Pension

Identification of Data Controller:

Data Controller: Türkiye Hayat ve Emeklilik Anonim Şirketi
Mersis No: 0434005145200019
Address: Levent Mah. Çayır Çimen Sokak, No:7 34330 Levent - Beşiktaş / ISTANBUL
Phone & Fax No: 0212 310 37 00 & 0212 310 39 99
Customer Services 0850 202 2020
Email: [email protected]
Web Page: www.turkiyehayatemeklilik.com.tr

We, Türkiye Hayat ve Emeklilik Anonim Şirketi (“Company”), acting as the “Data Controller”, would like to inform you regarding the purposes of processing your personal data, the legal basis for such processing, and your rights under Personal Data Protection Law No. 6698 (“Law No. 6698”). The Company implements the utmost security protocols to guarantee that your personal information is gathered, stored, shared, and kept confidential as per the Law No. 6698.

Purposes for the Processing of Personal Data:

Your personal data and special categories of personal data* may be processed by the Company in accordance with the principles as set forth in Article 4 of the Law No. 6698 as well as the personal data processing conditions as defined in Articles 5 and 6 of the said Law and for the purposes listed below:

Establishment and execution of any individual pension and life insurance contracts offered by the Company, as well as all processes related to such contracts in terms of contractual relationship;

Fulfillment of our obligations under Turkish Commercial Code, Insurance Law, Law on Individual Retirement Savings and Investment System, Law on the Prevention of the Laundering of Proceeds of Crime, Turkish Civil Code, and other legislation to which the Company is subject;

Performance of any insurance and individual pension operations in accordance with the Company’s procedures and/or applicable legislation;

Conduct of any business and transactions with partners and/or vendors within the scope of the provision and development of products and services;

Implementation of risk evaluation and indemnity payment procedures concerning the provided insurances, as well as the policy issuance processes;

Reassurance of risks, and conduct of co-insurance operations;

Filing of all records and documents that will serve as the basis for electronical (internet branch, mobile application, digital assistant, WhatsApp line, call center, social media, etc.) or hardcopy format;

Documentation of any details such as identity and address verification, occupation, income level, and the reason for engaging in transactions with the Company, in order to meet our obligations to know our customers as required by applicable legislation;

Handling of customer relations related to the Company’s products and services, ensuring customer satisfaction;

Obtaining information from local postal services, national address database (Central Population Administration System “MERNIS”) and similar institutions for verification and updating of address;

Management of the business and transactions carried out by the Company with its main shareholders and affiliates;

Planning and execution of business activities and operational processes;

Management of corporate sustainability, corporate governance and strategic planning processes;

Planning, auditing, and execution of information security processes;

Processing of online visitor data in accordance with applicable legislation;

Completion of membership formalities on our online platforms;

Recording images with security cameras at the Company’s headquarters and service units in accordance with workplace security practices and legal obligations;

Planning and execution of marketing, sales, and after-sales support service activities;

Promotion and marketing of products and services, cross-selling, surveys, statistical analyses and market researches through targeting, profiling and analysis in line with your preferences and tastes, as part of your explicit consent and permission regarding the sending of commercial electronic messages so as to enhance service quality and/or to conduct marketing analyzes;

Sharing risks with reinsurance companies abroad for reinsurance purposes based on your explicit consent;

Obtaining your sensitive personal data, including your health data, from you and/or public or private health service providers, recording such data in the Company’s data filing system, and storing it for such periods as stipulated by applicable legislation;

Compliance with disclosure and reporting obligations whenever requested by administrative authorities, including but not limited to Turkish Ministry of Treasury and Finance, Central Bank of the Republic of Türkiye, Insurance and Private Pension Regulation and Supervision Authority, Capital Markets Board, Central Securities & Trade Repository of Türkiye, Association of Insurance, Reinsurance and Pension Companies of Türkiye, Insurance Arbitration Commission, Insurance Information Center, Pension Monitoring Center, Financial Crimes Investigation Board, and Credit Registration Bureau;

Handling of the legal actions and enforcement proceedings in which the Company is involved;

Planning and execution of audit activities; and

Processing of the data we have obtained regarding the determination of insurance coverage limits (for life insurances) during the initial phase of our offer, and processing of your relevant data even if you are not our insured/customer in accordance with the risk acceptance requirements.

In addition, under the legislative change that came into effect on 01.06.2024, your health data, including your sensitive personal data, is processed based on the legal basis as set forth in Article 6/3, subparagraph b of Law No. 6698 (“Explicitly provided for in the laws”), and subparagraph d of the said Law (“Necessary for the establishment, exercise or protection of a right”), and may be obtained from you and/or public or private healthcare providers, is recorded in the Company’s data filing system, and stored for such periods as stipulated by applicable legislation.

Transfer of Your Personal Data:

Under Insurance Law, Law on Individual Retirement Savings and Investment System, and other applicable legislation, your personal data and special categories of personal data may be transferred to any governmental and administrative authorities, including but not limited to Turkish Ministry of Treasury and Finance, Central Bank of the Republic of Türkiye, Insurance and Private Pension Regulation and Supervision Authority, Capital Markets Board, Central Securities & Trade Repository of Türkiye, Association of Insurance, Reinsurance and Pension Companies of Türkiye, Insurance Arbitration Commission, Insurance Information Center, Pension Monitoring Center, Financial Crimes Investigation Board, and Credit Registration Bureau, as well as to our shareholders and direct/indirect subsidiaries or affiliates, insurance/pension companies, domestic and/or international agencies, brokers, intermediaries, financial institutions, investment/portfolio companies, reinsurance companies, suppliers, vendors, program partners, and third persons, for such purposes as specified in Article 1 of this Disclosure Form within the scope of the provisions of Articles 8 and 9 of Law No. 6698 regarding the transfer of personal data domestically and abroad.

Rights of the Data Subject:

If you, as the Data Subject, submit your claims regarding the rights listed below to the Company, your claim shall be processed on a free-of-charge basis through identity verification as soon as possible but no later than thirty days, via written or secure electronic communication channels. Nevertheless, if the procedure incurs an extra charge, our Company shall apply the fee schedule set by Personal Data Protection Authority.

It is crucial that the personal data we possess about you is correct and current, so it is vital to notify the Company whenever there are any changes to your personal data.

You, as the Data Subject, have the rights:

to find out whether your personal data has been processed;

to request for information if your personal data has been already processed;

to ask for information about the purpose of processing your personal data and whether it is used for the intended purpose as specified;

to know third parties to whom your personal data is transferred domestically or abroad;

to ask for rectification in case your personal data has been processed incompletely or incorrectly, and to request that the process conducted in this context be notified to third parties to whom your personal data has been transferred;

to ask for the deletion or destruction of your personal data, and to request that the process conducted in this context be notified to third parties to whom your personal data has been transferred, in the event that the reasons necessitating its processing cease to exist, although it has been processed in accordance with Law No. 6698 and other applicable legislation;

to object to the occurrence of a result against you by analyzing the data processed solely through automated systems; and

to claim compensation for the damage arising from the unlawful processing of your personal data.

If you would like to get more information on these matters and review our policies, you may access our full disclosure form and policies at www.turkiyehayatemeklilik.com.tr, where you may submit your requests regarding your rights as set forth in Article 11 of Law No. 6698 by filling out the ���Data Subject’s Application Form”. You may also submit your claims regarding your personal data within the scope of Law No. 6698, together with documents authenticating your identity as well as your petition containing your request, to our above-mentioned address in person or through a notary public, to our Registered Email address by using secure electronic signature or mobile signature or using your e-mail address previously notified to the Company and registered in our system.

* Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data constitutes special categories of personal data.

 

OBJECTIVE AND SCOPE

Türkiye Hayat Emeklilik ve Hayat A.Ş. (“Türkiye Hayat Emeklilik”), as the Data Controller, offers various products in the fields of personal accident, individual pension, and life insurance, and in order to carry out its activities, and lawfully processes personal data of its customers, employees, job candidates, visitors, service suppliers, business partners, and other individuals who establish a relationship for any purpose or by channel.

This Personal Data Protection and Privacy Policy (“Policy”) is intended to inform data subjects by making a disclosure regarding the processing activities carried out by Türkiye Hayat Emeklilik and thus to ensure transparency regarding personal data.

Therefore, Türkiye Hayat Emeklilik hereby explains in detail the processing of personal data, the data subjects involved in this processing, and the rights of such individuals, along with the use of cookies and similar technologies.

DEFINITIONS

PERSONAL DATA

General Principles Regarding the Processing of Personal Data

Pursuant to Article 4(2) of the Law and within the scope of the purposes as set forth in the section “Purposes for the Processing of Personal Data” in this Policy, Türkiye Hayat Emeklilik processes personal data in accordance with the following principles:

Lawfulness and fairness

Being accurate and kept up to date where necessary

Being processed for specified, explicit and legitimate purposes

Being relevant, limited and proportionate to the purposes for which they are processed

Being stored for such period as laid down by applicable legislation or for such other period as required for the purpose for which personal data is processed

Data Processed by Türkiye Hayat Emeklilik

Personal data is processed within Türkiye Hayat Emeklilik based on the explicit consent obtained from the data subjects or in light of the activities that can be carried out without the need for obtaining an explicit consent in accordance with Articles 5 and 6 of the Law, provided that it is processed only for the purposes as set forth in the section “Purposes for the Processing of Personal Data” in this Policy. The types of personal data processed in accordance with the principles in this Policy, which vary and differentiate depending on the type and nature of the relationship between a data subject and Türkiye Hayat Emeklilik, as well as the communication channels used, and the purpose of processing mentioned, are as follows:

Identification: Full name, mother’s & father’s name, mother’s maiden name, date of birth, place of birth, marital status, ID card serial number, Turkish identification number, etc.

Contact Details: Address number, email address, contact address, phone number, etc.

Location: Location information of the current location, etc.

Personnel Details: Payroll details, disciplinary investigation, statement of employment records, resume information, performance evaluation reports, etc.

Legal Actions: Information in any correspondence with judicial authorities, information in the case file, etc.

Customer Transaction: Insurance offer and policy details, individual pension contract details, contribution payment/premium payment details, fund distribution preference information, payment history, call center records, Invoice, complaint and request information, beneficiary details, information found in income certificate and claim documents, tax liability statement, as well as information regarding guardian, custodian, proxy, and the insured person, if any, such as information identifying data subject, risk address belonging to data subject, policy and health information in indemnity payments and provision activities, or inheritance certificate, autopsy report, etc. related to a death.

Physical Area Security: Employees and visitors’ entry and exit records, camera recordings, etc.

Process Safety: IP address, website entry and exit details

Risk Management: Identity verification details obtained in accordance with MASAK regulations, information processed for the management of commercial, technical, and administrative risks, etc.

Finance: Credit and risk information, monthly income details

Professional Experience: Occupational knowledge

Marketing: Customer behaviors, information obtained through surveys and campaigns, etc.

Visual and Audio Records: Photos, call center records, camera recordings

Health Information: Healthcare data processed under insurance policies, employee health reports

Criminal Conviction: Previous criminal records

Biometric Data: Fingerprint information

Other Information: Bank account/credit card details

Purposes for the Processing of Personal Data

Personal data may be processed by Türkiye Hayat Emeklilik for the purposes outlined below and may be retained for such periods as required by these purposes and applicable legislation.

Personal Data of Customers

Fulfillment of statutory obligations under applicable legislation, especially Individual Pension and Insurance Law;

Establishment and fulfillment of contracts with a main heading of individual pension, personal accident insurance, life insurance, complementary health insurance, and execution of all processes related to such contractual relationship;

Fulfillment of any instructions received from the relevant regulatory institutions and organizations such as Turkish Ministry of Treasury and Finance, Association of Insurance and Reinsurance Companies of Türkiye (“TSB”), Financial Crimes Investigation Board (“MASAK”), Pension Monitoring Center (“EGM”), etc.

Response to requests for information from administrative and judicial authorities;

Implementation of risk evaluation procedures concerning the provided insurances, as well as the policy issuance processes;

Completion of claims assessments and indemnity payment procedures in case of risk materialization;

Carrying out assessment and indemnity payment procedures in the insurance branch with the health data obtained based on explicit consent, and obtaining expert opinion on healthcare data when necessary;

Execution of businesses and procedures in compliance with the information retention, reporting, disclosure obligations, etc. as stipulated by applicable legislation and public authorities;

Production of all records and documents that will be the basis of any transaction electronically (internet/mobile, etc.) or in hardcopy;

Planning and execution of corporate operations;

Planning and execution of audit activities;

Handling of the legal actions and enforcement proceedings in which we are involved;

Execution of the business and transactions carried out by the Company with its main shareholder and affiliates;

Conduct of any business and transactions with partners and/or vendors within the scope of the provision and development of products and services;

Reassurance of risks, and conduct of co-insurance operations;

Handling of customer relations, ensuring customer satisfaction;

Planning and execution of after-sales support service activities;

Evaluation of customers’ requests, complaints and suggestions;

Recording of incoming calls, and use of such recordings to enhance the service quality;

Planning, auditing, and execution of information security processes;

Recording images with security cameras at the Company’s headquarters and service units in accordance with workplace security practices and legal obligations;

Processing of online visitor data in accordance with applicable legislation;

Completion of membership formalities on our online platforms;

Sending commercial electronic communications based on explicit consent and conducting cross-selling; planning and execution of promotional and advertising activities aimed at increasing volume;

Promotion and marketing of products and services, cross-selling, surveys, statistical analyses and market researches through digital marketing, targeting, profiling and analysis in line with your preferences and tastes, based on explicit consent;

Execution of life club processes;

Sharing risks with reinsurance companies abroad for reinsurance purposes based on explicit consent;

Personal Data of Employees

Fulfillment of obligations under all laws of the Republic of Türkiye, especially Labor Law;

Determination and implementation of business, management and human resources strategies and policies with our Company’s shareholders, direct/indirect subsidiaries and affiliates, and enhancement of internal processes;

Fulfillment of any instructions received from public institutions such as Social Security Institution, Turkish Employment Agency, etc.;

Implementation of human resources policies;

Completion of all activities necessary within the scope of the employment relationship, especially preparation of personnel files;

Execution of performance assessment processes;

Execution of businesses and transactions to be carried out within and outside the Company within the scope of representation and assignment;

Execution of powers of attorney and signature circulars;

Obtaining medical reports to support your excuse leave;

Creation of individual pension files offered as a vested benefit;

Implementation of training processes for personal development;

Execution of vested benefit operations associated with life insurance and health insurance, based on explicit consent;

Conducting financial risk assessments in recruitment processes, based on explicit consent;

Use of monitoring, observation, and tracking systems with audio and visual functions in workplaces and their premises to ensure occupational health and safety inspections, to prevent any negative occurrences that may arise in the workplace in advance, and to protect the working environment against dangers that may come from inside or outside;

Use of systems to monitor, observe and track the use of equipment such as telephones, computers, automobiles, etc. allocated for work in order to enable the employer to provide control and supervision;

Handling of the legal actions and enforcement proceedings in which we are involved;

Use of a fingerprint authentication system for monitoring and controlling the employees’ entry and exit at the workplace, based on explicit consent;

Execution of processes regarding the processing of photographs, videos and similar images for events, in-house training, promotion & marketing, and corporate communication activities, based on explicit consent.

Personal Data of Job Candidates

Implementation of recruitment processes

Personal Data of Visitors

Fulfillment of legal obligations and taking necessary precautions as required by workplace safety practices

Personal Data of Online Visitors

Processing of online visitors’ data under Law No. 5651;

Fulfillment of statutory obligations;

Response to requests for information from administrative and judicial authorities

Personal Data of Suppliers/Business Partners or Suppliers’/Business Partner’s Executives

Establishment and execution of any contracts, as well as all processes related to such contracts in terms of contractual relationship;

Tracking of accounting and purchasing transactions;

Handling of the legal actions and enforcement proceedings in which we are involved;

Fulfillment of statutory obligations;

Response to requests for information from administrative and judicial authorities;

Transfer of Personal Data

Türkiye Hayat Emeklilik carries out domestic and international transfer of personal data for the purposes as set forth in the section “Purposes for the Processing of Personal Data” in this Policy, and in accordance with Articles 8 and 9 of the Law, and personal data may be processed and stored on servers and electronic media used for such purpose. Personal Data Inventory prepared by Türkiye Hayat Emeklilik details the parties involved in data transfer and its purposes.

The nature of such data transfers and the parties involved may vary depending on the type and nature of the relationship between the data subject and Türkiye Hayat Emeklilik, the purpose of the transfer, and the relevant legal basis. In this connection, the parties are generally as follows:

Individuals and organizations permitted by all national/international legislation, and/or individuals and organizations that have the permission, right and authority to request and process personal data under such legislation or any contracts to which they are a party, including but not limited to Turkish Ministry of Treasury and Finance, Insurance Association of Türkiye, Capital Markets Board, Financial Crimes Investigation Board, Pension Monitoring Center, Istanbul Settlement and Custody Bank Inc. (Takasbank), Central Securities & Trade Repository of Türkiye

Financial institutions as defined in Article 31/A of Insurance Law No. 5684

Agencies, brokers, and domestic/foreign reinsurance companies, consulting actuaries, consulting doctors, and similar service providers

The Company’s shareholders, direct/indirect subsidiaries and affiliates

Contracted enterprises providing services in life clubs processes

Service suppliers or cooperating domestic/foreign third parties

Project/program/funding partner institutions/organizations and contracted banks

Transferee/transferor companies operating in the same sector in accordance with the transfer provisions of insurance and private pension legislation

Collection of Personal Data

Within the scope of the conditions for the processing of personal data as specified in Articles 5 and 6 of Law No. 6698, for the purposes as set forth above, and on basis of the fact that your personal data is necessary for the establishment and execution of a contract, is clearly stipulated in the laws, and is mandatory for the fulfillment of legal obligations, and for the legitimate interests, including in cases requiring explicit consent, based on your explicit consent, and if you have already given permission for commercial electronic messages, based on this permission, personal data may be collected from the Company’s Head Office Units, Regional Directorates, Liaison Offices, Agencies, Intermediaries, Brokers, internet branch and mobile application, verbally, in writing or electronically by automatic or partially automatic methods.

Storage and Destruction of Personal Data

Personal data are retained within Türkiye Hayat Emeklilik for the relevant legal retention periods, and are stored for such periods as necessary for the fulfillment of any activities associated with such data and such purposes as specified in this Policy and/or for such periods as stipulated in the legislation. In case of personal data with its purpose of use has ceased to exist and with its legal retention period has expired, such personal data are erased, destructed or anonymized in accordance with “Policy on Retention and Destruction of Personal Data” published by Türkiye Hayat Emeklilik.

Legal Rights of Data Subject

The rights of natural persons whose personal data is processed are governed by Article 11 of the Law, pursuant to which the data subjects have the following rights over Türkiye Hayat Emeklilik:

to find out whether personal data has been processed;

to request for information if personal data has been already processed;

to ask for information about the purpose of processing personal data and whether it is used for the intended purpose as specified;

to know third parties to whom personal data is transferred domestically or abroad;

to ask for rectification in case personal data has been processed incompletely or incorrectly;

to ask for the deletion or destruction of personal data in the event that the reasons necessitating its processing cease to exist;

to request that the rectification and deletion processes be notified to third parties to whom personal data has been transferred;

to object to the occurrence of a result against you by analyzing the data processed solely through automated systems; and to claim compensation for the damage arising from the unlawful processing of personal data.

Data subjects may submit their claims regarding the rights listed above through one of the following methods:

Applying in person at Türkiye Hayat Emeklilik Head Office (Levent Mah. Çayır Çimen Sokak No: 7 Beşiktaş/Istanbul) or any regional directorates and filling out a written form;

Applying at the head office address by the agency of a notary;

Sending email from his/her own Registered Email address; or Sending email from the email address registered in the systems of Türkiye Hayat Emeklilik.

Claims submitted under this item by the data subjects shall be addressed by Türkiye Hayat Emeklilik not later than 30 days. If any claim requires an additional cost, Türkiye Hayat Emeklilik may charge a fee equal to an amount as laid down in applicable legislation.

Data Transfer Abroad

For processing, storage, management, or any other use as specified in this Policy, personal data may be transferred abroad in accordance with applicable legislation to fulfill the purposes as defined in the section “Purposes for the Processing of Personal Data” in this Policy. In case of data transfers abroad, necessary measures shall be taken to safeguard personal data.

Security of Personal Data

Türkiye Hayat Emeklilik attaches importance to protecting the confidentiality and security of personal data. Accordingly, necessary technical and administrative security measures shall be taken to safeguard personal data against unauthorized access, damage, loss or disclosure. In this regard, necessary system access controls, data access controls, secure transfer controls, business continuity controls and other necessary corporate controls shall be implemented. The monitoring activities with cameras at the entrance and inside the building and premises are carried out meticulously by Türkiye Hayat Emeklilik as part of the privacy and security measures for personal data.

COOKIES AND SIMILAR TECHNOLOGIES

General Information

Cookies are small data files transmitted to users’ devices by internet web servers via the browser in use, and websites identify users through these cookies, which can have different lifespans based on browser configurations.

These cookies are generated by systems overseen by Türkiye Hayat Emeklilik, and certain service providers approved by Türkiye Hayat Emeklilik may collect IP address, unique identifier, and device identifier data by using similar technologies on users’ devices. Additionally, links from third parties found within Türkiye Hayat Emeklilik’s systems are governed by the privacy policies of those third parties; however, Türkiye Hayat Emeklilik is not responsible for their privacy practices. In this case, it is advised to review the privacy policy when accessing a website via the corresponding link.

Cookie Types

Cookies, designed mainly to enhance user convenience, are basically classified into four key categories:

Session Cookies: These Cookies allow the transfer of information between web pages and the systematic recall of information entered by the user, and are necessary for the proper functioning of Türkiye Hayat Emeklilik’s website.

Performance Cookies: Cookies that gather data on how often pages are visited, any error messages encountered, and the total duration users engage with the specific page are utilized to enhance the functionality of Türkiye Hayat Emeklilik’s website.

Functional Cookies: These cookies enable the stored preferences to be recalled for the user’s convenience and seek to offer users enhanced online functionalities related to Türkiye Hayat Emeklilik’s website.

Advertising and Third-Party Cookies: These cookies are provided by third-party vendors and facilitate specific functions on Türkiye Hayat Emeklilik’s website while enabling advertising monitoring.

Purposes of Using Cookies:

The objectives for which Türkiye Hayat Emeklilik uses cookies are as follows:

Uses for Operational Purposes: Türkiye Hayat Emeklilik might utilize cookies that facilitate functions on this website or identify unusual activities to oversee and guarantee the security of its systems.

Functional Purposes: Türkiye Hayat Emeklilik may utilize cookies that retain users’ information and previous choices to enhance the use of its systems and offer features tailored to individual users.

Performance Purposes: Türkiye Hayat Emeklilik may use cookies to assess and analyze user interactions with sent messages and behaviors, aiming to enhance and measure the effectiveness of its systems.

Advertising Purposes: Türkiye Hayat Emeklilik may utilize cookies to assess how effective these ads are or to analyze click activity, enabling the delivery of advertisements and related content to users according to their interests via systems owned by itself or external parties.

How to Disable Cookies

The use of cookies is often pre-set in various browsers, and users have the option to modify this setting in their browser preferences, allowing them to remove current cookies and decline future cookie use. In fact, if cookie usage is turned off, it might limit access to specific functionalities within Türkiye Hayat Emeklilik’s systems.

The process for altering cookie usage settings differs by browser type and can be obtained from the appropriate service provider whenever needed.

GENERAL CONDITIONS

Routine Check

This Policy is reviewed at least once a year by Personal Data Protection Committee and is updated as specified in the Policy and Procedure Development Procedure.

Disclaimer

The sole beneficiary of all the information contained herein is Türkiye Hayat Emeklilik. Accordingly, the use, reproduction, distribution, display, modification, disclosure to third parties, and publication of the information in this document without the Company’s approval and consent shall be prohibited, regardless of whether it is in favor of or against any other company, individual, or enterprise. Any legal proceedings shall be initiated against those who act to the contrary in relation to their unlawful behavior, and Türkiye Hayat Emeklilik and its employees shall not bear any responsibility in the event that a crime is committed by using the content of this document.