Clarification Text On The Protection And Processing Of Personal Data

Turkish Mercantile Exchange Inc. (TMEX) takes the utmost care to protect your personal data, along with all your fundamental rights and freedoms. Your personal data are processed and protected in accordance with the Personal Data Protection Law No. 6698 dated 24 March 2016 (the Law) and the applicable legislation. Through this Privacy Notice, we aim to inform you about the personal data we process.

1. Identity of the Data Controller

TMEX acts as the “Data Controller” under the Law and the applicable legislation. You may contact us using the contact details provided below:

Address: Mustafa Kemal Mah., Dumlupınar Blv., No: 252, TOBB Kuleleri, C Blok, Kat: 19, Çankaya/ANKARA

Telephone: 0 (312) 939 35 55

Fax: 0 (312) 939 35 56

Registered Electronic Mail (REM) Address: turkiyeurunborsasi@hs01.kep.tr

2. Purposes and Legal Bases for the Processing of Personal Data

Your personal data obtained within the scope of your legal relationship with TMEX may be processed for the purposes and on the legal bases set out below.

On the legal bases of “being expressly provided for by law” under Article 5(2)(a) of the Law and “necessary for compliance with a legal obligation to which the data controller is subject” under Article 5(2)(ç) of the Law:

  • Your identity, contact, location, financial, customer transaction and transaction security data may be processed to ensure that electronic warehouse receipts (EWR) and futures contracts based on EWRs are traded transparently and easily in an environment of trust, free competition and stability.
  • Your identity, contact, financial, customer transaction, personnel, professional experience and transaction security data may be processed to fulfil TMEX’s obligations arising from Article 53 of Law No. 5174 on the Union of Chambers and Commodity Exchanges of Türkiye and Chambers and Commodity Exchanges and other applicable legislation.
  • Your identity, contact, financial and customer transaction data, visual and audio recordings, and legal transaction and transaction security data may be processed to conduct supervision and surveillance of the TMEX activities, the functioning of the markets and market transactions in accordance with the relevant legislation; to carry out examinations and investigations within this framework; and to perform quality and standards audits.
  • Within the framework of TMEX information systems activities, your identity, contact, customer transaction, location and transaction security data may be processed to grant access rights to physical and electronic environments, monitor the exercise of such rights and fulfil legal obligations relating to internet access, with a view to ensuring effective and secure use in compliance with personal data protection and management systems policies and legal regulations.
  • Your identity, contact, location, financial, customer transaction and transaction security data may be processed to liaise with the relevant judicial and administrative institutions and organisations, including the Ministry of Trade of the Republic of Türkiye and the Capital Markets Board, and to submit documents to such institutions where compliance with the regulations and/or instructions of the competent authorities is required.

On the legal basis set out in Article 5(2)(c) of the Law: “Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of that contract”:

  • Your identity, contact, financial, location and customer transaction data may be processed to manage processes relating to letters of undertaking and contracts.
  • Your identity, contact, financial and customer transaction data may be processed to enable Commodity Market Intermediary Institutions (CMII) to contact you in accordance with the instructions and requests submitted to TMEX.
  • Your identity, contact, financial and customer transaction data may be processed to assess applications for authorisation to trade on the markets operated by TMEX.
  • Your identity, contact, financial, location and customer transaction data may be processed to verify that individuals authorised to trade on the markets operated by TMEX meet the required conditions, provide them with market access and enable them to use the trading platforms.
  • Your identity, contact, location, personnel, professional experience and transaction security data, as well as your visual and audio recordings, may be processed to authorise representatives of TMEX members.

On the legal basis set out in Article 5(2)(e) of the Law: “Data processing is necessary for the establishment, exercise or protection of any right”:

  • Your identity, contact, financial, customer transaction, legal transaction, location, risk management and transaction security data may be processed to match orders submitted to the markets operated by TMEX through the matching engine; clear and reconcile executed transactions; monitor order requests and cancellations, as well as queries sent to banks and the responses received; collect market orders and carry out clearing operations; record inventory files in the database and facilitate communications relating to market operations; resolve disputes; and ensure compensation for losses.
  • Your identity, contact, financial and customer transaction data may be processed to create current accounts, facilitate account transfers, calculate licensed warehouse fees in accordance with the applicable tariffs, prepare TMEX’s financial data and/or monitor accounting activities, and carry out index calculations and other TMEX statistical calculations.
  • Your identity, contact, financial, customer transaction and transaction security data may be processed to respond to and evaluate requests, complaints and questions submitted to TMEX, and to handle and track internal and/or external help desk calls.
  • Your identity, contact, financial, customer transaction, transaction security and personnel data may be processed to handle case files, investor complaints, formal notices, legal matters and proceedings, and to manage enforcement proceedings.

On the legal basis set out in Article 5(2)(f) of the Law: “Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject”:

  • Your identity, contact, financial, customer transaction and transaction security data may be processed to conduct supervision and surveillance of the TMEX’s activities, the functioning of the markets and market transactions in accordance with the applicable legislation; to carry out examinations and investigations within this framework; and to perform quality and standards audits.
  • Your identity, contact, financial and customer transaction data may be processed to maintain accounting records, fulfil tax obligations, carry out e-invoice and other invoicing procedures, invoice services obtained from TMEX and deliver invoices to the relevant recipients.
  • Your identity, contact, financial, customer transaction and transaction security data may be processed to safeguard TMEX’s legitimate interests and ensure transaction security, as well as legal and commercial security.
  • Your identity, contact, financial and customer transaction data may be processed to retain records of information provided through the call centre and/or other electronic and written channels.
  • Your identity, contact, financial, customer transaction and transaction security data may be processed to obtain storage and server services from third parties.
  • Your identity and contact data, as well as your visual and audio recordings, may be processed to provide information about and send invitations to training sessions, seminars, meetings, events and other activities organised or supported by TMEX, and to manage their organisation, including registration and participation processes.
  • Your identity, contact, financial, customer transaction and transaction security data may be processed to carry out communication and information activities; register, track and archive incoming and outgoing documents; and use such data in procedures before official authorities and in official correspondence.
  • Your marketing data may be processed to conduct TMEX’s customer relationship management processes, carry out customer satisfaction activities, manage advertising, campaign and promotional processes, follow up on requests and complaints, and carry out marketing activities for products and services.
  • Your data relating to visual and audio recordings may be processed to TMEX’s the physical security of the premises.

3. Recipients of Personal Data and Purposes of Transfer

Your personal data may be shared, in accordance with Article 8 of the Law, where expressly provided for by law and within the scope of our legal obligations, the performance of a contract and our legitimate interests, with CMIIs, our business partners, and the suppliers from whom we obtain services; Republic of Türkiye Ministry of Trade; the Capital Markets Board of Türkiye; Central Securities Depository and Trade Repository of Türkiye; the Union of Chambers and Commodity Exchanges of Türkiye; Borsa İstanbul A.Ş.; Istanbul Settlement and Custody Bank Inc.; Turkish Grain Board; and authorised public institutions and organisations and regulatory and supervisory authorities in Türkiye, including law enforcement agencies, Chief Public Prosecutors’ Offices, courts and enforcement offices.

4. Methods of Collecting Personal Data

Your personal data may be collected when you contact TMEX or establish a legal relationship with it, and throughout the duration of that relationship, for the purposes and on the legal bases set out above.

Such data may be collected from you, third parties—including suppliers of goods and services with whom we cooperate or have a contractual relationship and legal authorities; through written or electronic channels, including the internet, social media and other publicly accessible platforms; through training sessions, organised events and similar activities; through forms prepared by TMEX or other free-form submissions; or directly through Registered Electronic Mail Systems.

5. Rights of the Investor Whose Personal Data Are Processed

TMEX exercises due care to enable you to exercise the rights granted to you under the Law. Pursuant to Article 11 of the Law, you have the following rights in relation to your personal data:

  • To learn whether your personal data are being processed.
  • To request information about the processing of your personal data, where such data have been processed.
  • To learn the purpose of processing your personal data and whether they are being used in accordance with that purpose.
  • To know the third parties to whom your personal data have been transferred in Türkiye or abroad.
  • To request the correction of your personal data where they have been processed incompletely or inaccurately.
  • To request the erasure, anonymisation or destruction of your personal data where the grounds requiring their processing no longer exist, even if the data have been processed in accordance with the legislation.
  • To request that third parties to whom your personal data have been transferred be notified of the correction, at your request, of any incompletely or inaccurately processed data, and of the erasure, destruction or anonymisation of your data where the grounds for processing no longer exist.
  • To object to an outcome against you resulting from the analysis of your processed personal data exclusively by automated systems.
  • To request compensation for any damage suffered as a result of the unlawful processing of your personal data.

6. Contact Us Regarding Your Rights and Requests

You may submit your requests under Article 11 of the Law in writing, by petition or through a notary public, to the Company’s address at “Mustafa Kemal Mah., Dumlupınar Blv., No: 252, TOBB Kuleleri, C Blok, Kat: 19, Çankaya/ANKARA”, or via the Company’s REM address using a secure electronic signature, a mobile signature or, where available, an email address previously provided by you to our Company and registered in the Company’s systems.

Data Controller

TURKISH MERCANTILE EXCHANGE INC.

Last Updated: 14.07.2026