Purpose, Legal Basis, and Your Rights Regarding Your Personal Data

At PayTR Payment and Electronic Money Institution Inc. (“we,” “us,” or “PayTR”), we collect and process your personal data strictly in accordance with:

Law No. 6698 on Protection of Personal Data (KVKK), where we act as Data Controller, and
Law No. 6493 on Payment and Securities Settlement Systems, Payment Services, and Electronic Money Institutions, along with all other applicable legal obligations.

Your data will only be used for the purposes you have expressly consented to—or for the exceptions legally permitted—and we apply industry-standard security measures to protect it. We will retain your information only for the periods required by law.

A. Personal Data of Merchants Using Our Payment Services (“Merchant Data”)

Personal Data Category	Processing Purpose	Legal Basis	Recipients & Purpose
Identity & Contact – Full name – National ID / Tax ID – ID card / signature circular – Address, phone, mobile, e-mail	• Evaluate merchant application • Conduct identity-verification processes	• Legal obligation of the Data Controller • Performance of the contract	Consultants: solve legal disputes Financial Institutions: ensure trust agreements Independent Auditors: audit activities
Financial – Tax registration certificate	• Evaluate merchant application • On-boarding into our system	Required by law	Interbank Card Center (BKM): create merchant registry
Integration & Billing – Bank account details – e-invoice & e-archive invoices – Balance information – Signature circular	• Integrate POS systems • Issue invoices and process payments	• Performance of the contract • Legal obligation	Integrator Partners: POS integration Tax Consultants: financial advice Independent Auditors: audit activities
Transaction Security – Signature	• Ensure transaction security • Report suspicious transactions	Legal obligation of the Data Controller	Regulatory Authorities: mandatory reporting
Marketing Consent – Name – Mobile, e-mail	Send promotional communications (opt-in only)	• Legal requirement • Your explicit consent	Comms Platform Providers: deliver messages

B. Personal Data of Merchants’ Customers (“Customer Data”)

Personal Data Category	Processing Purpose	Legal Basis	Recipients & Purpose
Identity – Full name	• Issue invoices & settle payments • Verify transaction security	• Legal obligation of the Data Controller • Performance of the contract • Our legitimate interest • Establish, exercise or protect a right	Invoice Partners: generate invoices Tax Consultants: financial advice Auditors & Authorities: audit & reporting
Financial – Bank account & tax ID details	Issue invoices & settle payments	• Legal obligation of the Data Controller • Performance of the contract	Same as above
National ID – T.C. Identity Number	• Billing, identity verification • Fraud prevention	• Legal obligation • Performance of the contract • Our legitimate interest	Same as above
Contact – Phone, e-mail, address	• Transaction security • Internal audit • Customer support	• Performance of the contract • Our legitimate interest • Establish, exercise or protect a right	Same as above
Signature Circular	• Evaluate merchant applications • Respond to support requests	• Legal obligation of the Data Controller • Performance of the contract	Consultants: resolve legal disputes

All data are collected electronically and processed solely for the purposes listed above. As a data subject, you may exercise your rights under Article 11 of KVKK by:

Submitting a signed letter listing the rights you wish to exercise, or
Using the downloadable form here with your identity documents.

You may also review your legal rights under Article 11 of KVKK.

We will respond within 30 days, free of charge. If our response exceeds 10 printed pages, a fee of ₺1 per additional page applies. For responses on physical media (CD, flash drive), we will charge only the cost of that medium.

If you act on someone else’s behalf, please provide your own identity details, proof of authority, and the principal’s identity documents with your request.