This Information Notice on the Processing of Personal Data (“Information Notice”) has been prepared pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform data subjects about the purposes for which personal data is processed by Hakede Finansal Teknolojiler Limited Şirketi, the legal bases relied upon, the methods through which personal data is collected and processed, and the parties to whom personal data may be transferred and the purposes of such transfers.

This Information Notice is separate from Hakede’s Privacy Policy and Master Services Agreement.

The presentation of this Information Notice does not constitute the obtaining of explicit consent from the data subject. Where a personal data processing activity requires explicit consent, such consent shall be obtained separately.

1. Data Controller

The data controller under KVKK is:

Hakede Finansal Teknolojiler Limited Şirketi

Website: https://hakede.com

Privacy Contact: privacy@hakede.com

Legal Contact: legal@hakede.com

Address: Maslak Mah. Eski Buyukdere Cad. Iz Plaza Giz No:9, Sariyer, Istanbul, Turkiye

MERSIS Number: *************************

Trade Registry Number: *************************

2. Personal Data Processed

Depending on the nature of your relationship with Hakede, the following categories of personal data may be processed.

2.1. Identity Data

• first name;
• surname;
• date of birth;
• nationality;
• Turkish Republic identification number;
• foreign identification number;
• passport number;
• identity document information;
• signature information.

Not all of these data elements are collected from every data subject.

2.2. Contact Data

• email address;
• telephone number;
• residential address;
• business address.

2.3. Company and Commercial Activity Data

• trade name;
• tax identification number;
• tax office;
• MERSIS number;
• trade registry number;
• registered office;
• business activity;
• country of incorporation;
• website;
• authorised company representatives;
• company shareholders;
• ownership percentages;
• ultimate beneficial ownership information.

2.4. Financial Data

• IBAN;
• bank name;
• account holder name;
• account currency;
• Supplier Payout records;
• sales amounts;
• transaction amounts;
• refund amounts;
• chargeback amounts;
• reserve amounts;
• service fee records;
• foreign exchange conversion records;
• tax deduction records.

2.5. Transaction Data

• transaction identifier;
• order identifier;
• transaction date;
• transaction time;
• transaction currency;
• transaction amount;
• transaction status;
• payment method type;
• refund status;
• chargeback status;
• subscription status;
• country of sale.

2.6. Product Data

• Product name;
• Product description;
• Product category;
• Product price;
• subscription plan;
• sales model;
• Product website address;
• delivery method;
• licence information.

2.7. Transaction Security Data

• IP address;
• session records;
• user login records;
• failed login records;
• device information;
• operating system information;
• browser information;
• error logs;
• security incident records;
• risk indicators;
• suspicious transaction records.

2.8. Request and Communication Data

• support requests;
• support messages;
• email correspondence;
• complaints;
• objections;
• feedback;
• dispute records.

2.9. Marketing and Communication Preference Data

• commercial electronic communication consent;
• communication preference;
• marketing consent date;
• consent withdrawal date.

3. Methods of Collecting Personal Data

Personal data is obtained electronically through wholly or partially automated means using the methods described below.

3.1. Directly from the Data Subject

Personal data may be obtained through:

• Hakede account creation screens;
• Supplier onboarding screens;
• the Supplier Dashboard;
• identity verification screens;
• company verification screens;
• bank account information screens;
• Product registration screens;
• support systems;
• contact forms;
• email communications.

3.2. Through Hakede Systems

During use of the Hakede website and Supplier Dashboard, the following data may be generated automatically:

• IP address;
• device information;
• browser information;
• session information;
• login and logout records;
• security records;
• error logs;
• Dashboard activity records.

3.3. From Official and Authorised Sources

Where Hakede is legally authorised to access the relevant source, the following information may be verified:

• company trade name;
• tax identification number;
• trade registry information;
• MERSIS information;
• company address;
• authorised company representatives;
• company ownership information;
• tax liability information;
• document verification results.

3.4. From Third-Party Systems

The following information may be obtained from Merchant of Record, financial infrastructure, identity verification, and risk assessment systems:

• identity verification result;
• company verification result;
• Supplier assessment result;
• risk assessment result;
• transaction status;
• payment status;
• refund status;
• chargeback status;
• reserve information;
• tax calculation information;
• Supplier Payout information.

4. Purposes and Legal Bases for Processing Personal Data

4.1. Account Creation and Supplier Onboarding

Data processed: Identity, contact, company, Product, and transaction security data.

Purposes:

• creating a Hakede account;
• identifying the account holder;
• receiving the Supplier application;
• conducting the onboarding process;
• evaluating the Supplier application;
• providing the Supplier Dashboard;
• managing account settings.

Legal basis: Processing is necessary for the establishment or performance of a contract pursuant to Article 5(2)(c) of KVKK.

4.2. Identity, Company and Bank Account Verification

Data processed: Identity, contact, company, and financial data.

Purposes:

• verifying identity;
• verifying company information;
• verifying authorised company representatives;
• verifying company shareholders;
• verifying ultimate beneficial owners;
• verifying the bank account;
• detecting fraudulent information or documents.

Legal bases:

• processing is necessary for the establishment or performance of a contract pursuant to Article 5(2)(c) of KVKK;
• processing is necessary for Hakede’s legitimate interests in preventing fraud and misuse of the Services, provided that the fundamental rights and freedoms of the data subject are not adversely affected, pursuant to Article 5(2)(f) of KVKK.

4.3. Conducting Merchant of Record Processes

Data processed: Identity, contact, company, financial, Product, and transaction data.

Purposes:

• connecting the Supplier to Merchant of Record infrastructure;
• conducting the Merchant of Record application process;
• transferring Supplier information to the Merchant of Record Provider;
• receiving transaction information into Hakede systems;
• displaying indirect tax calculation information;
• displaying refund information;
• displaying chargeback information;
• displaying Supplier Payout information.

Legal basis: Processing is necessary for the establishment or performance of a contract pursuant to Article 5(2)(c) of KVKK.

The Merchant of Record Provider may act as an independent data controller in relation to its own final KYB assessment, risk assessment, payment processing, indirect tax processing, refunds, chargebacks, and Supplier Payout activities.

4.4. Sales and Transaction Management

Data processed: Financial, transaction, and Product data.

Purposes:

• creating sales records;
• displaying transaction information in the Supplier Dashboard;
• tracking subscriptions;
• tracking refunds;
• tracking chargebacks;
• generating Supplier revenue reports;
• generating transaction reports.

Legal basis: Processing is necessary for the performance of a contract pursuant to Article 5(2)(c) of KVKK.

4.5. Risk Management and Information Security

Data processed: Identity, company, financial, transaction, and transaction security data.

Purposes:

• identifying suspicious accounts;
• identifying suspicious transactions;
• detecting fraudulent documents;
• detecting account takeover attempts;
• reviewing unusual transaction volumes;
• reviewing high refund rates;
• reviewing high chargeback rates;
• detecting unauthorised access;
• protecting user sessions;
• investigating security incidents;
• preventing misuse of the Services.

Legal bases:

• processing is necessary for Hakede’s legitimate interests in protecting information security, user accounts, and commercial systems pursuant to Article 5(2)(f) of KVKK;
• processing is necessary for the establishment, exercise, or protection of a right pursuant to Article 5(2)(e) of KVKK.

4.6. Support and Communications

Data processed: Identity, contact, transaction, and request data.

Purposes:

• receiving support requests;
• responding to support requests;
• resolving account issues;
• investigating transaction issues;
• resolving technical issues;
• sending account, transaction, security, and contractual notifications.

Legal bases:

• processing is necessary for the performance of a contract pursuant to Article 5(2)(c) of KVKK;
• processing is necessary for Hakede’s legitimate interest in operating Supplier support processes pursuant to Article 5(2)(f) of KVKK.

4.7. Legal, Tax and Accounting Obligations

Data processed: Identity, contact, company, financial, and transaction data.

Purposes:

• maintaining records required by law;
• maintaining tax records;
• maintaining accounting records;
• responding to lawful requests from authorised public authorities;
• complying with court decisions;
• managing legal disputes;
• establishing, exercising, and protecting legal rights.

Legal bases:

• processing is expressly provided for by law pursuant to Article 5(2)(a) of KVKK;
• processing is necessary for Hakede to comply with its legal obligations pursuant to Article 5(2)(ç) of KVKK;
• processing is necessary for the establishment, exercise, or protection of a right pursuant to Article 5(2)(e) of KVKK.

4.8. Technical Improvement of the Services

Data processed: Transaction security and system usage data.

Purposes:

• identifying software errors;
• measuring system performance;
• improving system stability;
• identifying technical issues in the user interface.

Legal basis: Processing is necessary for Hakede’s legitimate interest in operating the Services securely and efficiently pursuant to Article 5(2)(f) of KVKK.

5. Transfer of Personal Data

Personal data may be transferred to the recipient groups identified below for the purposes specified.

5.1. Merchant of Record Provider

Data that may be transferred:

• identity data;
• contact data;
• company and ownership data;
• ultimate beneficial ownership data;
• bank account data;
• Product data;
• transaction data.

Purposes of transfer:

• evaluating the Merchant of Record application;
• conducting the final KYB review;
• providing Merchant of Record services;
• conducting risk and fraud controls;
• calculating and managing indirect taxes;
• transaction management;
• processing refunds;
• conducting chargeback processes;
• making Supplier Payouts.

5.2. Banks and Financial Infrastructure Providers

Data that may be transferred:

• transaction identifier;
• transaction amount;
• transaction currency;
• transaction date;
• payment method information;
• transaction status;
• identity information necessary for the relevant transaction.

Purposes of transfer:

• executing payment transactions;
• verifying transactions;
• ensuring transaction security;
• executing refunds;
• conducting chargeback processes;
• making Supplier Payouts.

5.3. Identity and Company Verification Providers

Data that may be transferred:

• identity data;
• company data;
• authorised company representative data;
• company ownership data;
• ultimate beneficial ownership data.

Purposes of transfer:

• identity verification;
• company verification;
• document verification;
• authorised company representative verification;
• ownership structure verification;
• ultimate beneficial owner verification.

5.4. Cloud, Server and Database Infrastructure Providers

Data that may be processed:

• account data;
• contact data;
• company data;
• Product records;
• transaction records;
• IP addresses;
• session records;
• support records;
• application records.

Purposes of transfer:

• operating the Hakede website;
• operating the Supplier Dashboard;
• operating Hakede application services;
• storing records;
• querying records;
• maintaining system backups.

5.5. Email and Support Infrastructure Providers

Data that may be processed:

• first name;
• surname;
• email address;
• Supplier Account information;
• notification content;
• support messages;
• documents attached to support requests;
• support history.

Purposes of transfer:

• sending account notifications;
• sending transaction notifications;
• sending security notifications;
• sending contractual notifications;
• receiving support requests;
• responding to support requests.

5.6. Security and Error Monitoring Providers

Data that may be processed:

• IP address;
• device information;
• browser information;
• error logs;
• application event logs;
• security incident records.

Purposes of transfer:

• identifying software errors;
• identifying security incidents;
• monitoring system stability;
• diagnosing technical problems.

5.7. Legal, Accounting and Audit Service Providers

Data that may be transferred:

• identity data;
• contact data;
• company data;
• contractual records;
• financial data;
• transaction records;
• dispute records.

Purposes of transfer:

• obtaining legal advice;
• managing legal disputes;
• complying with accounting obligations;
• conducting financial audits;
• maintaining statutory records.

5.8. Authorised Public Authorities and Judicial Authorities

Personal data may be transferred to:

• courts;
• public prosecutors;
• law enforcement authorities;
• tax authorities;
• authorised regulatory and supervisory public authorities

for the purposes of complying with legal obligations, responding to lawful official requests, implementing court decisions, or establishing, exercising, or protecting legal rights.

6. International Transfers of Personal Data

Where the Merchant of Record Provider used by Hakede, or its cloud, server, database, email, support, security, or verification infrastructure is located outside Türkiye, personal data necessary for the provision of the relevant service may be transferred outside Türkiye.

International transfers of personal data are carried out on the basis of a transfer mechanism permitted under Article 9 of KVKK and applicable to the relevant transfer.

Such transfers may be carried out on the basis of:

• an adequacy decision issued by the Personal Data Protection Board;
• a standard contract published by the Personal Data Protection Authority;
• binding corporate rules;
• an appropriate safeguard approved by the Board;
• an applicable incidental transfer condition under Article 9 of KVKK.

Where a standard contract is used, the notification procedures required under applicable legislation are fulfilled.

7. Processing Activities Requiring Explicit Consent

Hakede does not request separate explicit consent where a legal basis other than explicit consent exists under Articles 5 or 6 of KVKK for the relevant processing activity.

Where a personal data processing activity requires explicit consent:

• the explicit consent text shall be presented separately from this Information Notice;
• explicit consent shall be given freely;
• refusal to provide explicit consent shall not prevent use of Hakede services that do not require such consent;
• the data subject may withdraw the explicit consent granted, subject to applicable legislation.

Reading or receiving this Information Notice does not constitute explicit consent.

8. Rights and Applications Under KVKK

Data subjects may exercise their rights under Article 11 of KVKK by submitting an application to Hakede.

Applications may be submitted to:

Hakede Finansal Teknolojiler Limited Şirketi

Email: privacy@hakede.com

Address: Maslak Mah. Eski Buyukdere Cad. Iz Plaza Giz No:9, Sariyer, Istanbul, Turkiye

using the methods prescribed under the Communiqué on the Procedures and Principles of Application to the Data Controller.

An application must include:

• the applicant’s first name and surname;
• information sufficient to verify the identity of the applicant;
• the subject of the application;
• contact information to which the response should be sent.

Hakede may request additional information sufficient to verify the applicant’s identity for the purpose of processing the application.

Applications shall be reviewed and concluded within the period prescribed under KVKK.

9. Relationship with Other Hakede Legal Documents

This Information Notice has been prepared solely for the purpose of fulfilling Hakede’s transparency and information obligations under KVKK.

The Hakede Privacy Policy separately describes Hakede’s general practices relating to the protection of personal data, data security measures, data retention practices, cookies, and technical data protection approach.

The Hakede Master Services Agreement governs the commercial and contractual relationship between Hakede and the Supplier.

Where a personal data processing activity requires explicit consent, the relevant Explicit Consent Text shall be presented separately.