Personal Data Protection Information

As EDUVENCE TEKNOLOJİ ANONİM ŞİRKETİ (hereinafter referred to as "EDUVENCE" or the "Data Controller"), we would like to emphasize our sensitivity regarding the protection of your personal data. In this context, acting as the Data Controller under Article 10 of Law No. 6698 on the Protection of Personal Data ("Law"), and in accordance with the data controller's obligation to inform, we declare that we have prepared this Text in order to inform you about the methods by which your personal data is collected, the purposes and legal grounds on which it is processed, to whom and for what purposes it may be transferred, and the rights you hold under the Law. This Text may be updated in line with changes made to the relevant legislation. You can always access the current version of this text on EDUVENCE's website / Portal.

1. Data Controller

Under the Law, your personal data is processed by EDUVENCE, acting as the data controller, within the scope of the website and other services provided by EDUVENCE, in accordance with the procedures and principles set out in this Text.

2. Methods of Collecting Personal Data and Legal Grounds

EDUVENCE collects personal data through the following methods:

Transactions carried out through the website, mobile application and social media platforms.
Information obtained through cookies and other digital tracking technologies.
Electronic, written and/or verbal communication channels.
Notifications or legal notices from public institutions.

The website owned by EDUVENCE uses cookies to improve user experience and fulfill its legal obligations.

Your personal data is processed in accordance with the principles set out in Article 4 of the Law, namely: lawfulness and fairness; accuracy and, where necessary, being up to date; being processed for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes for which they are processed; and being retained for the period stipulated by the relevant legislation or required for the purpose of processing.

Your personal data is processed by EDUVENCE based on your explicit consent where required; where explicit consent is not required, it may be processed based on one or more of the following legal grounds set out in the second paragraph of Article 5 of the Law:

It is expressly provided for by law,
It is mandatory for the protection of the life or physical integrity of the person concerned, or of another person, where the person concerned is unable to disclose their consent due to actual impossibility or whose consent is not deemed legally valid,
It is directly related to the establishment or performance of a contract: Creating membership, providing educational services, managing the user account, carrying out payment and billing processes, providing customer support services, and fulfilling contractual obligations,
It is mandatory for EDUVENCE to fulfil its legal obligation as data controller: Fulfilling record-keeping, retention, reporting and audit obligations arising from legislation, and responding to duly made requests for information and documents from authorized public institutions and organizations,
The data has been made public by the person concerned: Processing of personal data that the person concerned has made public, provided this is consistent with their intention in making it public,
It is mandatory for the establishment, exercise or protection of a right: Preventing or resolving potential legal disputes, conducting litigation and enforcement proceedings, and fulfilling burden-of-proof obligations,
It is mandatory for EDUVENCE's legitimate interests as data controller, provided this does not harm the fundamental rights and freedoms of the person concerned: Ensuring information security, developing systems, improving service quality, enhancing user experience, conducting audit activities, preventing fraud and misuse, and enabling corporate operations to continue safely and effectively.

Under Article 6 of the Law, your special categories of personal data may be processed where one of the following data processing conditions set out in the Law is present:

The explicit consent of the person concerned,
It is expressly provided for by law,
It is mandatory for the protection of the life or physical integrity of the person concerned, or of another person, where the person concerned is unable to disclose their consent due to actual impossibility or whose consent is not deemed legally valid,
It relates to personal data that has been made public by the person concerned and is consistent with their intention in making it public,
It is mandatory for the establishment, exercise or protection of a right,
It is necessary for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services, by persons under an obligation of confidentiality or by authorized institutions and organizations,
It is mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
It relates to foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade-union purposes, provided that the processing is in accordance with their applicable legislation and purposes, is limited to their field of activity, is not disclosed to third parties, and is directed at their current or former members or persons who are in regular contact with such organization or formation.

Where special categories of personal data that are not required for the performance of the services provided by EDUVENCE are transmitted, such data will not be processed, in accordance with the principle of data minimization, and will be deleted, destroyed or anonymized within the framework of the relevant legislation.

3. Purpose of Using Cookies

Cookies are used on EDUVENCE's website and mobile applications for the following purposes:

To remember user preferences and personalize the experience.
To analyze site and application performance and carry out development work.
To improve the functionality of the Site and provide ease of use.
To present advertising and promotional content that may interest users.
To fulfill legal obligations and provide information in accordance with legal requests.

Users can refuse the storage of cookies by using their browser settings. However, in this case, access to all functions of the site may be limited.

4. Personal Data Processed

Your personal data collected through the platform in the course of your use of the Portal is listed below by category:

Identity Information: First and last name, Turkish ID number (or foreign ID/passport number), date of birth.
Contact Information: Email address, phone number, residential/billing address.
User and Account Information: Username, encrypted password (in hash format), user ID, profile photo, account preferences and language settings.
Education and Performance Information: Courses enrolled in/completed, course viewing durations, progress/completion rates, exam and test results, homework and project submissions, certificate information and success scores.
Visual and Audio Records: Audio and video recordings transmitted via your camera/microphone during live classes, webinars and interactive sessions, and forum posts.
Payment and Financial Information: Purchase history, billing information (your credit card information is processed directly by the payment infrastructure provider and is not stored in our systems).
Transaction Security and Technical Data: IP address, port information, system login/logout log records, device type, operating system, browser information and cookies.
Marketing: Preferred service information, surveys, service preferences, etc.

Customer Transaction and Communication Data: Support requests, notifications, complaints, survey responses and feedback.

5. Purposes of Processing Personal Data

EDUVENCE may use your personal data for the following purposes, in accordance with the personal data processing conditions set out in the Law:

Carrying out Portal membership processes and creating the user account,
Carrying out Portal membership relationship management processes;
Providing educational content, conducting live classes and tracking participation,
Evaluating success, checking homework/exams and issuing certificates/certificates of participation,
Improving the quality of education, carrying out performance analysis and statistical reporting,
Keeping system access (log) records within the scope of Law No. 5651 and ensuring information security,
Carrying out payment, billing and financial processes,
Resolving user support requests and complaints,
Fulfilling legal obligations arising from legislation.
Verifying user identity information.
Organizing advertising, campaign and promotional activities.
Meeting requests from public authorities.

6. Storage and Protection of Personal Data

EDUVENCE takes the necessary technical and administrative measures to protect your personal data against the risk of unauthorized access, loss, alteration or disclosure. It conducts regular tests in accordance with national and international standards on data confidentiality and updates its policies accordingly.

EDUVENCE securely retains the personal data it processes, in physical and/or electronic environments, for the retention periods stipulated by the relevant legislation and for the periods required by the purpose of processing, in accordance with the Law and other relevant legislation. However, in cases such as the fulfilment of a legal obligation, serving as evidence in potential disputes, the establishment, exercise or protection of a right, or where the relevant legislation stipulates a longer retention period, your personal data may continue to be retained for the period required by the relevant obligation or purpose.

The envisaged retention periods are approximately as follows:

Data Type	Retention Period	Legal Basis	Destruction Period
Personal Data Relating to Members/Users	10 years from the termination of the legal relationship	Law No. 6563 and secondary legislation, Law No. 6102	Within the first periodic destruction period following the end of the retention period
Personal Data Relating to Potential Members/Users	2 years	Legitimate interest of the data controller under KVKK Art. 5/2-f	Within the first periodic destruction period following the end of the retention period
Personal Data Relating to Online Members/Users	10 years after the termination of the legal relationship; 3 years under Law No. 6563 and related secondary legislation	Law No. 6563, Law No. 6102, Law No. 6098, Law No. 213, Law No. 6502	Within the first periodic destruction period following the end of the retention period
Personal Data Relating to Online Members/Users (Log Records)	2 years	Law No. 5651 and secondary legislation	Within the first periodic destruction period following the end of the retention period
Records Relating to the Sending of Commercial Electronic Messages	Records relating to consents for commercial electronic messages, 3 years from the date the consent becomes invalid; other records relating to commercial electronic messages, 3 years from the date of collection	Law No. 6563; Regulation on Commercial Communication and Commercial Electronic Messages	Within the first periodic destruction period following the end of the retention period

7. Sharing and Transfer of Personal Data to Third Parties

EDUVENCE may transfer the personal data of members/users it has collected, limited to the fulfilment of the purposes stated above, to its service providers, legally authorized public institutions, and private persons or organizations and third parties, in accordance with the personal data processing conditions set out in Articles 8 and 9 of the Law and limited to the purposes stated above, both domestically and abroad.

Party With Whom Data Is Shared	Purpose	Example
Individuals/Legal Entities from Whom Services Are Received	Ensuring the Security of Information, Transactions and Personal Data	Sharing personal data with suppliers providing storage services through cloud computing or similar means, for the purpose of secure storage. Transferring data to suppliers providing software services through cloud computing or similar means, for the purpose of tracking and managing commercial processes relating to Members/Users
Individuals/Legal Entities from Whom Services Are Received	Carrying Out Sales and After-Sales Support Processes	Sharing personal data with banks, financial institutions and similar third parties providing support within the scope of the performance of the contractual relationship
Individuals/Legal Entities from Whom Services Are Received	Carrying Out Communication Processes	Transferring data to suppliers providing email services using servers and cloud services, for the purpose of secure communication via email
Individuals/Legal Entities from Whom Services Are Received	Carrying Out Marketing, Campaign and Advertising Processes	Sharing personal data with third parties providing these services, for the purpose of sending commercial messages, making campaign announcements and providing service advertisements
Individuals/Legal Entities from Whom Services Are Received	Follow-up of Legal Proceedings	Sharing personal data with lawyers or legal service providers engaged for consultancy, including consumer arbitration committee and litigation proceedings
Authorized Persons, Institutions and Organizations	Providing Information to Authorized Persons, Institutions and Organizations	Sharing personal data with persons, institutions and organizations authorized by law, within the framework of the relevant legal obligation

EDUVENCE acts in accordance with the provisions of Article 9 of the Law regarding the transfer of personal data abroad.

In this context, personal data may be transferred abroad if at least one of the personal data processing conditions set out in Articles 5 and 6 of the Law is present, and if there is a valid and current adequacy decision issued by the Personal Data Protection Board ("Board") regarding the country, the sectors within that country, or the international organization to which the transfer will be made.

When issuing an adequacy decision, the following factors are taken into account: the data protection legislation and practices of the country, sector or international organization to which the personal data will be transferred; the state of reciprocity with Turkey regarding data transfer; the existence of an independent and effective data protection authority; the availability of administrative and judicial remedies in the relevant country; the country's membership of international conventions and organizations relating to the protection of personal data; and international agreements to which Turkey is a party, among other relevant matters.

In the absence of an adequacy decision, personal data may be transferred abroad provided that at least one of the data processing conditions set out in Articles 5 and 6 of the Law exists, that the person concerned is able to exercise their rights and apply to effective legal remedies in the country to which the transfer will be made, and that one of the following appropriate safeguards is provided:

The existence of an agreement, not in the nature of an international treaty, made between public institutions and organizations abroad or international organizations and public institutions and organizations in Turkey or professional organizations with public institution status, to which the Board has permitted the transfer,
The existence of binding corporate rules approved by the Board, for companies within a group of undertakings carrying out joint economic activity,
The due execution, between the parties, of the standard contract announced by the Board,
The existence of a written undertaking containing provisions that will provide sufficient protection, and the Board's permission for the transfer.

In the absence of an adequacy decision and where none of the appropriate safeguards set out above can be provided, personal data may only be transferred abroad on an occasional basis where one of the following situations set out in Article 9 of the Law exists:

The person concerned has given explicit consent, having been informed of the possible risks,
The transfer is mandatory for the establishment or performance of a contract between the person concerned and the data controller, or for the implementation of pre-contractual measures taken at the request of the person concerned,
The transfer is mandatory for the establishment or performance of a contract to be made between the data controller and another natural or legal person, for the benefit of the person concerned,
The transfer is mandatory in terms of overriding public interest,
The transfer of personal data is mandatory for the establishment, exercise or protection of a right,
The transfer of personal data is mandatory for the protection of the life or physical integrity of the person concerned, or of another person, where the person concerned is unable to disclose their consent due to actual impossibility or whose consent is not deemed legally valid,
The transfer is made from a registry that is open to the public or to persons with a legitimate interest, provided that the access conditions stipulated in the relevant legislation are met and the transfer is made at the request of the person with a legitimate interest.

Personal data may not be transferred abroad on an occasional basis by public institutions and organizations, within the scope of activities subject to public law, on the grounds of the explicit consent of the person concerned, or the establishment or performance of a contract, or the establishment or performance of contracts to be made with third parties for the benefit of the person concerned. In addition, in subsequent transfers of personal data transferred abroad and in transfers to international organizations, the safeguards set out in Article 9 of the Law will be ensured and the provisions of the relevant article will be complied with.

In cases where Turkey's interests or the interests of the person concerned could be seriously harmed, personal data may be transferred abroad with the permission of the Board, obtained following the opinion of the relevant public institution or organization, without prejudice to the provisions of international agreements.

8. Users' Rights Arising from the Law

Users have the following rights under Article 11 of the Law:

To learn whether their personal data has been processed.
To request information if personal data has been processed.
To question the purpose of processing and whether the data is used in accordance with that purpose.
To request correction if data has been processed incompletely or incorrectly.
To request the deletion or destruction of data within the scope of legal conditions.
To know the third parties, domestically or abroad, to whom personal data has been transferred.
To know the third parties to whom data has been transferred within the scope of the relevant Law.
To object to a result that is to their detriment arising from the analysis of processed data exclusively through automated systems.
To claim compensation in the event of damage due to unlawful processing.

You may submit the requests set out above to us using the application methods specified in the Law and the contact information provided below. (The relevant request must comply with the conditions set out in the Communiqué on the Procedures and Principles Regarding Application to the Data Controller.) If you submit your requests regarding these rights in the manner described above, EDUVENCE will conclude the request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request.

9. Data Timeliness and Accuracy

EDUVENCE is responsible for ensuring that personal data is accurate and up to date. If there is a change in their data, users must contact EDUVENCE to make an update. Responsibility for data not being up to date belongs to the user.

10. Being Informed of Regulatory Changes

EDUVENCE is aware of the rights and obligations you have under the Law and relevant legislation, in order to ensure the security of your personal data, and takes the necessary administrative and technical measures. This Text will be updated in line with changes made to the legislation, and the updated version will be published on the website.

11. Contact Information

You can use the following contact information for your requests or questions regarding personal data:

Data Controller: EDUVENCE TEKNOLOJİ ANONİM ŞİRKETİ
Email: destek@eduvence.com
Phone: +90 123 456 7890
Address: YEŞİLKÖY MAH. HAVAALANI CAD. DIŞ HATLAR SİTESİ NO: 2/5 İÇ KAPI NO: 3 BAKIRKÖY / İSTANBUL
Registered Electronic Mail (KEP) address: —

This text has been prepared by EDUVENCE for the purpose of providing general information about its personal data processing activities. The text may be updated in line with legal changes and users will always have access to the current version.