This document has been prepared to inform you about the processing of your personal data within the framework of Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”).
1. Who Processes Your Data?
As Mudi Finansal Teknoloji Hizmetleri A.Ş. (the “Company”), Levazım Mah. Koru Sk. Zorlu Center Blok No: 2 İç Kapı No: 21 Beşiktaş / İstanbul, www.getmundi.app, in our capacity as Data Controller under the Law with respect to the personal data we obtain from you, our Customers, we process your personal data that we request and that you have shared with us within the framework of the purpose requiring their processing and in a manner relevant, limited and proportionate to this purpose, keeping them accurate and in their most up-to-date form, to the extent explained below.
2. Which Personal Data Do We Process, for What Purposes and on What Legal Grounds?
As you are a natural-person Customer, our being able to work with you and to fulfill our mutual obligations requires us to process your personal data. In this context, we process and store your personal data in compliance with the law and the rules of good faith, accurately and, where necessary, kept up to date; for specified, explicit and legitimate purposes; and in a manner relevant, limited and proportionate to the purpose.
In this context:
- Your identity information (for example, name, surname, date of birth, place of birth, mother’s name, father’s name, Republic of Türkiye Identity No.);
- Your contact information (mobile phone number, e-mail address, address);
- Your Visual and Audio Information (photograph);
- Your occupational information (occupation);
- Financial information (in particular the information needed to complete the financial transactions you will carry out with the Third-Party Service Providers that are our business partners, for example, monthly income information, total assets information, source of assets, your IBAN, information on the Bank to which your account belongs, balance information, deposit type, deposit amount, investment preferences, return preferences);
- Transaction security information (username, password information, title, content of web forms, IP addresses, electronic log and record information relating to your use of our website and mobile application, such as the path you follow on our website and mobile application, traffic data);
- Customer transaction information (requests and instructions needed for the use of products and services, call center records, request information);
- Marketing (customer behavior information, surveys, cookie records, information obtained through campaign work, MAC ID, etc.);
- Risk management information (information processed to manage commercial, technical and administrative risks);
For the purposes of carrying out emergency management processes, carrying out information security processes, carrying out audit/ethics activities, managing access authorizations, carrying out activities in compliance with the legislation, carrying out finance and accounting affairs, carrying out company/product/service loyalty processes, following up and carrying out legal affairs, carrying out communication activities, carrying out / auditing business activities, receiving and evaluating suggestions for improving business processes, carrying out activities to ensure business continuity, organization and event management, carrying out goods / service production and operation processes, carrying out after-sales support and sales processes, carrying out customer relations processes, carrying out activities for customer satisfaction, carrying out marketing analysis studies, carrying out analysis and internal reporting activities, carrying out advertising/campaign/promotion processes, carrying out contract processes, carrying out risk management processes, carrying out storage and archiving activities, carrying out strategic planning activities, following up requests/complaints, carrying out marketing processes for products/services, ensuring the security of data controller operations, carrying out investment processes, preventing fraud within the scope of providing information to authorized persons, institutions and organizations, and combating crimes committed via the internet, we process the personal data belonging to our Customers within our Company.
We manage data processing operations by combining these purposes with the legal grounds below. Indeed, in this context:
We process your personal data on the legal ground of carrying out lawfully the processes of establishing, performing and terminating your customer agreement, for example storing documents such as user agreements, approved protocols and/or agreements and petitions, providing support services under these agreements, etc.
Cases expressly provided for by law (for example, internet access records, traffic data, etc. kept under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications) also constitute the bases for our data processing.
We also process your data on the ground of fulfilling our legal obligations in our relationship with our Customers (for example, processing your bank account information and your address so that the data transfer needed for use in the transactions you will carry out with our business partners can be made, etc.).
Cases where data processing is mandatory for the establishment, exercise and protection of a right (for example, conducting legal proceedings in disputes) and, in other cases, your consent, which we will request from you and which you will give explicitly, on an informed basis and of your own free will, constitute the main legal bases for processing personal data.
Our activities required by our Company’s field of business, in cases where data processing is mandatory for our Company’s legitimate interests, provided that this does not violate your fundamental rights and freedoms (the accurate and complete transmission of our instructions to our business partners so that a full and complete service can be provided through our mobile application and website to you, our Customers who benefit from our Company’s services, etc.), make it necessary to process your personal data. Indeed, we carry out data processing activities for the reasons of preventing abuse, preventing irregular transactions from being carried out, preventing theft, conducting internal audits and investigations, identifying confidential information, secrets or other important information belonging to the Company, and ensuring general security and occupational safety. However, in this case too, we take great care not to harm your fundamental rights and freedoms.
As a rule, your special categories of (sensitive) data are not among the personal data we process. At this point, in the process of sending the necessary documents within the framework of your customer relationship with our Company: when you send your identity information, since copies of old identity cards may contain the religion field and information on your blood group, and since this information is special categories of personal data, we strongly request that you do not give it to us or that you give it to us blacked out.
We categorize the personal data we process as “Identity Information, Contact Information, Visual and Audio Information, Occupational Information, Financial Information, Customer Transaction Information, Marketing, Transaction Security Information, Risk Management Information”.
In this context, the lawful conduct of the processes of establishing, performing and terminating your agreement; our Company’s legitimate interests, provided that they do not violate your fundamental rights and freedoms; cases expressly provided for by law; the fulfillment of our legal obligations in our relationship with our customers; cases where, in legal proceedings, data processing is mandatory for the establishment, exercise and protection of a right; and, in other cases, your consent, which we will request from you and which you will give explicitly, on an informed basis and of your own free will, constitute the legal bases for processing personal data.
There are many rules in the Company’s policies and procedures regarding the processing of your personal information. On this subject, you can review our Personal Data Protection and Processing Policy, available in the Settings > Legal Information section of our mobile application and on our website at www.getmundi.app/en/legal-information.
3. For What Purposes and on What Legal Grounds Do We Transfer Your Personal Data?
Your personal data will be shared, to the extent necessary to achieve the purposes set out above and to fulfill obligations arising from the law, and provided that this is limited to these purposes, with (a) Natural Persons or Private Law Legal Entities, (b) Business Partners, Suppliers and Third-Party Service Providers, (c) Shareholders, (d) Authorized Public Institutions and Organizations, (e) Business Partners, Suppliers (Third-Party Service Providers) Abroad. We set out the persons with whom data are shared and the purposes and legal grounds of the sharing as follows:
(a) Natural persons or private law legal entities: In this context, in particular, so that the Company can continue its activities (performance of the contract), with lawyers and legal advisers (data processing being mandatory for the establishment, exercise and protection of a right in cases of legal proceedings) and consultancy companies (performance of the contract, the Company’s legitimate interests),
(b) Business Partners, Our Suppliers (Third-Party Service Providers): the firms from which we receive services and consultancy for carrying out the agreements made to conduct the Company’s business and activities and the contractual and commercial relationships established, and for ensuring the efficiency and security of our Company processes and conducting them lawfully and properly, audit companies, our suppliers, our subcontractors, our business partners (Tacirler Yatırım Menkul Değerler A.Ş.), service-providing companies
(telecommunications companies, banks, etc.) (fulfillment of legal obligations, performance of the contract, our company’s legitimate interests): we require the third-party service providers to which we make transfers, such as these, to meet legal data protection standards, and we sign confidentiality agreements with our third-party service providers that commit to the security of your personal data.
(c) Our Shareholders: with our Shareholders, in connection with processes such as fulfilling obligations arising from the Turkish Commercial Code No. 6102, Company reporting and audits (fulfillment of legal obligations, the company’s legitimate interests),
(d) Authorized Public Institutions and Organizations: Where necessary, in particular within the scope of the stated data processing purposes, your personal data may be shared with legally authorized public institutions and organizations (cases expressly provided for by law, fulfillment of legal obligations, the Company’s legitimate interests).
(e) Business Partners, Suppliers (Third-Party Service Providers) Abroad: Our Company may need to share data abroad with our business partners, suppliers and Third-Party Service Provider companies that are resident abroad or whose servers are located abroad (such as Sosyo Plus Bilgi Bil. Tekn. Dan. Hiz. Tic. A.Ş., Adjust GmbH, Zendesk Inc., Meta Platforms Inc, Google LLC), for the agreements made to conduct the Company’s business and activities and for ensuring the efficiency and security of our Company processes and conducting them lawfully and properly. In this case, again in line with the data processing purposes and principles, we make transfers to foreign countries within the scope of your explicit consent in accordance with the provisions of the legislation. We carry out our work with these organizations in accordance with the principles and rules in the law, taking the necessary security measures through the special KVK Data Transfer Agreements and confidentiality agreements we have signed.
Meeting scheduling: When you choose a meeting time from the calendar that opens with the Book a demo button on our website or after you submit the contact form, your name, e-mail address, company name and the meeting time you chose are shared with Cal.com, Inc. for the purpose of arranging the meeting. The page from which you opened the calendar and, if any, the values you entered in the calculator on that page are also added to this information. Cal.com processes this data in the United States of America.
So that these processes of ours can be carried on securely, we request your explicit consent for your personal data to be transferred abroad.
4. Security and Storage of Your Personal Data
We store your personal data in secure environments and, if a transfer is to be made, take the necessary measures in this regard. We store your information in our Company’s locked archive and in tools and applications for which security measures have been taken. So that your personal data are not exposed to unauthorized access, lost or damaged in the environments where they are processed and stored, we process them, provided that they are not used outside the notified purpose and scope, by encrypting them where necessary, in a way that only authorized persons can access, and by also taking the other necessary information security measures.
We primarily store your collected personal data for the periods made mandatory in the relevant legislation. If legal requirements call for a specific period to be applied, we act in accordance with those periods. If an act constituting an offense is involved, your personal data are kept for the limitation period laid down in Turkish Criminal Code No. 5237 and the relevant legislation.
5. How Do We Collect Your Personal Data?
We obtain the great majority of the personal data we process from the information you provide, physically or electronically, within the framework of the relationship between our Company and you, our Customers. The information we process may be collected by non-automated methods on paper (such as surveys and application forms), and personal data may also be collected partly or wholly through methods such as all written/digital applications made via the website and/or mobile application, as well as documents sent by e-mail, electronic forms, information and documents you share through written and oral communication with our Company via online channels, information and documents you have sent to our Company by means such as SMS, fax or letter, post, parcel or courier services, information and documents you share in calls with the call center or directly with our Company and/or our business partners, all kinds of agreements you have signed with our Company, and personal data you share orally, in writing or electronically by any other means.
6. What Are Your Rights Regarding Your Personal Data?
Under Article 11 of the Law, you have the right, with regard to your personal data, to:
a) learn whether they are processed,
b) request information if they have been processed,
c) learn the purpose of their processing and whether they are used in accordance with that purpose, ç) know the third parties to whom they are transferred domestically/abroad,
d) request their rectification if they have been processed incompletely / incorrectly,
e) request their erasure / destruction within the framework of the conditions laid down in Article 7 of the Law,
f) request that the operations carried out under sub-paragraphs (d) and (e) above be notified to the third parties to whom they have been transferred,
g) object to a result arising to your detriment because they are analyzed exclusively through automated systems, ğ) claim compensation for the damage if you suffer damage because they are processed unlawfully.
To exercise your rights set out above, you may make your request, containing the information needed to identify you and your explanations regarding the right you wish to exercise among the rights set out in Article 11 of the Law, by filling in the form available in the Settings > Legal Information section of our Company’s mobile application and on its website at www.getmundi.app/en/legal-information, and deliver it by hand in person to our Company’s address at Levazım Mah. Koru Sk. Zorlu Center Blok No: 2 İç Kapı No: 21 Beşiktaş / İstanbul together with documents identifying you, send it through a notary public, or send it by registered e-mail to our Company’s KEP address nemateknoloji@hs01.kep.tr, or you may apply by other methods determined by the Personal Data Protection Authority.
I have received, read and understood the privacy notice above.
Customer Receiving the Privacy Notice: Full Name: Signature:
□ I confirm that I have received, read and understood the privacy notice above.