Koç Finansman Anonim Şirketi Processing of Personal Data Explanatory Statement
Application Form   Personal Data Processing Policy


a) Data Controller

Pursuant to the Law on the Protection of Personal Data No. 6698 (“Law”), your personal data may be processed by Koç Finansman Anonim Şirketi (“Company”) as the data controller within the scope described below.
For detailed information regarding the purposes of processing your personal data by our Company, please refer to the Koç Finansman Anonim Şirketi Personal Data Protection and Processing Policy (“Policy”), publicly available at:
https://www.kocfinans.com.tr/media/2665/politika.pdf.


b) Purposes of Processing Personal Data and Legal Basis

Your personal data collected may be processed by our Company for the following purposes (“Purposes”) and on the legal bases set out in Articles 5 and 6 of the Law.

Based on the legal ground of “necessity of processing the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract”:
· Updating customer contact information,
· Execution and monitoring of loan application and loan disbursement processes, issuance and tracking of insurance policies,
· Monitoring of loan repayment transactions,
· Conducting financial risk scoring and credit intelligence checks regarding you, your guarantor (if any), your company partners and representatives, or your first-degree relatives, if required for risk assessment,
· Submission of insurance offers and issuance of related policies.


Based on the legal ground of “explicitly stipulated by law” or “mandatory for the data controller to fulfill its legal obligations”:
· Responding to official authority requests,
· Providing information to authorized institutions as required by legislation,
· Ensuring compliance with legal retention obligations,
· Responding to data subject applications in accordance with the law,
· Compliance with financial regulations, prevention of money laundering and financing of terrorism, compliance with sanctions and embargo regulations,
· Combating tax evasion and fulfilling tax control and reporting obligations.


Based on the legal ground of “necessity of processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”:
· Managing customer relations,
· Monitoring financial and insurance transactions,
· Event management,
· Conducting necessary work by our business units to ensure customers benefit from our products and services, including sales and marketing activities, and carrying out related business processes,
· Conducting necessary work by our business units to carry out the commercial activities of our Company and related business processes,
· Ensuring legal, technical, and commercial-business security of our Company and business partners,
· Determining and implementing commercial and business strategies of our Company,
· Conducting and following up legal affairs,
· Managing information security processes,
· Conducting audit and ethics activities,
· Planning and executing customer satisfaction and corporate communication activities,
· Carrying out sweepstakes, campaigns, contests, promotions, or advertising activities,
· Measuring the performance and quality of lending processes,
· Managing risk in credit processes,
· Conducting financial risk scoring and credit intelligence checks for you, your guarantor (if any), your company partners and representatives, or your first-degree relatives, if required for risk assessment.


Based on the legal ground of “necessity for the establishment, exercise, or protection of a right”:
· Receiving, evaluating, and resolving your requests and complaints,
· Retaining personal data during the statutory limitation period for evidentiary purposes in possible future disputes.


Based on your explicit consent:
· Processing your contact, identity, financial, and customer data for the purposes of conducting marketing processes for our Company’s products and services, including profiling and analysis activities, to offer and promote customized products and services tailored to your preferences, usage habits, and needs,
· Processing your identity, financial, and contact data to send commercial electronic messages (advertisements, promotions, etc.) via your preferred communication channel, within the scope of your communication consent.


c) Transfer of Processed Personal Data

For the fulfillment of the above-mentioned Purposes, your personal data may be transferred to our business partners, suppliers, legally authorized public institutions, and legally authorized private parties, in compliance with the personal data processing conditions set forth in Articles 5 and 6 of the Law and the rules on data transfer specified in Article 8 of the Law.


ç) Method and Legal Basis of Collecting Personal Data

Your personal data is collected by our Company electronically and physically through the following channels, within the scope of fulfilling the above-mentioned Purposes:
· E-mail, call center, courts or official authorities,
· Our Company’s websites and microsites, mobile application, and social media accounts,
· Our business partner dealers and vehicle sales internet platforms,
· Fax, SMS, Credit Bureau (KKB), CCTV,
· Physical forms and documents,
· Platforms such as the General Directorate of Security’s vehicle pledge information system, MERNIS address verification system, and the Revenue Administration’s tax certificate inquiry system.


d) Rights of the Data Subject under Article 11 of the Law

Pursuant to Article 11 of the Law, you have the following rights regarding your personal data:
· To learn whether your personal data is processed,
· To request information if your personal data has been processed,
· To learn the purpose of processing and whether it is used in accordance with its purpose,
· To know the third parties to whom personal data is transferred domestically or abroad,
· To request correction of personal data if it is incomplete or incorrectly processed, and request notification of such correction to third parties,
· To request deletion or destruction of personal data if the reasons requiring its processing cease to exist, and request notification of such deletion to third parties,
· To object to the occurrence of a result against yourself through the analysis of processed data exclusively by automated systems,
· To request compensation if you suffer damage due to unlawful processing of personal data.


To exercise your rights, you may complete the Application Form and submit it with necessary identity verification documents:
· By delivering a signed copy in person to Ünalan Mahallesi Ayazma Caddesi Koç Çamlıca İş Merkezi A Blok 34700 Üsküdar / İstanbul,
· By sending it via notary public or other methods specified in the Law,
· Or by sending it with a secure electronic signature to [email protected]


Our Company will finalize your request as soon as possible and within thirty (30) days at the latest, free of charge depending on the nature of the request. However, if the process incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.



Privacy Notices for Different Data Subjects