FERNCO E-commerce Infrastructure and Payment Infrastructure Iyzico Privacy and Data Policy

This Privacy & Personal Data Policy aims to provide information about personal data collected, stored, processed, shared and transferred by FERNCO and therefore iyzico. All natural persons who visit the FERNCO and therefore iyzico website, use any FERNCO and therefore iyzico service (for example, make a credit card payment through FERNCO and therefore iyzico) are within the scope of this Privacy & Personal Data Policy.

Since FERNCO and therefore iyzico Turkey and iyzico Europe are two companies that apply the same privacy principles and policies, the expression "FERNCO and iyzico" is used throughout this policy to cover both companies. Throughout the Privacy & Personal Data Policy, expressions such as "we" and "our company" may be used when referring to FERNCO and iyzico. The official titles and contact information of FERNCO and iyzico are provided at the end of this policy.

The terms "personal data", "personal information" and "your information" are used interchangeably and include all information related to an identified or identifiable natural person (e.g. name, e-mail address, date of birth, ID number).
We are aware that personal data is important for our customers and end users and we will make every effort to ensure that everyone within iyzico complies with this policy and that the security of your personal data is maintained in all cases.

The purpose of this Privacy & Personal Data Policy is to:

• Explain the purpose and method of using the data we obtain in the clearest and most understandable way possible;
• Explain what information we obtain with your consent and for what purposes and how this information is processed;
• Inform you about the purposes and methods by which this information is transferred to third parties;
• Inform you about your legal rights regarding your personal data;
• To explain our responsibility to protect your rights and privacy.

This policy is only valid for the use of FERNCO and iyzico products and services. In all websites and environments that do not belong to FERNCO and iyzico, the privacy policy and rules of the relevant person or institution will apply. In cases such as when an iyzico payment form is placed on a merchant's website to transfer payment information to iyzico, both iyzico's and FERNCO's privacy policies will apply.

The types of personal data processed by FERNCO and iyzico may vary depending on which services you use and how you use them. Depending on factors such as your location and legal status, not all services may be available to you.

2. Personal Data Collected by FERNCO and iyzico
When you visit our website or use our services, we collect various personal data about you.
When you enter our website, send or receive a payment through FERNCO and iyzico, or register with iyzico and open an account; we collect the information necessary to provide the services you request effectively and securely. This information may include the following:

• Your personal information (e.g. your name, address, e-mail address, ID number).
• Payment information (e.g. your credit card number, expiration date of your card, your installment preference).
• When someone sends a payment to a third party, or performs another transaction that requires them to provide us with information about third parties, we may obtain personal data about these third parties.
• Information obtained from other parties; for example, we may obtain the names and categories of the products or services you wish to purchase from FERNCO, details regarding your membership in FERNCO, your IP address, and information regarding your previous transactions. We may also obtain and use information regarding the status of your order from cargo companies.
• If you wish to become a customer of ours benefiting from FERNCO and iyzico services, information used to determine the type and identity of your business, contact information, introductory and explanatory information and documents regarding the business, bank information required for the transfer of payment, and records regarding your use of FERNCO and iyzico products and services (IP address, web infrastructure you use, etc.) will be obtained. Some or all of this information may contain personal data, and as a company, you must ensure that you are authorized to share this personal data.
• Identifying information about your business, your contact information and bank account information will be transferred to iyzico by FERNCO and iyzico.
• Additional information you provide to us, such as when you benefit from optional services offered by iyzico or when you contact iyzico, is collected by iyzico.
• Information obtained through cookies, beacons and other tracking mechanisms (for example, details about your device, geographic location and usage). For more detailed information about the use of cookies and other tracking technologies we use to provide our services and to market to your interests, please read Section 4 below.

3. Use of Personal Data by FERNCO and iyzico and Legal Basis
We use the personal data we hold for various purposes permitted by legal regulations in Turkey and the European Union. The purposes for which we use your personal data are explained below with examples. The legal compliance criteria we rely on when processing this personal data may include fulfilling our contractual obligations, our legitimate interests and our legal obligations.

• To provide you with our website and services:
We need to use your personal information to make payments, transfer money, store your credit cards for future use upon your request and enable you to create, access and make changes to an account.
• To improve our services and manage our operational requirements:
We monitor the use of our websites and services and improve our performance by analyzing data on usage.
• Protecting our customers from harm with risk management and our platform:
We know our customers and measure their risk levels in order to detect and prevent malicious transactions. Decisions on this subject can be made by automatic algorithms or by our own officers within certain rules. If an application or transaction you want to perform is rejected as a result of these reviews, you can contact us using the contact information at the end of this document to request information.
• Contacting you when necessary: ​​
We use your contact information to inform you about the status of your transactions. In addition, if a problem occurs regarding your transaction or your account, we can use your contact information to reach you about the issue and resolve the problem. Those who contact you on behalf of iyzico may be direct iyzico employees or other business partners from whom we receive services, in which case your personal data must be shared with these business partners.
• Fulfilling our legal obligations or resolving disputes:
Some regulations in the places where we operate may require us to use and store your information in certain ways. As a payment service provider, we are obliged to keep and review records of all transactions we mediate for purposes such as fulfilling our data retention obligations, preventing money laundering and taxation.

In the event of a dispute between the parties to a transaction we mediate, or between iyzico and users, your personal information may be used to resolve the dispute and may be transferred to the courts and alternative resolution bodies.

We may also use your information for other purposes for which you have consented. For example, we may obtain your consent for other processing activities such as sending you marketing communications, receiving feedback from you. In such cases, you can always withdraw your consent, for which you can contact us using the contact information provided at the end of this document. You must also include information that will allow us to identify you when contacting us. Your notice of withdrawal of consent will be effective in the future, so the processing we have carried out in the past based on your consent will not become unlawful, but we will cease to process the relevant information after receiving your notice.

4. Use of Cookies and Other Tracking Technologies
During the use of the FERNCO and iyzico websites and services, access data such as the name of your internet service provider, IP addresses and the pages you have visited are collected. This information may be used to provide the infrastructure of the website to which FERNCO and iyzico are subject and to conduct statistical analyses and to direct FERNCO and iyzico-related advertisements to more accurate targets. In addition, cookies (small files) and beacons belonging to FERNCO and iyzico or other service providers are used to collect information about your use and to use this information to provide site functions, manage site infrastructure and for marketing purposes.

This site uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies" and other identifiers to help the website owner analyze how users use the site and to enable Google to continue its services. The information generated about your use of the website (including your IP address) will be transmitted to Google's servers located in different countries and processed by Google there. Google will use this information to evaluate your use of the website, to compile reports on website activity for website owners and to provide other services related to website activity and internet use (e.g. creating user categories). Google may share this information with third parties in accordance with legal obligations or where third parties process this information on Google's behalf. For more detailed information about Google Analytics, please visit the following page: https://www.google.com/policies/privacy/partners/ If you do not want your information to be used for Google Analytics Services, you can request to opt out of Google Analytics by following the instructions at the following link: https://tools.google.com/dlpage/gaoptout/

FERNCO and iyzico use a service provided by Hotjar Ltd. ("Hotjar") that identifies users' experiences on the website and questions the ease of use of the website, and receives anonymous feedback from users. Cookies are placed on your computer in order for Hotjar to provide this service.

FERNCO and iyzico use a service provided by Optimizely Inc. ("Optimizely") that shows users different versions of the website and helps them find out which version is more useful in terms of usage. Cookies are placed on your computer in order for Optimizely to provide this service.

FERNCO and iyzico use a service provided by Sosyo Plus Bilgi Bil. Tekn. Dan. Hiz. Tic. A.Ş. ("Insider") that helps member businesses find features they could not view before. Cookies are placed on your computer in order for Insider to provide this service.

FERNCO and iyzico use a service provided by Doğan İnternet Yayıncılık ve Yatırım A.Ş. ("Medyanet") that analyzes user behavior. In order for Medyanet to provide this service, cookies are placed on your computer.

You can refuse the use of cookies by selecting the appropriate settings on your browser, but please note that if you do this you may not be able to use this website to its full functionality. By using our website or using our services, you consent to the processing of your personal data by Google, Hotjar, Optimizely, Insider, Medyanet and other third party service providers as described above.

5. Storage and Deletion of Personal Data
The period that FERNCO and iyzico will store your personal data in a way that allows you to be identified is the shortest period necessary to meet our legal obligations and operational requirements.

When the period for which your personal data will be stored expires, we delete or anonymize your personal data in accordance with our internal procedures aimed at ensuring the security of your data, and ensure that it cannot be associated with you.

When you close your account or request the deletion of your personal data, we delete or anonymize the remaining data, except for the data that we are obliged to keep even if you close your account according to legal regulations or that we reject your request for deletion.

The cookies we use have certain validity periods and if you do not use our website or services during this period, they will be automatically deactivated and the stored data will be deleted. You can also delete these cookies using the settings of your internet browser.

6. Transfer of Personal Data to Third Parties
While providing our services, we sometimes share your personal data with third parties for the purposes explained below.

We share your personal data among iyzico group companies in order to manage our activities and provide our services securely and continuously. Transfers between FERNCO and iyzico group companies are carried out by taking the necessary precautions and your personal data does not fall outside the scope of this privacy policy due to this transfer.

When necessary, we use the services of other companies and we may need to share your personal data with some of them. For example, when we receive your payment information (we may receive this information directly from you or through the merchant you wish to make payment with), we transfer it to the relevant financial institutions to ensure your payment is made. Or, if the transaction you are making requires additional steps (for example, if it is an international sale that requires customs procedures to be completed), we may transfer your data to the relevant service providers (for example, customs consultants) to ensure that these steps can be taken. We may also transfer personal data to third parties (e.g., data processors to prevent fraud) to ensure the safety and convenience of our users and our business.

When you use our services, we inform other parties to the transaction you make (e.g., the merchant you make a payment to or other users). This information may include transferring some of your personal data to these parties.

Law enforcement and other authorized institutions may request your personal data from us. We only share this information when we are legally obliged to do so or when we believe it is necessary to prevent or investigate a crime.

We may also need to share your data with third parties for other business purposes. These business purposes include various activities such as company audits, corporate governance, and exercising our legal rights. We always act in accordance with legal regulations when making these sharings.

7. Transfer of Personal Data to Third Countries
Due to the nature of the services we provide, we may need to transfer some personal data internationally. The majority of our information technology infrastructure (FERNCO and iyzico Turkey’s entire infrastructure) is located in the United States and Turkey, and therefore, if you access our website or use our services from a country other than Turkey, your personal data will be transferred to the United States and Turkey. This transfer takes place within a legal framework that ensures the security of your personal data. We use model contractual provisions published by the European Commission for personal data transfers between FERNCO, iyzico Europe and iyzico Turkey.

In addition to the transfers between FERNCO and iyzico companies, the data transfers to third parties described above may require the transfer of your personal data to different countries. However, in all cases, we guarantee that your personal data will only be transferred to countries that provide adequate protection, or to persons located outside these countries who have undertaken to ensure the security of your data in accordance with the regulations.

8. Your Preferences
You can make some choices regarding your privacy. You can always refuse to provide your personal data requested by FERNCO and iyzico. However, if the information you refuse to provide is necessary for us to provide our services, you will not be able to benefit from our services. For example, if you do not enter your credit card number on the payment page where credit card payments are accepted through FERNCO and iyzico, we will not be able to make the payment.

As explained in Section 4, we also use cookies to provide our services better. You can use your internet browser settings to reject these cookies, but if you reject these cookies, you may not be able to use our website and services.

You can see some of the personal data we have in the settings section after logging in to the FERNCO and iyzico mobile or web application. If you want to exercise these or any other rights you have over your personal data, you can contact us using the contact information at the end of the document.

We will contact you from time to time. This communication may be for marketing purposes or related to transactions you are a party to. You may refuse to receive all marketing-related communications, for which you can follow the instructions at the bottom of the messages sent to you. You cannot refuse to receive informational messages regarding transactions performed, but you may be able to change the method and addresses to which they are sent.

9. Your Rights
We would like to state that you have the following rights in accordance with legal regulations:
(a) To learn whether your personal data is processed, the personal data processed, the sources from which the personal data is obtained, the third parties to whom it is transferred domestically and abroad, the period for which the data is stored or the criteria used to determine this period;
(b) To access your personal data and request that the personal data provided by you be provided in a structured, commonly used and machine-readable format or transferred to another data controller,
(c) To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
(d) To object to the processing of your personal data or request its restriction,
(e) To request correction of your personal data if they are processed incompletely or incorrectly,
(f) To request that your personal data be deleted or destroyed if the reasons requiring processing are eliminated,
(g) To request that third parties to whom your personal data is transferred be notified of such actions, such as correction and deletion,
(h) To object to the emergence of an adverse result as a result of the analysis of processed data through automated systems,
(i) To request compensation for damages incurred due to unlawful processing of personal data.
You can exercise your rights regarding your personal data specified above by contacting us using the contact information at the end of the document. In order for us to recognize you when making this application, you must specify the information you provided during registration or when using our services and attach a copy of an official ID.

10. Protection of Personal Data
All personal data obtained by FERNCO and iyzico are transmitted and stored subject to reasonable security conditions accepted in the industry. The security of payment data is provided by our PCI DSS (Payment Industry Data Security Standards) Level 1 compliant infrastructure and the connections through which personal data is transferred are encrypted and protected. Although we take all reasonable precautions to protect your personal information, it is your responsibility to ensure the security of your password and account information.

11. Other Information
Our services and website are not intended for use by children (all persons who are not legally adults). We do not collect personal data from children and persons who cannot legally benefit from our services. If we understand that we have obtained personal data belonging to a child, we will immediately delete this data unless we are legally obliged to store it. If you believe that we have obtained personal data belonging to a child as a result of an error or negligence, please contact us immediately using the contact information below.
We may make changes to this privacy policy. The changes made will be effective as of the date the new privacy policy is published.
Users and customers are obliged to follow possible updates and to inform the persons with whom they transact or who transact with them about FERNCO and iyzico's data processing activities and this privacy policy before transferring their information to FERNCO and iyzico.

12. Contact Information
iyzico Turkey:
Company Name: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.
MERSİS Number: 0483034315700019
Address: Burhaniye Mahallesi Atilla Sokak No:7 Üsküdar İstanbul
E-Mail: [email protected]
Phone: +90 216 599 01 00

iyzico Europe:
Company Name: Iyzi Payments, UAB
Registration Number: 304782968
Address: Mėsinių g. 5, LT-01133 Vilnius LITHUANIA
E-Mail: [email protected]
Phone: +90 216 599 01 00

FERNCO:
Company Name: FERNCO Design and Foreign Trade Inc.
Address: Caddebostan Mah. Plaj Yolu Sk. No: 35B/26 Caddebostan 34728 Kadıköy/İstanbul, Turkey
E-Mail: [email protected]
Phone: +90 (216) 759 14 61