Introduction
Protection of Personal Data
The protection of personal data is among the top priorities of ÖZEL ISPARTAKULE SUN ANAOKULU [FULYA KOÇALİ] (the “School”), which exercises the utmost care to act in compliance with all legislation in force on this matter.
This Personal Data Protection and Processing Policy (the “Policy”) explains the principles adopted in the conduct of personal data processing activities carried out by the School and the fundamental principles adopted for the compliance of our School’s data processing activities with the rules set out in Law No. 6698 on the Protection of Personal Data (the “Law”); in this way, the School informs data subjects and ensures the necessary transparency. Fully conscious of our responsibility in this regard, your personal data is processed and protected within the scope of this Policy.
Purpose of the Policy
This Policy concerns all personal data of the School’s employees, visitors, parents, students and students’ relatives processed by fully or partially automated means, or by non-automated means provided that it forms part of a data recording system.
Application of the Policy and the Applicable Legislation
The applicable statutory provisions in force regarding the processing and protection of personal data take precedence. In the event of an inconsistency between the legislation in force and this Policy, the School accepts that the legislation in force shall apply. The Policy sets out the rules established by the applicable legislation by rendering them concrete within the scope of School practices.
Entry into Force of the Policy
This Policy is published on the School’s website and is made available to the relevant persons upon the request of data subjects.
Matters Regarding the Protection of Personal Data
Ensuring the Security of Personal Data
In accordance with Article 12 of the Law, the School takes the necessary measures — appropriate to the nature of the data to be protected — to prevent the unlawful disclosure, access, transfer of personal data or other security deficiencies that may otherwise arise. In this context, the School takes the technical and administrative measures needed to ensure the required level of security in accordance with the guidelines published by the Personal Data Protection Board (the “Board”), and carries out or commissions the necessary audits.
Protection of Special Categories of Personal Data
The Law attaches special importance to certain personal data due to the risk of causing victimization or discrimination when processed unlawfully. These data are: data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. The School acts with sensitivity in protecting special categories of personal data determined as “special” by the Law and processed lawfully. In this context, the technical and administrative measures taken by the School for the protection of personal data are applied with particular care with respect to special categories of personal data, and the necessary audits are ensured within the School. Detailed information on the processing of special categories of personal data is provided in Section 3.3 (“Processing of Special Categories of Personal Data”) of this Policy.
Raising the Awareness of Business Units on the Protection and Processing of Personal Data, and Auditing
The School ensures that the necessary training is provided to business units in order to raise awareness aimed at preventing the unlawful processing of personal data and unlawful access to personal data, and at ensuring the safekeeping of personal data. The systems necessary to build awareness of personal data protection among School employees are established, and consultants are engaged where needed. In this regard, the School evaluates participation in the relevant trainings, seminars and information sessions, and updates and renews its trainings in parallel with updates to the applicable legislation.
Matters Regarding the Processing of Personal Data
Processing of Personal Data in Accordance with the Principles Set Out in the Legislation
Processing in Compliance with the Law and the Principle of Good Faith
The School acts in accordance with the principles introduced by legal regulations and the general principles of trust and good faith when processing personal data. Within this framework, personal data is processed to the extent required by, and limited to, the School’s educational activities.
Ensuring That Personal Data Is Accurate and Up to Date Where Necessary
The School takes the necessary measures to ensure that personal data is accurate and up to date throughout the period during which it is processed, and establishes the mechanisms required to ensure the accuracy and currency of personal data at set intervals.
Processing for Specific, Explicit and Legitimate Purposes
The School clearly sets out the purposes for which personal data is processed and processes it within the scope of purposes connected with its educational activities.
Being Relevant, Limited and Proportionate to the Purposes of Processing
The School collects personal data only of the nature and to the extent required by its educational activities, and processes it limited to the determined purposes.
Retention for the Period Prescribed by the Applicable Legislation or Required by the Purpose of Processing
The School retains personal data for the period required by the purpose of processing and for the minimum period prescribed by the legal legislation to which the relevant activity is subject. At the end of the determined retention periods, personal data is disposed of in line with the periodic disposal schedule or upon the data subject’s application, using the determined disposal methods (deletion and/or destruction and/or anonymization).
Conditions for the Processing of Personal Data
Apart from the data subject’s explicit consent, the basis of a personal data processing activity may be only one of the conditions set out below, or more than one condition may form the basis of the same personal data processing activity.
The Data Subject’s Explicit Consent
One of the conditions for processing personal data is the explicit consent of the data subject. The data subject’s explicit consent must be given in relation to a specific matter, based on information, and expressed of free will. However, where expressly provided for by law, the data subject’s personal data may be processed without such consent.
Inability to Obtain the Data Subject’s Explicit Consent Due to Actual Impossibility
The data subject’s personal data may be processed where it is necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility, or whose consent cannot be recognized as valid, or of another person.
Direct Relevance to the Conclusion or Performance of a Contract
This condition may be deemed satisfied where the processing of personal data is necessary, provided that it is directly related to the conclusion or performance of a contract to which the data subject is a party (such as an education contract).
Fulfilment of the School’s Legal Obligations
The data subject’s personal data may be processed where processing is necessary for the School to fulfil its legal obligations.
The Data Subject Having Made Their Personal Data Public
Where the data subject has made their personal data public, the relevant personal data may be processed limited to the purpose of such disclosure.
Necessity of Data Processing for the Establishment or Protection of a Right
The data subject’s personal data may be processed where data processing is necessary for the establishment, exercise or protection of a right.
Necessity of Data Processing for the School’s Legitimate Interest
The data subject’s personal data may be processed where data processing is necessary for the legitimate interests of the School, provided that it does not harm the fundamental rights and freedoms of the data subject.
Processing of Special Categories of Personal Data
Special categories of personal data are processed by the School in accordance with the principles set out in this Policy, by taking all necessary administrative and technical measures — including the methods to be determined by the Board — and where the following conditions exist:
- Special categories of personal data other than health and sexual life may be processed without seeking the data subject’s explicit consent where expressly provided for by law. Otherwise, the data subject’s explicit consent will be obtained for the processing of such special categories of personal data.
- Special categories of personal data relating to health and sexual life may be processed without seeking explicit consent only by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing. Otherwise, the data subject’s explicit consent will be obtained for the processing of such special categories of personal data.
Informing the Data Subject
The School informs data subjects in accordance with Article 10 of the Law and secondary legislation. In this context, the School informs the relevant persons about who processes their personal data as data controller, for what purposes it is processed, with whom and for what purposes it is shared, by what methods it is collected and its legal basis, and the rights the data subjects have with respect to the processing of their personal data.
Transfer of Personal Data
The School may transfer the data subject’s personal data and special categories of personal data to third parties (third-party companies, official and private authorities, third-party natural persons) in line with lawful personal data processing purposes, taking the necessary security measures. In doing so, the School acts in accordance with the rules set out in Article 8 of the Law.
Conditions for the Transfer of Personal Data
Even without the data subject’s explicit consent, personal data may be transferred to third parties by the School — exercising due care and taking all necessary security measures, including the methods prescribed by the Board — where one or more of the following conditions exist:
- The activities related to the transfer of personal data are expressly provided for by law,
- The transfer of personal data by the School is directly related to and necessary for the conclusion or performance of a contract,
- The transfer of personal data is necessary for the School to fulfil its legal obligations,
- The personal data has been made public by the data subject, and is transferred by the School limited to the purpose of such disclosure,
- The transfer of personal data by the School is necessary for the establishment, exercise or protection of the rights of the School, the data subject or third parties,
- Carrying out personal data transfer activities is necessary for the School’s legitimate interests, provided that it does not harm the data subject’s fundamental rights and freedoms,
- It is necessary for the protection of the life or physical integrity of a person who is unable to give consent due to actual impossibility, or whose consent is not legally valid, or of another person.
Transfer of Special Categories of Personal Data
Special categories of personal data may be transferred by the School in accordance with the principles set out in this Policy, by taking all necessary administrative and technical measures — including the methods to be determined by the Board — and where the following conditions exist:
- Special categories of personal data other than health and sexual life may be processed without seeking the data subject’s explicit consent where expressly provided for by law. Otherwise, the data subject’s explicit consent will be obtained.
- Special categories of personal data relating to health and sexual life may be processed without seeking explicit consent only by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing. Otherwise, the data subject’s explicit consent will be obtained.
Categorization of Personal Data Processed by the School and Purposes of Processing
Within the School, personal data is processed — with the relevant persons informed pursuant to Article 10 of the Law and secondary legislation — in line with the School’s personal data processing purposes, based on and limited to at least one of the personal data processing conditions set out in Articles 5 and 6 of the Law.
Annex-1: Personal Data Categories and Processing Purposes
| Purposes | Details |
|---|---|
| Conduct of the Human Resources Policy | • Creation of personnel files • Use in intern/employee recruitment and placement processes • Keeping of information within the scope of employee requests, satisfaction and the right to complain |
| Requirements of Educational Activities | • Planning, management and delivery of educational services • Monitoring students’ development and achievements • Provision of student guidance and counseling services • Evaluation of educational quality |
| Health and Safety Management | • Keeping students’ health records • Storing health information for emergencies • School health and hygiene practices • Vaccination and illness tracking |
| Requirements of Audit Activities | • Planning and performance of audit activities • Conduct of activities in compliance with legislation • Monitoring the accuracy and currency of data |
| Ensuring the Legal, Technical and Commercial-Operational Security of the School and Related Persons | • Follow-up of legal, accounting and human resources affairs • Security of School employees, students and the school campus • Informing authorized organizations • Occupational safety and crisis management |
Retention and Disposal of Personal Data
The School retains personal data for the period required by the purpose of processing and in accordance with the minimum periods prescribed by the legal legislation to which the relevant activity is subject. At the end of the determined retention periods, personal data is disposed of in line with the periodic disposal schedule or upon the data subject’s application, using the determined disposal methods (deletion and/or destruction and/or anonymization). You can find detailed information on this subject by reviewing the “Personal Data Retention and Disposal Policy” available on our website.
Retention of Personal Data Processed by the School and Retention Periods
In accordance with its information obligation under Article 10 of the PDP Law, the School informs data subjects of which personal data of which data subject groups it processes, the purposes of processing the data subject’s personal data, and the retention periods.
Where prescribed by the relevant laws and legislation, the School retains personal data for the period specified in that legislation. If no period is prescribed in the legislation regarding how long personal data must be retained, the personal data is processed for the period required by School practices and the customs of the education sector in connection with the activity conducted when processing that data, and is subsequently deleted, destroyed or anonymized.
If the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and the School have expired, the personal data may be retained only to serve as evidence in potential legal disputes, or to assert the relevant right connected to the personal data, or to establish a defense.
Rights of Data Subjects and the Exercise of These Rights
Rights of the Data Subject
Data subjects have the following rights:
- To learn whether personal data is being processed
- To request information if their personal data has been processed
- To learn the purpose of processing of personal data and whether it is used in accordance with that purpose
- To know the third parties to whom personal data is transferred, whether domestically or abroad
- To request the correction of personal data if processed incompletely or inaccurately, and to request that the action taken in this context be notified to the third parties to whom the personal data has been transferred
- To request the deletion or destruction of personal data if the reasons requiring processing cease to exist, even though it has been processed in accordance with the Law and other applicable legal provisions, and to request that the action taken in this context be notified to the third parties to whom the personal data has been transferred
- To object to the occurrence of a result to the person’s own detriment arising from the analysis of the processed data exclusively through automated systems
- To request compensation for damages incurred due to the unlawful processing of personal data
Exercise of the Data Subject’s Rights
Data subjects may submit their requests regarding the rights listed in Section 7.1 to our School by the methods determined by the Board.
To exercise these rights, data subjects/relevant persons may fill in the “Data Subject Application Form” available on our website and deliver it to our School by the methods specified in that form.
Responding to Applications
The School takes the necessary administrative and technical measures to conclude applications made by data subjects in accordance with the Law and secondary legislation. Where the data subject duly submits a request regarding the rights listed in Section 7.1 to the School, the School will conclude the request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process additionally requires a cost, a fee may be charged according to the tariff determined by the Board.
Cases in Which the Data Subject Cannot Assert Their Rights
Since the following cases are excluded from the scope of the PDP Law pursuant to Article 28 of the PDP Law, data subjects cannot assert the rights listed in Section 7.1 in these matters:
- Processing of personal data for purposes such as research, planning and statistics, by being anonymized through official statistics.
- Processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute a crime.
- Processing of personal data within the scope of preventive and protective activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.
- Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings.
Special Situations in Which Personal Data Is Processed
Personal Data Processing Activities at Building and Facility Entrances and Inside the Facilities, and the Website
In order to ensure security and control service quality, the School carries out personal data processing activities consisting of security camera monitoring in its buildings and facilities and the tracking of visitor entries and exits.
Camera Monitoring Activities at Building and Facility Entrances and Inside the Facilities
The School carries out camera monitoring activities in its buildings and facilities to ensure security and control service quality, in accordance with the Law on Private Security Services, the Regulation on Preschool Education Institutions and the applicable legislation. To ensure security in School buildings and facilities, the School conducts security camera monitoring for the purposes prescribed in the applicable legislation in force and in accordance with the personal data processing conditions listed in the Law.
The purpose of the School’s video camera monitoring activity is limited to the purposes set out in this Policy. The monitoring areas, number of security cameras and monitoring times are implemented in a manner sufficient for and limited to achieving the security purpose. Areas where monitoring could result in an intrusion into a person’s privacy beyond security purposes (for example, toilets) are not subject to monitoring. Only a limited number of School employees have access to live camera images and to the recordings stored digitally.
Tracking of Visitor Entries and Exits at Building and Facility Entrances and Inside the Facilities
The School carries out personal data processing activities to track visitor entries and exits in its buildings and facilities, for the purpose of ensuring security and the purposes set out in this Policy. Data subjects are informed in this context when the names and surnames of persons arriving at School buildings as visitors are obtained, or through texts posted at the School or otherwise made available to visitors.
Relationship of the Personal Data Protection and Processing Policy with Other Policies
The School creates internal sub-policies on the protection and processing of personal data related to the principles set out in this Policy. The principles of internal policies are reflected — to the extent relevant — in publicly available policies, with the aim of informing the relevant persons within this framework and ensuring transparency and accountability regarding the personal data processing activities conducted by the School. In accordance with Articles 8 and 9 of the PDP Law, the School may share personal data — limited to its purpose — with the institutions listed in Annex-5, pursuant to this policy and where necessary.
Compliance with this data protection and processing policy and the applicable legislation is regularly checked by authorized persons working in the relevant units of the School. The Personal Data Protection Board may itself audit the School’s compliance with the provisions of this policy within the framework of the law.
Annex-1: Definitions
| Term | Definition |
|---|---|
| Explicit consent | Consent relating to a specific matter, based on information and expressed of free will. |
| Anonymization | The anonymization of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even when matched with other data. |
| Employee Candidate | Natural persons who have applied for a job with the School through any means, or who have made their CV and related information available for the School’s review. |
| Processing of personal data | Any operation performed on personal data, such as obtaining, recording, storing, retaining or altering it, by fully or partially automated means or by non-automated means provided that it forms part of a data recording system. |
| Personal data | Any information relating to an identified or identifiable natural person. (Name-surname, Turkish ID number, email, address, date of birth, etc.) |
| Special categories of personal data | Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. |
| School Official | Members of the School’s board of management and other authorized natural persons. |
Annex-2: Purposes of Processing Personal Data
| Purposes | Details |
|---|---|
| Conduct of the Human Resources Policy | Creation of personnel files; use in intern/employee recruitment and placement processes; keeping of information within the scope of employee requests, satisfaction and the right to complain |
| Requirements of Educational Activities | Planning, management and delivery of educational services; monitoring students’ development and achievements; provision of student guidance and counseling services; evaluation of educational quality; communication with parents and students; performance of planning and management activities |
| Requirements of Audit Activities | Planning and performance of audit activities; conduct of activities in compliance with legislation; monitoring the accuracy and currency of data; quality control and evaluation operations |
| Ensuring the Legal, Technical and Operational Security of the School and of Related Persons in a Business Relationship with the School | Follow-up of legal, accounting and human resources affairs; security of School employees, students and parents; security of the school campus; informing authorized organizations; crisis management and emergency protocols; occupational health and safety practices |
| Health and Safety Management | Keeping students’ health records; storing health information for emergencies; school health and hygiene practices; vaccination and illness tracking; tracking of allergies and special conditions |
Annex-3: Data Subjects
| Data Subject Groups | Details |
|---|---|
| Student | Natural persons enrolled at and receiving education from the School (children under 18). |
| Parent / Legal Representative | The mothers, fathers and legal representatives of students enrolled at the School. |
| Visitor | Natural persons who have entered the physical premises owned by the School for various purposes or who visit our websites. |
| Employee Candidate | Natural persons who have applied for a job with the School through any means, or who have made their CV and related information available for the School’s review. |
| Supplier | Natural persons who are employees, officials or shareholders of parties providing services to the School on a contractual basis, in line with the School’s orders and instructions, while the School conducts its educational activities. |
| Employees of Partner Institutions | Natural persons, including shareholders and officials, working at institutions with which the School has any kind of business relationship (such as business partners and suppliers). |
Annex-4: Personal Data Classes
| Personal Data Classification | Details |
|---|---|
| Identity | Data containing information about the person; name-surname, Turkish ID number, nationality, place of birth, date of birth, gender and similar information. |
| Contact | Telephone number, address, email address, fax number and similar information. |
| Health Information | Vaccination status, allergies, chronic illnesses, medication use, dietary restrictions, medical treatment records and similar information. |
| Education Information | Class notes, performance reports, student files, development records and similar information. |
| Physical Premises Information — Audio-Visual Information | Records taken at entry to physical premises, camera recordings, vehicle information records, records taken at the security point and similar photographs and camera recordings. |
| Financial Information | Account information and payment information belonging to parents and supplier companies, and similar data. |
| Special Categories of Personal Data | Data relating to persons’ health, sexual life and criminal convictions, as well as biometric data. |
Annex-5: Institutions to Which Data Is Transferred
| Institution Receiving Data | Purpose |
|---|---|
| Business Partner | To carry out educational activities. |
| Supplier | Companies whose support is obtained in the procurement of products/goods/services for the performance of educational activities. |
| Legally Authorized Public Institutions and Organizations | Sharing within the scope of legal processes (Ministry of National Education, Social Security Institution, etc.). |
| Legally Authorized Private-Law Persons | Persons supporting the School, where the School has an interest in the sharing. |
| Health Institutions | Storage of students’ health information and information sharing in emergency medical interventions. |