchestration platform (the “Platform”), our website (tahsildar.com.tr), our mobile applications and our API integrations, primarily within the framework of the Law on the Protection of Personal Data No. 6698 (hereinafter “KVKK” or the “Law”) and the related legislation.
This privacy notice has been prepared by the Company in its capacity as data controller under Article 10 of the Law and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
1. IDENTITY OF THE DATA CONTROLLER
Under Article 3(ı) of the Law, a data controller is defined as the natural or legal person who determines the purposes and means of processing personal data and who is responsible for establishing and managing the data filing system; our Company is the data controller with respect to the data of our valued corporate customers, dealers and authorised users.
- Registered name: THS FİNANSAL TEKNOLOJİLER ANONİM ŞİRKETİ
- MERSIS number: 0843086884900001
- Trade registry number: ISTANBUL - 1012273
- Address: İnkılap Mah. Dr. Adnan Büyükdeniz Cad. 2. Blok No: 4 İç Kapı No: 7 Ümraniye / İstanbul
- Email: info@tahsildar.com.tr
- KEP address: thsfinansal@hs03.kep.tr
2. CATEGORIES OF PERSONAL DATA PROCESSED
The data collected within the scope of Tahsildar’s B2B payment orchestration activities belongs directly to the natural-person representatives, employees and authorised users of corporate dealers/customers, and is processed in a limited and proportionate manner for the purpose of processing:
| Category of Personal Data Processed | Examples of Personal Data Processed |
|---|---|
| Identity Information | Name, surname, Turkish ID number (only for sole proprietorship dealers or to verify authorised signatories), signature circular/specimen signature, date of birth, place of birth, mother’s name, father’s name, ID serial number, ID expiry date, nationality, ID photo, gender |
| Contact Information | Email address, corporate phone number, workplace/company address for notifications, postal address, residential address |
| Customer Transaction & B2B Collection Information | B2B collection amount, transaction date/time, transaction reference number, dealer/sub-dealer order and account movements, payment channel type, transaction result (successful/failed error codes), support and request records, payment card information, call records, account holder name, invoice information, bank account number, IBAN, receipt, receipt details, account movements carried out by the customer on a crypto currency wallet, communication history |
| Financial Information | Integrated licensed bank/payment institution information, masked card information (first 6 and last 4 digits only), IBAN/account number, invoice and receipt information (Note: the full 16-digit card number, expiry date and CVV are not stored in the clear on Tahsildar servers; they are transmitted encrypted via PCI-DSS Level 1 compliant licensed payment gateways), financial performance information, asset information |
| Transaction Security Information | User’s IP address, website and platform sign-in/sign-out logs, encrypted (hashed) password information, two-factor authentication (2FA) records, session tokens, browser and operating system information, device type, instant photo, transaction receipts, residential address, civil registry record, device cookie settings, geographical region reported by the customer’s device |
| Marketing Information | Only for users who have consented to commercial electronic messages: platform newsletter/campaign interaction data, survey responses and usage analytics data |
3. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Your personal data is processed on the following legal grounds set out in Article 5 of the Law:
- Processing being necessary, provided that it is directly related to the establishment or performance of a contract, of the personal data of the parties to the contract (KVKK Art. 5/2-c): Setting up platform membership/user accounts, verifying the sign-ins of dealer/sub-dealer authorised persons, and performing B2B payment orchestration and collection management services.
- Processing being mandatory for the data controller to fulfil its legal obligations (KVKK Art. 5/2-ç): Keeping access logs under Law No. 5651, retaining accounting/transaction records under Turkish Commercial Code No. 6102 and Tax Procedure Law No. 213, and compliance with Law No. 6493 and MASAK regulations.
- Processing being mandatory for the establishment, exercise or protection of a right (KVKK Art. 5/2-e): Submitting evidence in legal disputes and following up lawsuits and enforcement proceedings.
- Processing being mandatory for the legitimate interests of the data controller (KVKK Art. 5/2-f): Taking information security and fraud prevention measures, platform performance analysis and running technical support processes.
- Explicit Consent (KVKK Art. 5/1): Sought only for sending commercial electronic messages and, in exceptional cases, for transfers of data abroad.
4. TRANSFER OF PERSONAL DATA
In line with Article 8 of the Law, your personal data is transferred to partner licensed banks and payment institutions to run collection processes; to our infrastructure, SMS and technical support providers; and to competent judicial/administrative authorities within the scope of legal notifications.
Transfers Abroad (KVKK Art. 9): In line with the amendments made by Law No. 7499 dated 12 March 2024, where cloud and infrastructure services of foreign origin are used, transfers are carried out primarily by concluding the Standard Contracts announced by the Personal Data Protection Board and notifying the Board, or by ensuring other legal safeguards; in incidental cases where these safeguards cannot be ensured, transfers are carried out based on your explicit consent.
5. RIGHTS OF THE DATA SUBJECT (KVKK ART. 11)
Under Article 11 of the Law, data subjects may submit their applications to exercise their rights in writing to info@tahsildar.com.tr or to the company address stated above. Applications will, as a rule, be concluded free of charge within 30 (thirty) days at the latest.