BİP PRIVACY NOTICE

Publication Date: 03/07/2020

Who We Are

The BiP Application (“Application”) is provided by Turkcell İletişim Hizmetleri A.Ş. (hereinafter to be referred to as “Turkcell”, “we”, “us”, “our”).

Turkcell is committed to protect and respect your Personal Data in accordance with the applicable data protection legislation, including the provisions of the Law No. 6698 on the Protection of Personal Data, General Data Protection Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and other applicable laws (hereinafter referred to as the “Data Protection Legislation”).

This Privacy Notice(“Notice”) sets out how we collect, use and share information that identifies or make specifiable your (“(you”, “your” or user”) identity (“Personal Data”). If you have a request concerning this Notice or if you have a complaint, please contact us through our Data Protection Officer whose contact details are provided under “Contact us” section below. You may also contact your local data protection authority. For the interpretation of undefined terms stated in this Notice, we refer to the definitions as used in the internal BiP terms of use of Turkcell (“Terms of Use”). For more information about cookies please also read our cookie policy.

In What Way are Your Personal Data Collected?

Turkcell collects your Personal Data from you when you voluntarily submit information directly to us or through the Application. This include information you provide when you register to use the Application, create an account, set up a profile, complete a form, correspond with us, purchase products through the Application or respond to surveys or promotions.

In addition to this, we also collect Personal Data indirectly from you such as the device you connect to the Application with, information about how you use the Application or information about you gained from third parties such as our service providers.

In the following sections, you may find detailed information on which data are collected for which purposes.

Which Personal Data are Collected?

We describe the categories of Personal Data we have collected in more detail below:

  • Identity and Contact Details: data such as your phone number, user name (nickname), avatar, GSM operator, e-mail address and other similar data, subscription information, passwords used for the Application if available for the identity verification and for access to the account.
  • Usage Data and Favorites: data such as satisfaction survey results or similar survey results conducted through the Application, including but not limited to various technical data collected through technologic devices from your devices, the kind of messages (text, video, etc.) that have been sent without any information about its content, your preferred language, active periods, types of services that are used, usage habits regarding the Application interface, date of the last entry to the Application, errors occurred during the use of the Application.
  • Location Data: data related to the (approximate) locations of users. Depending on device settings as controlled by you, including GPS data as well as nearby base transmission stations and Wi-Fi hotspots, and location and navigation data obtained from the IP addresses.
  • Payment Data: in the event that you make any in-app purchases, payment information including relevant price, invoice, invoice number, tax amount and method of payment.
  • Device Data: data such asdevice model, operating system of the device, preferred phone language, information regarding which operator the users use, country information.
  • Communication Data: data related to the communication type (BiP Out Calls, call/instant messages etc.), the duration, time, type, parties and contacts of communication. Turkcell does not collect any data related to the content of your communication made via the Application.
  • Backup Data: in case the users request, the communication data can be backed up by Turkcell.
  • Address Book Data: Contact List including phone numbers, contact names, surnames and relevant details stored in the user’s device.
  • Nickname, Profile Picture, Status Note, Blocked Numbers.
For What Purposes Your Personal Data are Processed?

Your Personal Data is being processed by Turkcell for the purposes described below:

  • Identity Information: These are processed for the purposes of user registration, error/failure notice, control, developing and realizing operational activities, business development, customer portfolio management, measurement of the service quality, communication, intra-company evaluation, promotion, service analysis, complaint management, management of the customer survey process and forwarding the Application subscription to other devices.
  • Data and Favorites: These Personal Data are processed for the purposes of business development, direct or indirect marketing (customer campaigns, advertisement, services and functions within the application which are being advised to the customers, the offering of advertisements), profiling (the offering of advertisements according to your preferences, diversification of customers according to location, operator, tenure, the duration of using the application, and its functions), supervision and control, risk management, development of the after sale processes, intra-company evaluation, portfolio management, measurement and development of the service quality, communication, execution of the complaint management processes, execution and development of operational activities, translate services which are being provided by Microsoft and Google (as further referenced below), error/failure notice and recovering service quality based on usage habits. These are processed for promotional purposes, intra-company evaluation, for analysis and communication through anonymous data (in a way that the users cannot be identified) and statistical evaluation.
  • Location Data: These Personal Data are processed for the purposes of allowing users to share their location with each other, supervising and controlling location services associated with the “Discovery” area, product and strategy development.
  • Payment Data: These Personal Data are processed for the purposes of managing the invoicing process and the payment information which belongs to the users who purchases in-app services (regardless whether such user is a Turkcell subscriber or not), the management of payment information, accounting, improving after sale processes, business development, intra-company evaluation, customer portfolio management, after sale services, communication, marketing, supervision and control.
  • These Personal Data are processed in order to optimize the Application and related services and to enable the device to work properly with the Application and its settings.
  • : These Personal Data are used to determine the usage habits with the purpose of the business development, marketing, enhancing the service quality and the unauthorized and fraudulent use. During the processing of these personal data, there is no processing of any data regarding the content of the communication.
  • These Personal Data are used for backing up the communications of the users at their request. The messages that the user has received from or sent to another user shall be archived only upon the request of the other user.

Turkcell may anonymize and aggregate any of the data which has been collected (so that it does not directly or indirectly identifies or specifies the users). Turkcell may use anonymized data for purposes that include testing its IT systems, research, data analysis, improving the Application, developing new products, direct or indirect marketing, advertisement, profiling and features or displaying information about the purchases made via the Application (such as the most popular purchases or purchases based on an approximate location).

What is The Legal Basis for Processing the Personal Data?

Turkcell is obligated to process the Personal Data in accordance with the above-mentioned purposes and in compliance with the applicable Data Protection Legislation. The Personal Data processed by Turkcell may be required for registering the use of the Application, creating an account, setting up a profile, completing a form, corresponding with Turkcell, purchasing products through the Application or responding to surveys or promotions, for which the user has given its consent.

Where the user has given consent as the legal basis for the processing of Personal Data, the user always has the right to withdraw consent at any time.

Personal Data may be collected wholly or partially via automatic or non-automatic methods, processed and transferred for the purposes contained in this Notice based on legal grounds indicated in Articles 5 and 6 of Law on the Protection of Personal Data and listed hereunder and also Article 6 of GDPR (or other Applicable Data Protection Legislation) via vendors, call centers, web sites, application, messages and any kind of written, oral and electronic mediums.

•           As required in the legislation to which Turkcell is subjected,

•           Provided that the processing is directly related to conclusion or performance of a contract, it is necessary to process Personal Data of the parties to the contract in order to be able to provide the requested products and services, or to fulfill the requirements of any contracts that users have concluded,

•           Data processing is mandatory in order for Turkcell to fulfill its legal liabilities,

•           Respective Personal Data has already been made public by data subject,

•           Data processing is obligatory for the establishment, exercise or protection of a right,

•           Data processing is necessary for the legitimate interests of Turkcell, provided that such processing does not violate the fundamental rights and freedoms of the data subjects.

Purpose Limitation

The Personal Data may only be processed to the extent necessary for the purposes described above. Personal Data may not be processed for other purposes other than that for which the Personal Data were collected. If there is a necessity or need to process Personal Data for other purposes, Turkcell shall investigate whether the purposes of the intended data processing are compatible with the original purposes. Turkcell shall provide the user prior to that further processing with information on that other purpose. Turkcell shall minimize data processing as is reasonable and appropriate to do so.

Where is Personal Data Being Stored and Processed?

The Personal Data Turkcell collects may be transferred to and stored in countries outside of the jurisdiction the users are in, including, in particular, outside the European Union (EU) or European Economic Region (EER). Some of these countries offer differing levels of protection in respect of Personal Data and may, in certain instances, be less protective than the country the user is typically resident in. Turkcell takes all reasonable steps to ensure that the Personal Data is treated securely and in compliance with this Notice and the Data Protection Legislation. The transfer of Personal Data take place only in compliance with the applicable Data Protection Legislation, and where appropriate safeguards are in place that ensure the level of protection of parties as required by the applicable laws.

With Whom are the Personal Data Shared?

Turkcell may share the Personal Data it has obtained with the following parties:

  • Users: Turkcell and the user may share the Personal Data with other users (including Official Accounts) as part of the Application so users are able to interact with other users as permitted by the functionality of the service and their preferences and applicable law.  Where a User shares Personal Data of another individual, they take full responsibility for their actions in doing so.
  • Companies in the same group of companies as Turkcell: the subsidiaries of Turkcell (i.e. any organization Turkcell owns or controls) or ultimate holding company (i.e. any organization that owns or controls Turkcell) and any subsidiaries it owns. These companies will only use the personal data in the same way as Turkcell can under this Notice. CJSC Belarusian Telecommunications Network in Belarus and lifecell LLC in Ukraine, both subsidiaries of Turkcell,  will also use the personal data for its own marketing, promotion and advertising purposes and its legal obligations as well as to improve the quality and enrich the content of its products, services and applications, and marketing the same, as shown in its own privacy notice (https://www.turkcell.com.tr/tr/gizlilik-ve-guvenlik), where lawful to do so in accordance with Data Protection Legislation.
  • Service providers, partners and advisors: third parties who provide a service to Turkcell, partners of Turkcell on marketing and other business activities, advises Turkcell or that Turkcell works with in other business capacities. Where lawful to do so, Turkcell may also pass the Personal Data to its marketing and other business partners and other carefully selected third parties who may wish to offer you other goods or services that Turkcell or they have identified as likely to be of interest to you. These third parties will only be allowed to use the Personal Data in accordance with Turkcell’s instructions or marketing preferences of the users (where applicable) and will be required to keep this information secure, in accordance with the data processing agreements that are signed with these parties, where applicable.
  • Law enforcement, regulators and other parties for legal reasons: third parties with whom Turkcell is under a legal obligation to disclose the Personal Data to or to whom Turkcell needs to disclose the Personal Data to protect its rights, property or safety or the rights, property or safety of others, detect and investigate illegal activities and breaches of any agreement we have with you.

Turkcell may provide third parties with aggregate statistical data and analyses about users of the Application. Turkcell declares that no one can be identified from the data shared like this as long as it has not been disclosed by Turkcell.

Please be noted that the content of communications between users or the transactions conducted with third party service providers on the Discovery area are not monitored.

If you activate automatic translation functionality, the submitted words will be shared with a third-party service provider namely Microsoft and Google. Turkcell is not responsible for such third-party service providers.

Your Rights Regarding Your Personal Data

Application users, pursuant to the Article 11 of Law on the Protection of Personal Data, may be entitled to exercise the following rights:

•           To learn if their Personal Data is processed or not,

•           If processed, to request information in this regard,

•           To learn the purpose of processing for Personal Data and to know whether it is processed based on these purposes,

•           To learn the third parties inside Turkey or abroad to whom the Personal Data is transferred,

•           To request Personal Data to be corrected if it has been processed deficiently or incorrectly,

•           To have their Personal Data deleted or destroyed within the framework of terms set forth in Article 7 of Law on the Protection of Personal Data,

•           To request transactions made pursuant to correction, deletion and destruction rights indicated above to be informed to the third persons to whom Personal Data is transferred,

•           To object to processing of their Personal Data exclusively by automatic means,

•           To request to indemnify the damage they have suffered in case of illegal processing of their Personal Data.

In addition to the rights stated above, depending on their location, the Application users may also have the right to:

  • learn whether their Personal Data are being processed;
  • request information and a copy if their Personal Data have been processed;
  • learn the purpose of the processing of Personal Data and whether these are being processed in compliance with such purpose; 
  • learn the third-party recipients to whom the Personal Data are disclosed within the country or abroad, 
  • request rectification, correction or limitation of the processed Personal Data which is incomplete or inaccurate,
  • erasure or destruction of data in accordance with the conditions set forth in the Data Protection Legislation,
  • request processing is restricted where dependent on user consent,
  • if applicable, request their personal data, which they provided to Turkcell, is transferred to another data controller or data subjects themselves in a structured, commonly used and machine-readable format,
  • object to the processing of their personal data
  • notify the third person to whom the Personal Data are disclosed, about the processes regarding rectification, erasure and destruction of data,
  • object to negative consequences about them that are concluded as a result of analysis of the processed Personal Data by solely automatic means, which produces legal effects or significantly affects them,

In order to exert any of your rights stated above in relation to your Personal Data or exert your right of data portability (if applicable), please contact us using the contact details set out in the “Contact Us” section below. In order to help you find the data you would like to use your abovementioned rights, please provide as much information as you can about the data you would like to use your rights. Information provided shall be free of charge, unless the request is clearly unfounded or disproportionate, in which case a reasonable fee may be requested, or the request may be refused. Users also have the right to lodge a complaint with a local supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

Alternatively, you can forward your questions and requests regarding your Personal Data via one of the following methods:

(i)         Once you download Personal Data Application Form (https://s.turkcell.com.tr/SiteAssets/ Hakkimizda/dokuman/pdf/turkcell-kisisel-veri-basvuru-formu.pdf) to your device, by filling it digitally and e-mailing to turkcell.kisiselverilerikoruma@hs03.kep.tr address from your registered electronic mail (KEP).

(ii)        Once you print out the Personal Data Application Form, by completing the form in writing and sending it to “Turkcell Genel Müdürlük Aydınevler Mahallesi İnönü Caddesi No:20 Küçükyalı Ofis Park B Blok – Maltepe/İstanbul” address via the notary public.

Children

Users must be 16 years of age or older to subscribe, register or share any Personal Data to the Application and we do not intend to solicit, collect or process Personal Data of Users under the age of 16. In certain jurisdictions, the age may be older than 16, in which case, you must satisfy that age in order to become a subscriber. If you believe we have inadvertently processed Personal Data of a User under the age of 13, please contact us at the details provided.  If we discover that we have inadvertently processed the Personal Data of any user under the age of 16, we reserve the right to delete it.

Retention Period of Personal Data

Turkcell shall retain Personal Data during the period necessary for the purpose(s) for which it has been collected and/or is being processed for up to 2 (two) years unless a longer retention period is established by applicable laws. This includes the retention of Personal Data during a limited period determined as per the relevant legislation in case any dispute might arise from the Terms of Use. Please note that messages sent while a user is offline will be kept for a maximum of three weeks and will be deleted after the expiration of the aforementioned period. Turkcell will securely delete Personal Data and ensure all recipients of Personal Data comply with the same obligation as soon as Personal Data is no longer necessary in relation to the purpose for which it was processed unless Turkcell is required to retain Personal Data for a longer period by law.

Measures for Data Security

 Turkcell takes the security of your Personal Data seriously and it has appropriate technical and organizational measures in place in order to prevent unauthorized access and unlawful processing of Personal Data. Your Personal Data is protected by our strong security features, which we strictly enforce and periodically review.

Turkcell shall not disclose any Personal Data of users to any third party in defiance of this Notice and/or applicable Data Protection Legislation. Turkcell shall only use Personal Data for secondary processing insofar such processing is compatible and lawful. In case Personal Data of the users are shared with outsource service providers in accordance with the provisions of this Notice, Turkcell shall take necessary measures so that such third-party providers shall provide at least a similar level of security for the personal data.

However, Turkcell does not bear any responsibilities for third party applications to which a link is provided via the Application and for transactions conducted with other users and/or third parties under the “Discover feature of the Application, to the extent these applications are not under the control of Turkcell.

Automated Decision Making

We do not use Personal Data to make automated decisions about users.

Changes to this Notice

Turkcell shall update and change the provisions of this Notice, e.g. in case of any change/update in the Data Protection Legislation, in which case the updated Notice will be brought under your attention by publishing it via the Application. Updates and changes in the Notice made by Turkcell shall be effective as of the date of its publication on the Application.

Contact us

Questions, comments and requests regarding this Notice can be addressed via email at info@bip.com or in writing to the below e-mail or postal addresses:

Data Protection Officer
dpo@turkcell.com.tr

Aydınevler Mahallesi İnönü Caddesi No:20/36 Küçükyalı Ofispark Maltepe/ İstanbul Turkey