Information On Protection And Processing of Personal Data

We, Türkiye Cumhuriyeti Ziraat Bankası Anonim Şirketi ("Ziraat Bankası"), as the Data Controller, would like to inform you regarding the Personal Data Protection Law ("PDPL") numbered 6698 published in the volume of  the Official Gazette dated 7 April 2016 and numbered 29677, in order to protect the fundamental rights and freedoms of individuals, especially the privacy of private life in the processing of personal data, and to determine the obligations of natural and legal persons who process personal data, pursuant to Article 10 of the Law titled “Obligation of Data Controller to Inform”

1. Purpose of Processing Personal Data, Collection Method and Legal Basis
Ziraat Bank automatically collects your identity, contact information, CV, legal transactions, customer transactions, location, camera footage, risk management information, finance, professional experience, visual and audio records, demographic information, education level and income level information during establishment of your legal relationship with our bank and during the continuation of such relationship from you, third parties and legal authorities, provided that they are via website, various contracts, ATM, mobile banking, e-mail, application forms, written or verbal communication channels with our Bank, automatically verbally, in writing or electronically and based on the legal grounds that it is explicitly set forth in laws specified in Article 5/2(a) of the Law, that it is necessary for execution or performance of the contract specified in Article 5/2(c) of the Law, that our bank fulfils its legal obligation specified in Article 5/2(ç) of the Law, that it is made public by the relevant person specified in Article 5/2(d) of the Law, that data processing is mandatory for the establishment, exercise or protection of a right specified in Article 5/2(e) of the Law and that data processing is mandatory for the legitimate interests of the data controller without prejudice to fundamental rights and freedoms of the data subject pursuant to Article 5/2(f), and processes and shares such personal data for following purposes;

  • Fulfillment of our Bank's obligations arising under the Banking Law, Bank Cards And Credit Cards Law Nr 5464, Law No 5549 on Prevention of Laundering Proceeds of Crime, Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions No 6493
  • Compliance of information provision and reporting obligations if required by public, administrative authorities such as Banking Regulation and Supervision Agency, Merkezi Kayıt Kuruluşu A.Ş. (Central Securities Depository of Türkiye), Financial Crimes Investigation Board (MASAK), the Ministry of Treasury and Finance, Kredi Kayıt Bürosu (Credit Bureau of Türkiye),  Central Bank of the Republic of Türkiye, Bank Association of Türkiye;
  • Ensuring that banking operations are carried out in accordance with the Bank's procedures and/or relevant legislation;
  • Ensuring that the obligations under the contractual relationship are duly performed;
  • Recording your profession, income level, and the purpose of your transactions with our Bank, in order to fulfill our obligations under the applicable legislation regarding customer due diligence, particularly for the identification and verification of your address.;
  • Acquiring identity and contact details, your credit card number, vehicle's license plate and registration property certificate in particular for the purpose of enabling you to benefit from Electronic Toll Collection System (HGS) upon your demand;
  • Recording feedback such as complaints, objections, requests, suggestions, satisfaction in our notification management system in order to serve you better;
  • Issuance of all records and documents related to transactions either electronically (via SWIFT, Internet / mobile banking, Head Office Units, Branches, kiosks, ATMs, Internet branch, video transaction, center, call center and all other similar channels, etc.) or on a paper basis,
  • Use of them for products and services which we can provide in our capacity as agent;
  • Planning and execution of business activities and operational processes;
  • Execution and management of customer relations;
  • Ensuring that your data is kept accurate and up-to-date;
  • Carrying out support services and obligations, customer satisfaction and corporate communication activities;
  • Evaluating your requests and complaints received on Social Media and suggesting solutions;
  • Execution of affairs conducted by our Bank with its domestic, foreign branches and affiliates and management of relations;
  • Execution of lawsuits and execution proceedings to which our bank is a party;
  • Planning and implementing corporate sustainability, corporate governance, strategic planning and information security processes;
  • Recording of camera footage at ATMs and branches for security reasons and within scope of our obligations arising under the law.

Ziraat Bankası may need your explicit consent whilst processing your personal data for some of activities conducted by it. Your biometric data is processed based on the legal reason of your explicit consent as per article 6/3 of the Law for purposes of remote customer acquisition and identification and verification in respect of submission of instructions, requests and documents through digital channels, and your personal data related to marketing, behavior analyses, your user habits is processed based on the legal reason as per article 5/1 of the Law for purposes of planning and execution of promotion and advertisement activities intended for volume increase as well as planning and realization of sales and marketing activities that are exclusive for you.
Additionally, even if you are not a customer of ours, your personal data may be processed by our Bank in order to determine, monitor, report and control the risk group to which you will be involved in order to determine the credit limits to be extended to a risk group  as per the banking legislation.
Partnerships in which you, your spouse, your children and the said persons are members of the board of directors or general managers, or in which they or a legal entity jointly or individually, directly or indirectly control or participate with unlimited liability as well as partnerships in which qualified shareholders, members of the board of directors and the general manager of a bank, they jointly or individually, directly or indirectly control or are partners with unlimited liability or in which they are members of the board of directors or general manager and any real and legal persons with surety, guarantee or similar relationships that may result in the insolvency of one or more of the others constitute a risk group. In addition to these, other real and legal persons to be included in the risk group are determined by the Banking Regulation and Supervision Agency of the Republic of Türkiye.

2. Transfer of Your Personal Data
Your personal data may be transferred to financial institutions, as provided for in Article 73/4 of the Banking Law, insurance companies, public institutions and organizations such as the BRSA, CMB, CBRT (Central Bank of Republic of Türkiye), MASAK (Financial Crimes Investigation Board), TBB (Banks Association of Türkiye), Risk Center of Banks Association of Türkiye, Ministry of Treasury and Finance, Kredi Kayıt Bürosu (Credit Bureau of Türkiye), Merkezi Kayıt Kuruluşu A.Ş. (Central Securities Depository), our domestic and international branches and subsidiaries, third parties from whom we receive services to carry out our banking activities, relevant/related parties of contracts or contractual transactions signed within the scope of our banking activities, cooperating organizations and program partners for the purposes and legal reasons set forth in Article 1 of this Clarification Text within the scope of provisions of the Law regarding the transfer of personal data and their transfer abroad.

3. Storage of Your Personal Data
Your personal data can be stored for as long as required for the purposes of their processing. If there is no other justification or legal reason, no international law or regulation, and the obligations arising from the contracts no longer exist, your personal data with no remaining purpose to process it, is erased, destructed or anonymized.

4. Rights of the Data Subject Whose Personal Data is Processed
You can exercise the following rights regarding the processing of your personal data with a request you may submit to our Bank. The requests submitted in this framework shall be concluded by our Bank free of charge within no later than thirty days. However, where the Personal Data Protection Board prescribes a fee, our Bank will charge the fee set forth in the tariff. In this framework, personal data subjects are entitled:

  • To learn whether your personal data has been processed or not,
  • To request information regarding processing of your personal data,
  • To find out the purpose for processing of your personal data, and whether personal data of yours has been used in accordance with that purpose,
  • To know the third parties to whom personal data has been transmitted at home or abroad,
  • To request the correction of personal data that has been processed insufficiently or incorrectly.
  • To request for erasure or destruction of your personal data,
  • To request that the third parties to whom personal data have been transferred be notified of the actions regarding the correction, erasure or destruction of personal data,
  • To object to occurrence of any result that is to your detriment by means of analysis of personal data exclusively through automated systems,
  • To demand compensation of your loss if you incur any loss due to illegal processing of your personal data.

 As regards to your rights concerning your personal data under Law numbered 6698, you can apply to our nearest branch in person or through a notary public with your petition containing documents proving your identity and your request, or you can submit your request to our KEP address ziraatbank@hs.01.kep.tr.

Applications within this scope will be accepted following the identi​ty verification to be made by us, and data subjects will be answered in writing or electronically within legal periods. 


Deposit Account Application / Opening Clarification Text

Clarification Text Regarding Credit / Credit Card

Investment Products Application /Opening Clarification Text