Legal1. PURPOSE AND SCOPE
1.1. This Privacy Policy (the “Policy”) sets out the procedures and principles governing the processing, security and confidentiality of the personal data and commercially sensitive information of users, customers and visitors (each a “User”) who benefit from the financial technology, collection and payment infrastructure services offered through the websites at www.tahsildar.com.tr and ths.tahsildar.com.tr, the mobile applications and all related electronic service channels (together, the “Platform”) operated by THS FİNANSAL TEKNOLOJİLER ANONİM ŞİRKETİ (the “Company”).
1.2. The Company undertakes to protect the confidentiality of Users’ data within the framework of the Law on the Protection of Personal Data No. 6698 (“KVKK”), the Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions No. 6493, the Law on the Protection of Competition No. 4054, the confidentiality provisions of the Banking Law No. 5411 and the related secondary legislation and administrative regulations.
2. DATA PROCESSING PRINCIPLES AND LEGAL BASES
2.1. Personal data is processed in full compliance with the principles of lawfulness and fairness; accuracy and, where necessary, being kept up to date; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes for which it is processed (data minimisation); and being retained only for the period set out in the relevant legislation or required for the purpose of processing.
2.2. The Company processes personal data solely on the legal grounds set out in Articles 5 and 6 of KVKK. Accordingly, data processing activities are based on the following legal grounds:
- Being expressly provided for by law (Law No. 5651, Law No. 6493, the Tax Procedure Law, etc.),
- Being directly related to the establishment or performance of a contract (provision of collection and payment services),
- Being necessary for the Company to fulfil its legal obligations,
- Being necessary for the Company’s legitimate interests, provided that the fundamental rights and freedoms of the data subject are not harmed (subject to a balancing test showing that no rights are infringed),
- Where required by legislation, the User’s explicit consent, given freely, on an informed basis and in relation to a specific matter.
3. OBLIGATION TO INFORM AND SEPARATION OF EXPLICIT CONSENT (OPT-IN PRINCIPLE)
3.1. This Policy is a general privacy assurance document and cannot replace the activity-specific “Privacy Notice on the Processing of Personal Data”. Layered privacy notices compliant with the legislation are provided in every channel through which Users’ data is obtained (membership, payment orders, contact forms, etc.).
3.2. The obligation to inform and the processes for obtaining explicit consent are strictly separated. The provision of services cannot be made conditional on giving consent for marketing, profiling, sending commercial electronic messages or non-essential cookies (no “take it or leave it” condition).
3.3. In all processes requiring explicit consent, an “opt-in” system (an empty box ticked by the User’s active action) is applied; pre-ticked (opt-out) consent boxes or boxes containing blanket/general consent are deemed legally invalid.
4. DATA PROCESSED AND DEVICE ACCESS PERMISSIONS
4.1. When the User accesses the Platform and uses the services, the Company collects only the data that is strictly necessary to perform the service, ensure transaction security and meet legal obligations. Excessive or disproportionate data not directly related to the service, such as e-Government passwords or third parties’ contact lists, is never requested.
4.2. Technical parameters and hardware permissions accessed through mobile applications or web channels (camera, location/GPS, device ID, IMEI, MAC address, IP address, operating system and network information) are processed only to the limited and proportionate extent required for identity verification, fraud prevention, transaction security and regulatory record-keeping. Users can restrict these permissions at any time from their device settings.
4.3. In payment and collection processes, credit/debit card data is processed only by the relevant licensed institutions for the authorisation and execution of the transaction. Storage activities to offer card storage and fast payment are not considered part of the performance of the contract and are subject to the User’s separate and explicit consent; the User can delete a stored card from the system at any time.
4.4. The User’s contact details are used only to communicate with the User; unless the User consents or there is a legal requirement, data belonging to the User’s relatives, references or third parties is not added to the contact pool.
5. TECHNICAL AND ADMINISTRATIVE MEASURES AND INFORMATION SECURITY
5.1. In line with Article 12 of KVKK and the decisions of the Personal Data Protection Board (including Board Decision No. 2018/10), the Company takes all necessary technical and administrative measures to ensure an appropriate level of security.
5.2. Administrative Measures: Company employees can access data only on a “need-to-know” basis, limited to their job descriptions and only as necessary. All staff receive periodic data protection and competition law compliance training and sign specific confidentiality undertakings.
5.3. Technical Measures: Personal data and strategic commercial information are stored encrypted using up-to-date cryptographic methods; remote access is restricted with two-factor authentication. Data Loss Prevention (DLP) and Security Information and Event Management (SIEM) software is used on the system; access, transaction and audit logs are retained in an unalterable and non-repudiable manner for the periods required by legislation.
5.4. If personal data is unlawfully obtained by unauthorised persons (a data breach), the Company will notify the affected Users and the Personal Data Protection Board without delay and at the latest within the legal time limits.
6. CHINESE WALL, DATA ISOLATION AND COMPETITION LAW SAFEGUARDS
6.1. The Company may not use the financial technology, collection and payment data obtained through the Platform in a way that leads to an exchange of information restricting competition, market sharing or abuse of a dominant position within the scope of Law No. 4054.
6.2. Strategic customer information belonging to different member merchants, corporate customers or competing financial institutions (pricing, fees, campaign strategies, spending volumes, turnover data, etc.) is kept in logically and physically isolated databases.
6.3. “Chinese Wall” procedures and authorisation matrices are applied within the Company to prevent information leakage. Competition-sensitive trade secrets belonging to one User/Customer are not shared with the Company’s other group companies, parent shareholders or competing undertakings.
6.4. Data in data pools created for analytics, reporting or market insight is irreversibly anonymised (in a way that cannot be undone by reverse engineering) and processed only as aggregated outputs.
7. TRANSFER OF DATA AND CONFIDENTIALITY OBLIGATION
7.1. Personal data and information qualifying as customer secrets are not transferred to third parties, except where permitted by legislation, required to perform a contract or based on the User’s duly given explicit consent.
7.2. Service Providers and Business Partners: Technical providers, integrators and third-party data processors from whom the Company receives support to offer its services are bound by strict data security and confidentiality agreements concluded with the Company. These parties are prohibited from using the data outside the Company’s instructions and the specified purpose.
7.3. Official and Judicial Authorities: Requests for information/documents from courts, public prosecutors, the BRSA (BDDK), the CBRT (TCMB), MASAK or competent administrative authorities are met only to the extent of the scope, subject and period of the relevant legal order/request letter (observing the principle of data minimisation). Data not requested or outside the scope is not shared; transfers are made in sealed envelopes, via KEP or over encrypted secure channels.
7.4. Transfers Abroad: Personal data is transferred abroad (including cloud computing and server services) lawfully, where the safeguards set out in Article 9 of KVKK exist (an adequacy decision, standard contracts/undertakings and Board approval processes, or incidental explicit consent).
8. THIRD-PARTY LINKS AND LIMITATION OF LIABILITY
8.1. The Platform may from time to time contain links to third-party websites or applications. The provisions of this Policy apply only to the Platform and service channels belonging to the Company; the Company cannot be held responsible for the privacy policies, ethical principles or security levels of the third-party sites to which users are redirected.
8.2. However, this disclaimer does not remove the Company’s legal liability arising from its own fault or from its obligations under the legislation, as data controller, to take administrative and technical measures.
9. DATA RETENTION, DESTRUCTION AND ANONYMISATION
9.1. Personal data is retained for the limitation and retention periods set out in the relevant legislation or for as long as the purpose of processing requires. Deactivating a User account does not mean that the data is deleted immediately while legal retention periods continue.
9.2. When the processing conditions and legal periods end, personal data is deleted, destroyed or anonymised in line with the periodic destruction schedule under the Company’s Personal Data Retention and Destruction Policy, or upon the User’s request. All destruction operations are recorded in auditable logs.
10. RIGHTS OF THE USER (DATA SUBJECT) AND APPLICATION PROCEDURE
10.1. Under Article 11 of KVKK, Users have the right to apply to the Company to:
- Learn whether their personal data is being processed,
- Request information if their personal data has been processed and access their data (with masking so as not to breach third parties’ secrets),
- Learn the purpose of processing their personal data and whether it is used in line with that purpose,
- Know the third parties to whom their personal data is transferred in Türkiye or abroad,
- Request the correction of personal data that is incomplete or inaccurately processed,
- Request the deletion or destruction of their data under the conditions set out in Article 7 of KVKK,
- Request that the correction, deletion or destruction be notified to the third parties to whom the data has been transferred,
- Object to an outcome against them arising from the analysis of the processed data exclusively through automated systems,
- Claim compensation for damages if they suffer loss due to the unlawful processing of their personal data.
10.2. How to Apply: Users may submit their requests relating to the rights listed above in writing or electronically, in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller”:
- By delivering them by hand, with documents proving their identity, to the Company’s physical address or through a notary public,
- To the Company’s registered electronic mail (KEP) address thsfinansal@hs03.kep.tr with a secure electronic signature or mobile signature,
- By sending an email to info@tahsildar.com.tr from the verified email address registered in the Company’s system.
10.3. Depending on the nature of the request, the Company will conclude the application free of charge as soon as possible and at the latest within 30 (thirty) days. If the application is rejected, the reasons for rejection are notified to the data subject in writing or electronically.
11. LANGUAGE AND UPDATING OF THE POLICY
11.1. The Company may update this Privacy Policy at any time in line with changes in legislation, court decisions or operational requirements. The current text enters into force on the date it is published on the Platform.
11.2. This Policy may also be prepared in languages other than Turkish. In the event of any difference in meaning or conflict between the Turkish text and translations in a foreign language, the Turkish text prevails.
12. ENTRY INTO FORCE AND DECLARATION
12.1. This Policy entered into force on the date it was made available to Users on the Platform.
12.2. Persons who visit or use the Platform acknowledge that they have been informed of the general data security and privacy principles set out in this Policy. Data processing and commercial communication activities requiring explicit consent are carried out, independently of this Policy, through separate consent mechanisms presented to the User at the relevant steps.
DATA CONTROLLER DETAILS:
Registered name: THS Finansal Teknolojiler Anonim Şirketi
Website: www.tahsildar.com.tr
Contact / KEP: thsfinansal@hs03.kep.tr
Date: 18.09.2026