Personal Data Processing Clarification Text
Dear Customers,
This Clarification Text provides details about which of your personal data is processed and for what purposes, as well as the third parties with whom your personal data is shared, your rights, and how you can contact Whitebit Kripto Varlık Alım Satım Platformu Anonim Şirketi (hereinafter referred to as the "Company"). The Clarification Text has been prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 (KVK Law) for the transparent processing of personal data for the purposes of providing our Company's platform services and executing contractual processes within this scope.
Our Company operates as a crypto asset service provider, and the processing of personal data is carried out in accordance with the Capital Markets Board and the Prevention of Money Laundering legislation.
IDENTITY OF THE DATA CONTROLLER
Whitebit Kripto Varlık Alım Satım Platformu Anonim Şirketi is the "Data Controller" for the personal data included in this clarification text, in accordance with Article 3, Paragraph 1, Item (ı) of the KVK Law.
As the data controller, our company takes all necessary measures to prevent the unlawful use of personal data, ensure its preservation, and provide an appropriate level of security in accordance with the legislation during the processing and transfer of personal data. Your personal data is processed primarily in accordance with the provisions of the Personal Data Protection Law, the Turkish Code of Obligations, the Turkish Commercial Code, the Consumer Protection Law, the Capital Markets Law, and other relevant legislation.
Your personal data may vary depending on the service, product, or commercial activity provided by our Company, but it is processed in accordance with the principles set out below, pursuant to Article 4 of the KVK Law:
a) In compliance with the law and principles of good faith
b) Accurate and, where necessary, up-to-date
c) For specific, explicit, and legitimate purposes
d) In connection with, limited to, and proportionate to the purpose for which they are processed
e) Retained for the period required by the relevant legislation or necessary for the purpose for which they are processed
PURPOSE AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
| Processed Personal Data | Data Processing Purposes | Legal Basis for Data Processing | |
|---|---|---|---|
| Data Category | Data Type | ||
| Identity | Name, Surname, Turkish ID Number, Signature, Gender, Date of Birth, Mother/Father's Name, Citizenship Information, ID Serial Number, ID Information | Execution of Individual Customer Registration and KYC (Know Your Customer) Processes Execution of Communication Activities and Provision of Necessary Information within the Scope of the Contract Execution of Sales Processes for Crypto Asset Purchase, Sale, Transfer, and Storage Services Execution of Service Production and Operational Processes Identifying Customers, Performing Identity Verification and Confirmation Procedures Ensuring that customer information is accurate, complete, and up-to-date Providing Post-Sales Support Services Management of Contract Processes Conducting Risk Management and Audit Activities Execution of Storage and Archiving Activities Fulfilling Contractual Obligations Creation of User Account Definitions Management of Customer Relationship Processes and Activities Aimed at Customer Satisfaction Tracking Customer Requests and Complaints Ensuring the Security of Data Controller Operations Conducting Activities in Compliance with Legislation and Performing Necessary Audits Execution of Finance and Accounting Operations Providing Information to Authorized Persons, Institutions, and Organizations | KVK Law m.5/2-c The processing of personal data belonging to the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract KVK Law m.5/2-ç It is mandatory for the data controller to fulfill its legal obligations KVK Law Article 5/2-e Processing is necessary for the establishment, exercise, or defense of a legal claim. KVK Law m.5/2-f Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. |
| Communication | Address, Phone Number, Email Address, | ||
| Finance | IBAN Number, Account Number, Bank Name, Invoice Information, Account Information, Account Transactions, Money and Crypto Asset Transfer Transaction Information, Financial Income Status Information, Monthly Income Information Financial Transaction Information, Reason for Income Generation, Financial Liability Information, Investment Budget Information Crypto asset wallet address, Blockchain transaction hash information, On-chain transfer records, Network verification records | ||
| Customer Transaction | Customer Number/ID, Account Number, Username, Account Opening Date, Membership Information, Account Information, KYC Status Information, Billing Information, Request Information, Complaint Information, Contract Information, Payment and Collection Information, Occupation/Title Information | ||
| Transaction Security | User Account Information, IP Information, Website Login/Logout Information, Traffic Data Connection Information | Management of Information Security Processes Execution of Crypto Asset Platform Service Sales Processes Fulfillment of Contractual Obligations Execution of Storage and Archiving Activities Creation of User Account Definitions Providing Information to Authorized Persons, Institutions, and Organizations | KVK Law Article 5/2-c Necessary for the data controller to fulfill its legal obligations KVK Law m.5/2-c The processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract |
| Visual and Audio Recordings | Person's Photo, Video Recording | Identification of Customers, Identity Verification and Confirmation Processes Ensuring that Customer Information is Accurate, Complete, and Up-to-Date Performing User Account Verification Execution of Storage and Archiving Activities | |
| Risk Management | Commercial/Technical Risk Information Risk Score AML risk classification result PEP check result Sanctions list (OFAC, EU Sanctions, etc.) check result Suspicious transaction assessment notes | Management of Risk Assessment Processes for Prospective Customers Conducting Necessary Reviews to Identify Risks Associated with Customers' Financial Transactions Conducting Audit Activities Execution of Storage and Archiving Activities | KVK Law Article 5/2-c Necessary for the data controller to fulfill its legal obligations KVK Law m.5/2-f Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
| Legal Proceedings | Court Case File Information, File Number, Enforcement File Information, Seizure Information, Prosecutor's Investigation Information/Number, Official Letter Information/Number, Attorney Information, Correspondence Information with Official Authorities | Conducting Activities in Compliance with Legislation Monitoring and execution of legal matters Providing Information to Authorized Persons, Institutions, and Organizations Execution of Storage and Archiving Activities | KVK Law m.5/2-a Explicitly provided for in the laws KVK Law m.5/2-ç Necessary for the data controller to fulfill its legal obligations KVK Law Article 5/2-e Data processing is necessary for the establishment, exercise, or defense of a legal claim. |
| Biometric Data (Special Category Personal Data) | Facial Recognition Information | Conducting Activities in Compliance with Legislation Conducting Liveness Tests and User Authentications in accordance with Remote Identity Verification Processes Providing Information to Authorized Persons, Institutions, and Organizations | KVK Law 6/3-b Explicitly stipulated in the laws |
| Identity | First Name, Last Name | Establishing Communication for Celebration and Congratulation Purposes on Special Days Conducting commercial electronic message sending activities | KVK Law Article 5/1 Explicit Consent |
| Communication | Phone Number, Email Address | ||
| Marketing | Individual Preferences, Targeting Information, Marketing Analysis Data | Execution of Advertising/Campaign/Promotion Processes Execution of Company/Product/Service Loyalty Processes Execution of Marketing Analysis Studies Receiving and Evaluating Recommendations for Improving Business Processes Creation of Potential Customer Records | KVK Law m.5/1 Explicit Consent |
METHOD OF COLLECTING PERSONAL DATA
Your personal data is collected from membership application forms you fill out on our Company's corporate website or applications, copies of documents such as identity cards, passports, residence permits, written communication channels and applications such as e-mail, messages, etc., verbal interviews, documents such as invoices, receipts, and vouchers, live test systems on our corporate website or mobile applications, as well as in physical or electronic environments, directly from you or from third parties you have disclosed to our Company for the purpose of communication, and in necessary cases, with your explicit consent, in compliance with the general principles under Article 4 of the KVK Law.
TRANSFER OF YOUR PERSONAL DATA
Your collected personal data may be transferred within the framework of the personal data processing conditions set out in Articles 8 and 9 of the KVK Law.
1. Based on the legal grounds of "explicitly stipulated by law" as regulated in Articles 5/2 (a) and 6/3 (b) of the KVK Law; your personal data may be transferred to the Capital Markets Board, MASAK, and other authorities requesting information for the purpose of fulfilling the necessary notifications within the scope of fulfilling the obligations arising from legislation, primarily the provisions of the Law on the Prevention of Money Laundering of Criminal Proceeds. the Law on the Prevention of Money Laundering, and other legislation, to authorized persons, public institutions, and organizations such as the Capital Markets Board, MASAK, and MKK, which request information for the purpose of making the necessary notifications to fulfill the obligations arising from the legislation.
2. Based on the legal grounds of "establishment and performance of a contract" as stipulated in Article 5/2 (c) of the KVK Law; your personal data may be transferred to the relevant banks and payment institutions with which you conduct transactions on your account within the framework of our company's crypto asset wallet services.
3. Based on the data processing condition stipulated in Article 5/2 (ç) of the KVK Law, namely "the necessity of data processing for the fulfillment of the Company's legal obligations"; your personal data may be transferred to courts and public institutions and organizations requesting information for the purpose of making legal notifications, to storage institutions, financial advisors, accounting firms, and independent auditors for the purpose of fulfilling legal obligations arising from legislation.
4. Based on the data processing condition stipulated in Article 5/2 (e) of the KVK Law, "for the establishment, exercise, or protection of a right"; your personal data may be transferred to law firms and other consultants for the purposes of providing evidence in potential disputes, obtaining legal advice and technical support, enforcing the contract, and monitoring whether the parties comply with their obligations.
5. Based on the "legitimate interest" data processing condition stipulated in Article 5/2 (f) of the KVK Law; your personal data is transferred to domestic suppliers and/or archiving companies for the purposes of ensuring commercial security, storing your personal data securely, using accounting programs and archive services, obtaining accounting programs, electronic storage, infrastructure server services, backup services or systems, as well as to service providers and/or archiving companies within the country for the purposes of preventing fraud, combating money laundering, and conducting risk analysis processes.
6. The existence of a standard contract containing the appropriate safeguards stipulated in Article 9/4 of the KVK Law, such as "data categories, purposes of data transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, and additional measures taken for special categories of personal data, as announced by the Personal Data Protection Board." Based on the data processing condition, your personal data may be transferred to overseas-based suppliers to whom our Company provides services for the purposes of conducting communication activities, electronic or physical data storage, cloud service usage, backup services or systems; to overseas-based identity verification service providers from whom services are obtained for the purposes of conducting remote identity verification and liveness testing processes; to foreign-based accounting programs for the purposes of managing finance and accounting processes and utilizing archiving services; to our global affiliates located abroad for the purposes of conducting business continuity and cooperation activities, managing joint economic activities, and providing information in accounting processes.
STORAGE OF YOUR PERSONAL DATA
Your personal data will be stored and destroyed within the period specified in the Storage and Destruction Policy, which is regulated in accordance with Article 7 of the KVK Law, based on one of the data processing conditions specified in Article 5 of the KVK Law and in accordance with the general principles specified in Article 4 of the KVK Law, especially for the period required by the relevant legislation or necessary for the purpose. in accordance with the retention periods specified in the Retention and Destruction Policy established pursuant to Article 7 of the KVK Law, and destroyed within the destruction period.
YOUR RIGHTS AS A DATA SUBJECT UNDER ARTICLE 11 OF THE KVK LAW
1. The right to learn whether your personal data is being processed,
2. To request information regarding the processing of your personal data if it has been processed,
3. To learn the purpose of the processing of your personal data and whether they are being used in accordance with that purpose,
4. To know the third parties to whom your personal data has been transferred within or outside the country,
5. To request the correction of your personal data if it has been processed incompletely or incorrectly, and to request that this action be communicated to third parties to whom your personal data has been transferred,
6. To request the deletion or destruction of your personal data if the reasons for processing it no longer exist, even if it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and to request that this action be communicated to third parties to whom your personal data has been transferred,
7. Object to a result being reached against you solely through the analysis of processed data by automated systems,
8. You have the right to request compensation for damages incurred due to the unlawful processing of personal data.
APPLICATION TO THE DATA CONTROLLER
As the data subject, you may submit your requests regarding your rights in writing or to the Data Controller in accordance with the procedures and principles set forth in the Communication on the Procedures and Principles for Applying to the Data Controller (https://www.resmigazete.gov.tr/eskiler/2018/03/20180310-6.htm) , our Company will process your request free of charge as soon as possible and within a maximum of thirty days, depending on the nature of the request. However, if the process incurs additional costs, the Company will charge the fee specified in the tariff determined by the Personal Data Protection Authority.
Information Regarding the Data Controller
Data Controller Title: Whitebit Kripto Varlık Alım Satım Platformu Anonim Şirketi
Data Controller Address: Fulya Mahallesi, Büyükdere Caddesi, Torun Center, A Blok, No:74 A, Inner Door No:31, Şişli, Istanbul
Data Controller's Website Address: www.whitebit-tr.com
Data Controller's Email Address: support@whitebit-tr.com