1. Data Controller

This Disclosure Notice has been prepared by AssisTT Holland B.V. ("Data Controller") in accordance with the General Data Protection Regulation (EU) 2016/679 — GDPR, the Payment Services Directive 2 (PSD2), and applicable financial legislation.

Contact Details:

•      Address: Kingsfordweg 151, 1043GR Amsterdam

•      E-mail: international@assistt.com.tr

•      Telephone: 0090 216 666 44 44

2. Categories of Personal Data Processed

2.1. Identity and Contact Data

•      First name, surname

•      Date of birth

•      Turkish National Identity Number (TCKN) / passport / identity document information

•      Address, email address, telephone number

2.2. Financial and Payment Data

•      IBAN and bank account information

•      Card information (in masked form)

•      Payment, transfer, and transaction history

•      Electronic money balance

•      Device and transaction identifiers

2.3. Legal and Compliance Data

•      Know Your Customer (KYC) data

•      Risk, fraud, and compliance assessment records

•      Notifications submitted to competent authorities

2.4. Digital and Security Data

•      IP address

•      Log and transaction records

•      Mobile application / web usage data

3. Purposes of Processing Personal Data

Your personal data are processed for the following purposes:

•      Execution of money transfer, payment, and settlement transactions

•      Prevention of fraud, money laundering, and terrorist financing

•      Conduct of risk management and internal control processes

•      Fulfilment of legal and regulatory obligations

•      Management of customer support, request, and complaint processes

4. Legal Bases

Your personal data are processed pursuant to Article 6 of the GDPR and applicable financial legislation on the following legal grounds:

•      Performance of a contract and pre-contractual measures (Art. 6(1)(b))

•      Compliance with a legal obligation (Art. 6(1)(c) — PSD2, Anti-Money Laundering legislation, financial regulations)

•      Legitimate interests (Art. 6(1)(d)(e)(f) — fraud prevention, information security)

5. Transfer of Personal Data

Your personal data may be transferred, only to the extent necessary and in compliance with the GDPR, to the following recipients:

•      Banks and payment infrastructure service providers

•      Card payment system organisations

•      Giftplay A.Ş.

•      Information technology, cloud, audit, and legal service providers

•      Competent regulatory and supervisory authorities

Transfers Outside the European Union

Where personal data are transferred outside the European Union, the following safeguards are applied:

•      European Commission adequacy decisions

•      Standard Contractual Clauses

•      Additional technical and organisational measures

6. Retention Periods

Your personal data are retained for the following periods:

•      Periods prescribed under financial and compliance legislation

•      Contractual term and applicable statutory limitation periods

•      Legitimate interest requirements

Upon expiry of the applicable retention period, personal data are disposed of in accordance with our Company's data retention and destruction policy.

7. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, customers are entitled to the following rights:

•      Right of access to personal data

•      Right to request rectification

•      Right to request erasure (subject to compatibility with applicable legislation)

•      Right to restriction of processing

•      Right to data portability

•      Right to object to processing

•      Right to object to automated decision-making and profiling

•      Right to withdraw explicit consent

Applications to exercise the above rights may be submitted via: international@assistt.com.tr