Personal Data Disclosure Text

1. Data Controller

As Siemens Financial Leasing Inc. (“Siemens Leasing” or “Company”), we show utmost care regarding the security and confidentiality of your personal data. With this awareness and as the data controller under the Personal Data Protection Law No. 6698 (“Law”), we present the following information to you within the scope of our disclosure obligation to ensure our compliance with the Law regarding the personal data we obtain.

This Siemens Financial Leasing Inc. Personal Data Protection Disclosure Text (“Disclosure Text”) is prepared by Siemens Financial Leasing Inc. as the data controller in accordance with the Law, Banking Law No. 5411, Financial Leasing, Factoring, Financing and Savings Financing Companies Law No. 6361, and other relevant legislation and their sub-regulations, for the purpose of protecting the personal data of customers, suppliers, prospective customers/suppliers, guarantors, visitors, and other third parties. Under the Law, “Data Processing” refers to any operation performed on personal data, such as obtaining, recording, storing, updating, classifying, sharing with or transferring to third parties permitted by law, entirely or partially through automated means, or non-automated means provided that it is a part of a data recording system.

With this Disclosure Text, our Company aims to inform data subjects about their rights, the purpose and legal reasons for processing their personal data, its transfer, collection methods, and security measures, primarily to protect fundamental rights and freedoms of individuals, especially privacy, in the processing and transfer of personal data belonging to real persons and/or representatives/authorized persons/employees of legal entities with whom our Company establishes a relationship, within the framework of Article 20 of the Constitution, the Law, and other applicable primary and secondary legislation.

As Siemens Leasing, the data controller, we maintain all personal data shared by you by acting in accordance with the Law and other relevant legislation and by taking all necessary technical and administrative measures to ensure an appropriate level of security.

2. Processing of Personal Data and Purposes of Processing

For the purpose of providing the products and services offered by Siemens Leasing in the best possible way, personal data of the data subjects specified below, and special categories of personal data where necessary, may be processed in accordance with the Law, banking legislation, and the principles set forth in our Company's Personal Data Protection Policy.

a) Information of our Company's real person merchants and/or legal entity suppliers, their employees/contact persons/partners/authorized persons, b) Information of our Company's real person merchants or legal entity customers, their employees/contact persons/partners/authorized persons, and in some cases, third parties such as guarantors or family members designated by our customers, c) Information of our Company's real person merchants or legal entity prospective customers, their employees/contact persons/partners/authorized persons, and other third parties who have applied to our Company.

The identity and contact information, education and professional information, legal information, financial/monetary data, customer transaction data, individual/corporate commercial data, visual/communication records, meeting notes, marketing data, and, where necessary, special categories of personal data belonging to these identified persons are processed by our Company, to the extent appropriate for the purpose, and limited to the services or activities specified below:

• Carrying out identity verification and customer and supplier registration processes,
• Fulfilling obligations arising from Financial Leasing, Factoring, Financing and Savings Financing Companies Law No. 6361, Banking Law, Law on Prevention of Laundering of Criminal Proceeds, Law on Prevention of Financing of Terrorism, international agreements, secondary regulations, and related legislation, including but not limited to cases mandated by regulatory and supervisory institutions and public authorities,
• Providing products and/or services, carrying out, supervising, and evaluating the established commercial relationship,
• Evaluating financial data and carrying out the credit approval process,
• Carrying out and monitoring collateral transactions,
• Carrying out contract processes, goods and service procurement processes, goods and service sales and after-sales support services, and monitoring operational transactions,
• Managing customer relations, and within this scope, improving and developing business processes, determining strategies, conducting analysis, surveys, and reporting studies, carrying out brand, product, and service loyalty processes, preparing announcements and press releases,
• Managing marketing analysis studies and advertising, campaign, and promotion processes,
• Using in transactions related to external service procurements, provided that necessary technical and administrative measures are taken to ensure that the services offered are provided efficiently, to the highest degree, with quality, and beneficially,
• Carrying out insurance activities for commercial business/transactions and equipment,
• Carrying out insurance services activities that we mediate or provide as an agent within the scope of applicable legislation,
• Monitoring and auditing legal and regulatory compliance work and ensuring that activities are carried out in accordance with legislation,
• Carrying out finance, accounting, reporting, and collection operations,
• Keeping location and other tracking information of our Company's vehicles and equipment,
• Keeping your traffic information records in accordance with Law No. 5651,
• Organizing meetings, events, training, conferences, or similar activities,
• Carrying out corporate communication activities and implementing our Company's sustainability goals,
• Executing business operations and managing relations with our Company's main partner, branches, affiliates, and subsidiaries,
• Ensuring and auditing information systems security and continuity within the scope of data security,
• Creating visitor records and ensuring the security of our workplaces,
• Ensuring occupational health and safety measures,
• Carrying out independent audit and reporting activities, and internal audit/investigation/intelligence activities,
• Ensuring the security of the data controller's operations through risk management processes,
• Providing information to authorized persons, institutions, and organizations upon request, and carrying out information security processes,
• Carrying out storage and archiving processes,
• Using for risk management, preparation of consolidated financial statements, and internal audit activities of our main partner Siemens Aktiengesellschaft (“Siemens AG”),
• Fulfilling obligations arising from legislation and ensuring compliance with the policies and procedures of Siemens Aktiengesellschaft (“Siemens AG”) and other legal entities within Siemens AG.

3. To Whom and For What Purposes Personal Data May Be Transferred

The procedures and principles to be applied in personal data transfers are regulated in Articles 8 and 9 of the Law, and the personal data and special categories of personal data of the data subject may be transferred to third parties domestically and abroad in compliance with the legislation. For the performance of services, your personal data may be processed and shared with third parties by Siemens Leasing, including but not limited to cases mandated by the Law, regulations, and other legislation, as well as regulations of regulatory and supervisory institutions and organizations, and public authorities.

Your collected personal data may be transferred to domestic and international affiliated companies and subsidiaries within our Company's group of companies, our main partner, other relevant third parties including organizations and consultants that our main partner receives information systems infrastructure support from together with our Company, third-party service providers/suppliers that our Company receives services from, lawyers for the resolution of legal disputes, real and legal persons with whom we have a power of attorney relationship, independent audit firms, consultancy firms, insurance companies with whom we cooperate for insurance transactions including third parties we mediate and act as agents for, guarantors and firms whose services we benefit from and with whom we cooperate including our suppliers, cloud service providers and main software firms that provide our Company's commercial record keeping services, our Company's dominant partner and group companies for the purpose of compliance with the policies and procedures of the company group to which the Company is affiliated, and to official institutions and organizations upon request, for the purposes explained in Article 2 of this Disclosure Text and limited to the reasons requiring transfer within the scope of the Law and relevant legislation.

Domestic Transfer of Personal Data

Personal data is transferred domestically in accordance with Article 8 of the Law, provided that one of the conditions specified in Article 4 of this Disclosure Text is met.

International Transfer of Personal Data

Personal data is transferred abroad in accordance with Article 9 of the Law, for the purposes and under the conditions specified in this Disclosure Text, within the framework of the standard contract signed between our Company and the company to which the data is transferred abroad, and the data transfer instruction received from the data owner within the scope of the Regulation on Sharing Confidential Information in banking legislation.

4. Legal Reason and Method of Personal Data Collection

Your personal data is collected by automated or non-automated methods, directly by you or through your employer, or through verbal or written information conveyed via our e-mail address, phone, call center, website, face-to-face meetings, camera recordings during your office visits, and through online platforms managed by official authorities such as the application form on our website, the Risk Center of the Banks Association of Turkey or companies established by at least five banks or financial institutions (such as Credit Bureau), and public institutions and organizations' systems and the Identity Sharing System, based on and limited to the legal reasons specified in Article 5 of the Law, in accordance with the fundamental principles stipulated in the Law and for the purposes explained in Article 2 of this Disclosure Text: explicitly stipulated in laws, being mandatory for our Company to fulfill its legal obligation, the existence of explicit consent, being made public by the data subject themselves, being directly related to the establishment or performance of a contract, being necessary for the processing of personal data belonging to the parties of the contract, the legal obligation of the data controller, the establishment, exercise or protection of a right, and being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

5. Retention Periods for Personal Data

Our Company determines whether a period is stipulated in the relevant legislation for the storage of personal data. If a period is stipulated in the relevant legislation, it adheres to this period; if no period is stipulated, it retains personal data for the period necessary for the purpose for which they are processed. If the purpose of processing personal data has ceased and the retention periods determined by the relevant legislation and/or our Company have expired, personal data may only be stored for the purpose of serving as evidence in possible legal disputes, asserting the related right pertaining to personal data, or establishing a defense. Our Company does not store personal data based on the possibility of future use.

6. Ensuring the Security and Confidentiality of Personal Data

Our Company, in accordance with Article 12 of the Law, takes all necessary technical and administrative measures to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data, thereby ensuring an appropriate level of security. In this context:

a- Technical Measures Taken to Ensure Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data

Siemens Leasing has taken all kinds of technical and technological security measures to protect your personal data and protects your personal data against possible risks. Up-to-date network security and application security are provided at Siemens Leasing and its affiliated companies. Training and awareness activities on data security are carried out periodically for Siemens Leasing employees.

b- Administrative Measures Taken to Ensure Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data

• Training and raising awareness of company employees regarding the Law,
• Ensuring that in cases of personal data transfer, a clause stating that the party to whom personal data is transferred will fulfill data security is added to contracts concluded with such parties,
• Measures have been taken to identify what needs to be done for compliance with the Law and to prepare internal policies for their implementation.

c- Measures to Be Taken in Case of Unlawful Disclosure of Personal Data

In the event that processed personal data is obtained by others through unlawful means, our Company will notify the relevant data subject and the Personal Data Protection Authority as soon as possible within the periods specified in the Law.

7. Your Rights Regarding the Protection of Personal Data

We inform you that you have the following rights regarding your personal data in accordance with Article 11 of the Law and that you can make a request regarding these rights by applying to our Company. Accordingly:

• To learn whether personal data is processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of personal data if it is incomplete or incorrectly processed and to request notification of the transaction made within this scope to third parties to whom personal data has been transferred,
• To request the deletion, destruction, or anonymization of personal data if the reasons requiring its processing cease to exist and to request notification of the transaction made within this scope to third parties to whom personal data has been transferred,
• To object to a result against the data subject that arises from the analysis of processed personal data exclusively through automated systems,
• You have the right to demand compensation for damages if you suffer damage due to unlawful processing of your personal data.

You can submit your requests regarding your above-mentioned rights via the electronic form accessible by clicking the button below or the KVKK Data Subject Application Form, in writing to Esentepe Mah. Yakacık Cad. No:111/17, 34870 Kartal, İstanbul-Turkey, in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller", or via secure electronic signature or mobile signature through our Company's KEP (Registered Electronic Mail) address “siemensfinansalkiralama@hs03.kep.tr”, or in person by ensuring your identity is verified, or via e-mail to “verikoruma.sfs@siemens.com” from an e-mail address where your identity has been verified. Your application must include your first name and last name, your signature if the application is written, your identity number (your nationality and passport number or identity number if you are a foreign national), your notification address, your e-mail address for notification, your phone number, and the subject of your request.

Requests submitted to our Company will be concluded as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request, and if the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged by the Company.

Click to download the KVKK Data Subject Application form