SÜMER VARLIK YÖNETİM A.Ş.

DISCLOSURE STATEMENT ON THE LAW OF THE PROTECTION OF PERSONAL DATA

Sümer Varlık takes the highest possible level of security measures with the purpose to ensure that your personal data is collected, stored and shared in accordance with the law and to protect your privacy.  Our aim, pursuant to article 10 of the Law no 6698 on the Protection of Personal Data (the “Law”) and in line with your satisfaction, is to inform you in the most transparent and clear manner about the channels, means and methods of collecting your personal data, and the purposes and legal grounds of collecting and processing your personal data and your rights under the Law.   

a) Data Controller

In accordance with the Law no 6698 on the Protection of Personal Data (the “Law no 6698”) your personal data can be collected and processed by Sümer Varlık Yönetim A.Ş. (“Sümer Varlık”), acting in its capacity as the Data Controller, within the scope described below. 

b) The Purposes for which Personal Data is processed 

Within the scope of the Law no 4743 on Restructuring of Debts to Financial Sector, Banking Law, Regulation governing the Principles of Incorporation and Operations of Asset Management Companies , published in the Official Gazette no 24893 and other relevant legislation,  Sümer Varlık will process your personal data for the purpose of purchasing, collecting, restructuring and selling the receivables and other assets of the Savings Deposit Insurance Fund, banks and other financial institutions, and with the purpose to be able to provide services related to financial products and instruments, and to design, develop, carry out, implement, execute fulfil and perform  transactions in connection with the financial products and instruments referred to above. Your personal data is processed for the purpose of the provision of information by Sümer Varlık about the overdue receivables of banks and other financial institutions, fulfilment of the requirements for the management, monitoring, follow-up and collection of non-performing or overdue or problematic portfolios or overdue receivables of banks   purchased or acquired and  carrying out restructuring activities, fulfillment of the requirements of the contracts  to which you and/or we are a party;  conducting information researches and creditworthiness assessments, planning, statistics,  risk management, ensuring security, and complying with anti-money laundering legislation and domestic and international legislation;  complying with and fulfilling the obligations regarding data storage, reporting and notification  as provided for by the Credit Bureau of Türkiye (KKB), Interbank Card Center (BKM), Banking Regulation and Supervision Agency (BRSA),  Central Bank of the Republic of Türkiye (CBRT), Capital Markets Board (SPK), Financial Crimes Investigation Board (MASAK),  Banks Association of Türkiye (TBB),  Revenue Administration (GİB),  Undersecretariat of Treasury and  other competent authorities; and for being able to provide you with better and more reliable services and to continue to provide these services uninterruptedly.   In this context, within the framework of the conditions and purposes for processing personal data as outlined in articles 5 and 6 of the Law no 6698, your personal data will be processed with the following purposes:

·         To be able to get in contact with you at the time of collection of receivables,

·         In order to fulfill legal and commercial obligations  within the framework of the contracts entered into or activities carried out with third parties, whether natural persons or legal entities,  who have a business relationship with Sümer Varlık,  performance of the obligations arising from contracts entered into by and between  Sümer Varlık and business partner/customer/supplier (authorized officers or employees), establishment of rights, protection of rights, commercial and legal assessment processes, analysis of legal and commercial risks, legal compliance process, carrying out financial transactions and their implementation in practice;        

In line with the purpose of setting and implementing the commercial and business strategies of Sümer Varlık; receivables collection operations, communication, research, procurement operations (request, proposal/offer, assessment, order, budgeting, contracting), campaigns, profiling and evaluations for campaigns, setting and implementing Sümer Varlık’s commercial and business strategies; in-company system and application management operations, management of legal operations;   

·          In line with the purpose of ensuring the execution of Sümer Varlık’s human resources policies; carrying out human resources operations in accordance with the human resources policies of Sümer Varlık, recruitment of personnel suitable for vacant positions in accordance and in compliance with human resources policies, fulfilling obligations within the framework of the Labor Law, Social Security Law and other legislation regulating business life and occupational health and safety, and taking necessary measures;    

c) To whom and for what purposes processed personal data can be transferred

Your personal data that has been collected can be transferred to persons, institutions or organizations required or permitted by provisions of the legislation and to the business partners, shareholders, affiliates and subsidiaries of Sümer Varlık only limited to the achievement of the purposes set forth above, and to competent authorities such as the Banking Regulation and Supervision Agency, Capital Markets Board, Central Bank of the Republic of Türkiye,  Financial Crimes Investigation Board (MASAK),  Banks Association of Türkiye Risk Center, Small and Medium Enterprises Development Organization of Türkiye (KOSGEB),  Revenue Administration (GİB), Undersecretariat of Treasury, Social Security Institution (SGK)  and to legally authorized public bodies and institutions such as ministries, judicial authorities, and to third parties, whether natural persons or legal entities, from whom Sümer Varlık receives services that are complementary or an extension of its activities and in cases where the legislation permits to consultants, organizations, third parties, local and international support services organizations and assistance companies including Credit Bureau of Türkiye (KKB) and FINDEKS  and contracted organizations,  financial institutions, independent audit firms, payment system organizations, card companies, banks, contracted lawyers, business partner call centers that make debtor and debt collection calls, and your personal data can be transferred to third parties resident and/or  located in the country within the scope of the requirements and purposes set forth in articles 8 and 9 of the Law no 6698  or foreign countries provided any such country is included in the list of safe countries or has adequate safeguards and technical measures for the protection of personal data as approved by the Personal Data Protection Authority.          

d) olmalı Methods and Legal Grounds of Collecting your Personal Data

 Your personal data is collected through channels  such as Sümer Varlık Head Office, social media, call center, customer interviews, market intelligence, Identity Sharing System, Address Sharing System, SMS, written/digital applications made to websites, written/digital applications made directly to debt collection teams, companies from which call center service is received, SSI records, PTT, Credit Bureau of Türkiye through which our Company contacts you or will contact in the future and is stored until the expiry of the legal obligation to store data. Your personal data collected by these methods may also be processed and transferred for the purposes specified in articles (b) and (c) of this Disclosure Statement within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law No. 6698.

e) Rights of data subjects enumerated under article 11 of the Law no 6698

As a data subject, if you submit your request regarding your rights enumerated under article of the Law no 6698 in compliance with the methods set forth below the COMPANY shall proceed, evaluate and conclude your request and conclude your request as soon as possible and within thirty days at the latest, depending on the nature of the request. There will be no charge for the answer to be given up to ten pages. A processing fee of 1 Turkish Lira will be charged for each page over ten pages. If the response to the application is given in a recording medium such as CD or flash memory, the fee that may be requested by our company will not exceed the cost of the recording medium. In this context, a data subject is entitled to ;

·         Learn whether your personal data has been processed,

·         Request information as to the processing if your personal data has been processed;

·        Learn the purpose of processing your personal data and whether such data is used in accordance with the purposes for what it is collected;

·        Request information about third parties located within the country or abroad to whom your personal data has been transferred 

·        Request rectification in the event your personal data has been processed incompletely or inaccurately and to request notification of the same to the third parties to whom your personal data has been transferred; 

·       Request deletion or destruction of personal data despite the fact that it has been processed in accordance with the Law no 6698 and other relevant applicable laws if the reasons requiring processing of such data no longer exist and, in this context, to request notification of the same to the third parties to whom your personal data has been transferred; 

·    Raise an objection to any adverse outcome or consequence to the detriment of or against them resulting from analyzing your processed data exclusively by automated systems

·     request compensation of your losses in the event you suffer or sustain any loss or damage due to the process of your personal data in violation

In accordance with paragraph 1 of Article 13 of the Law No. 6698 and the Communiqué No. 30356 dated 10.03.2018 on the Procedures and Principles of Application to the Data Controller, you can submit your request regarding the exercise of your rights enumerated under article 11 of the Law No 6698,  in Turkish and in writing or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature or the e-mail address previously notified to the COMPANY and registered in our system. In the applications, only information about the applicant will be given, and it will not be possible to obtain information about other family members and third parties. The COMPANY reserves the right to verify your identity before replying. In your application;

a.       Your name, surname and, if the application is in writing, your signature,

b.       For citizens of the Republic of Turkey, your Turkish ID number, if you are a foreigner, your nationality, passport number or identity number, if any,

c) Your residential or workplace address for notification, ç) Your e-mail address, telephone, and fax number, if any, for notification, and d) The subject of your request must be included, and information and documents related to the subject, if any, must be attached to the application. You can submit your applications that you want to make in writing by attaching the necessary documents to the address of our Company, as the data controller at Esentepe, Büyükdere Caddesi Öz sezen İş Merkezi B Blok Kat 1-2-3 No:124 ŞİŞLİ / İSTANBUL. You can access the application form here. You may also send your application to the kvkk@sumervarlik.com.tr  e-mail address via e-mail. You can also submit your applications that you want to make through the registered electronic mail (KEP) to our sumervarlik@hs01.kep.tr  KEP address. Depending on the nature of your request, information and documents that will allow identification must be provided to us completely and accurately. If the requested information and documents are not provided as required, there may be disruptions in the proper execution of the investigations to be carried out by the COMPANY based on your request. In such a case, the COMPANY reserves its legal rights. For this reason, your application must be submitted completely and containing the requested information and documents according to the nature of your request.

You can download the PDPL Application Form from here

SÜMER VARLIK YÖNETİM A.Ş.

PERSONAL DATA PROTECTION AND PROCESSING POLICY

 As Sümer Varlık Yönetim A.Ş. (Sümer Varlık), the confidentiality and security of your personal data is of great importance to us. The Personal Data Protection Policy of Sümer Varlık ("Policy"), sets out the principles adopted by Sümer Varlık for the protection and processing of personal data and should be taken into account in the implementation of data processing. Within the scope of the Law No. 6698 on the Protection of Personal Data, Sümer Varlık meets the general principles and conditions set forth in the legislation regarding the protection and processing of personal data as the "data controller" and acts in accordance with the principles listed below in order to ensure that personal data is processed in accordance with the Constitution and the Law on the Protection of Personal Data. Compliance of Personal Data Processing Activities with the Law and the Rule of Good Faith In accordance with Article 4 of the PDP Law, Sümer Varlık processes personal data in accordance with the law and the rule of honesty, adopts the principle of "transparency" towards data subjects and informs personal data subjects. Disclosure is based on openness and honesty, clear information is given about the purpose of use of the collected personal data, and the data is processed within this framework. It is essential that personal data is not used in a way that will cause an adverse impact on the data subject without any legal justification. Ensuring that Personal Data is Accurate and Up to Date When Necessary Sümer Varlık ensures that the personal data it processes is accurate and up to date.  Processing Personal Data for Specific, Explicit and Legitimate Purposes Sümer Varlık collects and processes personal data legitimately and in accordance with the law.  It processes personal data in connection with the activities it carries out, within a reasonable framework and to the extent necessary. Being Relevant, Limited, and Proportionate to the Purposes for which they are Processed Sümer Varlık refrains from processing personal data that is not related to the purpose of processing or is not needed. In this context, it is essential to minimize data processing activity. Being stored for the period laid down by relevant legislation or the period required 1for the purpose for which the personal data is processed. Sümer Varlık retains the personal data it processes only for the period stipulated in the relevant legislation and laws or required by the purpose of processing personal data. In this context, first of all, it is determined whether a certain period of time is stipulated in the relevant legislation for the storage of personal data subject to processing. If a legal period has been set, then this period is complied with. If the legal period has not been set, then the period required for the achievement of the purpose of processing is determined and personal data is stored limited to this period. When the period expires, personal data is deleted, destroyed, or anonymized unless there is a legal reason to store the data for a longer period of time.