POLICY ON PROCESSING AND PROTECTION OF PERSONAL DATA

PURPOSE Hasan Faydasıçok Education Foundation (“Foundation” or “Faydasıçok Foundation”), located at 2nd Industrial Street No:10 Tuzla Istanbul, aims to collect and process certain personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and relevant legislation in order to provide our services in the best possible manner. This Policy on Processing and Protection of Personal Data (“Policy”) has been prepared to determine and demonstrate the purposes for which your personal data is processed, to whom they are transferred, your rights regarding your personal data, and the obligations of Faydasıçok Foundation regarding the processing and protection of personal data. SCOPE This Policy covers our activities related to the processing of personal data of the following individuals:

• Representatives, proxies, and shareholders of our company and group companies,
• Employees, representatives, and proxies of our business partners,
• Employees, representatives, and proxies of our suppliers,
• Our customers and potential customers,
• Employees of public/private institutions and organizations,
• Bursiyerler ve bursiyer adaylarımız
• Scholarship recipients and scholarship applicants
• Family members of our scholarship recipients and applicants,
• Our donors, volunteers,
• Legally authorized individuals,
• Our visitors,
• Other third parties.

Faydasıçok Foundation Employees:  They are responsible for complying with this policy and relevant laws in all business activities. Suppliers: They are responsible for complying with this policy and relevant laws in all services provided to Faydasıçok Foundation. Faydasıçok Foundation Top Management:  They are responsible for ensuring that Faydasıçok Foundation’s business activities are conducted in compliance with this policy. DEFINITIONS AND ABBREVIATIONS   The definitions used in this Policy will be used in the following meanings:

Personal Data	Any information relating to an identified or identifiable natural person.
Special Categories of Personal Data	Data related to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data.
Data Subject	Natural persons whose personal data are processed by Faydasıçok Foundation.
Processing of Personal Data	Any operation performed on personal data, whether fully or partially automated or not, including collection, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, takeover, making available, classification, or use that is performed on data.
Explicit Consent	Consent based on informed decision and freely given with regard to a specific subject matter.
Anonymization	Rendering personal data unattributable to an identified or identifiable natural person in any way, even by matching it with other data.
KVKK	Law on the Protection of Personal Data No. 6698 published in the Official Gazette dated 7 April 2016 and numbered 29677, dated 24 March 2016.
KVK Board	Personal Data Protection Board
KVKInstitution	Personal Data Protection Board
Policy	Hasan Faydasıçok Education Foundation Policy on Processing and Protection of Personal Data.
Data Controller	The person who determines the purposes and means of processing personal data and is responsible for the systematic management of the place where the data is kept.
Data Processor	Natural or legal person who processes personal data on behalf of the data controller based on the authorization given by them.

PERSONAL DATA WE PROCESS As the Data Controller, we process some of your personal data, including but not limited to:

1- Identity Information	ID number, Passport number, name-surname, signature, photograph, place of birth, date of birth, age, identity card serial number, photocopies of driver’s licenses.
2- Contact Information	Individuals’ email, telephone number, mobile phone, social media accounts.
3- Location Information	Home and business addresses, residence information.
5- Legal Transaction Information	Information in correspondences with judicial authorities, information in lawsuit files (execution information).
6- Physical Space Security Information	Visitor entry and exit records, camera recordings.
7- Financial Information	Bank account information, IBAN information.
8- Professional Experience Information	Past education and occupation information, diploma information, attended courses, membership information in NGOs and university clubs.
9- Visual and Auditory Records	Camera footage obtained.
10- Association Membership	Information about association membership of scholarship recipients and scholarship applicants.
11- Foundation Membership	Information about foundation membership of scholarship recipients and scholarship applicants.
12- Health Information	Blood type information, information specified in health reports, disability status information, information about devices and prostheses used.
13- Criminal Conviction and Security Measures	Criminal record, information on criminal conviction or security measure.
14- Family Member Information	Name, surname, address, telephone number, education information, occupation information, income information, property information, health information of family members.
15- Hobbies and Interests	Information about individuals’ hobbies and interests.

OUR METHODS OF COLLECTING PERSONAL DATA We collect your personal data through the following channels:

• Email, Telephone,
• Business cards,
• CCTV (Closed-Circuit Television Recordings),
• Physical forms,
• Our website,
• Mail, courier, or courier services,
• Face-to-face meetings,
• Other physical and electronic environments.
• Scholarship platforms.

OUR PURPOSES OF PROCESSING PERSONAL DATA As Faydasıçok Foundation, we attach great importance to the confidentiality of the personal data we process and collect and process your personal data in accordance with the general principles and processing conditions specified in the KVKK. In this context, we will process your personal data limited to the following purposes:

• Execution of Emergency Management Processes: Such as ensuring communication between units and institutions in case of emergencies;
• Conducting Educational Activities: Such as determining the suitability of scholarship recipients and scholarship applicants for relevant educational programs;
• Conducting Activities in Compliance with Legislation: Such as compliance with legal regulations such as the Law on Foundations No. 5737;
• Conducting Financial and Accounting Affairs: Such as paying expenses, receiving donations;
• Monitoring and Conducting Legal Affairs: Such as enabling individuals and the Foundation to defend themselves in potential lawsuits;
• Conducting Communication Activities: Such as sending emails, making phone calls, sending e-newsletters and announcements related to our Foundation;
• Conducting Business Activities/Audit: Such as understanding the needs, success, and socio-cultural status of scholarship recipients and scholarship applicants;
• Conducting Business Continuity Activities: Such as renewing programs annually;
• Organization and Event Management: Such as conducting speeches and surveys at panels organized in high schools, taking photographs and videos of speakers and participants at these events and sharing them on our social media accounts, promoting engineering professions;
• Conducting Social Responsibility and Civil Society Activities: Such as conducting the process of granting scholarships to candidates who meet the necessary conditions, conducting mentor-mentee programs, supporting scholarship recipients in finding mandatory internship places and finding workplaces for them when they graduate;
• Providing Information to Authorized Individuals, Institutions, and Organizations: Such as responding to official letters/notifications from official institutions and courts.

LEGAL GROUNDS FOR PROCESSING We process your personal data based on the following legal grounds:

• Obtaining your explicit consent to process your personal data in accordance with Article 5/1 of the KVKK. For example, such as taking photographs of you at events and sharing them on our social media accounts;
• As explicitly stipulated in the law under Article 5/2(a): For example, processing activities stipulated in the Law on Foundations No . 5737;
• Necessity of your personal data for the establishment or performance of a contract under Article 5/2(c): For example, processing contact information of supplier employees to receive services from our suppliers;
• Necessity of fulfilling the legal obligations of Faydasıçok Foundation under Article 5/2(c): For example, complying with obligations stipulated in the Law on Foundations No. 5737 and relevant legislation;
• Necessity for establishing, using, or protecting the rights of Faydasıçok Foundation under Article 5/2(e). For example, retaining personal data for the statute of limitations period in case of a potential dispute or lawsuit to defend the Foundation’s rights;
• Necessity for the legitimate interests of Faydasıçok Foundation under Article 5/2(f), provided that it does not harm your fundamental rights and freedoms. For example, processing personal data for the purpose of informing and reporting;
• Obtaining your explicit consent to process special categories of personal data under Article 6/2 of the KVKK. For example, obtaining information about association memberships, criminal records, and health status of scholarship applicants for the interview and evaluation process.

TRANSFER OF PERSONAL DATA In accordance with the processing conditions specified in Articles 8 and 9 of the KVKK, we may transfer your personal data to the following parties for the purposes specified in Section 7: our foundation managers and employees, our business partners, our suppliers, Faydasıçok Holding group companies, authorized public institutions and organizations, legally authorized individuals, and our social media accounts (Instagram, Youtube, LinkedIn, etc.). Faydasıçok Foundation may share your personal data with third parties abroad under the following conditions:

• If you provide explicit consent for the transfer activity,
• If there is sufficient protection in the country to which personal data will be transferred, or
• If there is not sufficient protection in the country, with the condition that the party to whom the personal data will be transferred provides sufficient protection in writing along with the approval of the Personal Data Protection Board.

ENSURING THE SECURITY OF PERSONAL DATA As Faydasıçok Foundation, we ensure the security of the personal data we process while providing our services in accordance with the KVKK and relevant legislation. In this context, the Foundation takes appropriate security measures to ensure the legality of the processed personal data, prevent unauthorized access, and ensure their preservation, and harbors the necessary security technologies as required. Faydasıçok Foundation has prepared and implemented a Personal Data Security Policy regarding the technical and administrative measures taken to ensure the security of personal data processed. In addition, as the data controller, we take additional technical and administrative measures to ensure the security of special categories of personal data we process. The Foundation has prepared and implemented a Policy on Processing and Security of Special Categories of Personal Data to determine these measures. Faydasıçok Foundation ensures the security of processed personal data by adhering to the two policies mentioned in this section and following generally accepted best practices. YOUR RIGHTS REGARDING YOUR PERSONAL DATA AND APPLICATION As the Data Subject, you have the following rights regarding your personal data under Article 11 of the KVKK:

• To learn whether your personal data is processed,
• If your personal data is processed, to request information regarding this,
• To learn the purpose of processing your personal data and whether they are used in accordance with this purpose,
• To know the third parties to whom your personal data is transferred, domestically or abroad,
• If your personal data is incomplete or incorrectly processed, to request their correction and to request the notification of this correction to third parties to whom your personal data has been transferred,
• To request the deletion or destruction of your personal data processed in accordance with the Law No. 6698 and other relevant laws, despite being processed in accordance with the law, in case the reasons requiring their processing cease to exist, and to request the notification of this deletion or destruction to third parties to whom your personal data has been transferred,
• To object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• In case you suffer damage due to the unlawful processing of your personal data, to request the compensation of your damages.

You can submit your requests regarding these rights via the Data Subject Application Form on our website. Your request will be fulfilled free of charge. However, if the requested transaction requires an additional cost, the fees specified in the tariff determined by the Personal Data Protection Board will be requested from the applicant. Your requests will be answered in writing or electronically as soon as possible and no later than thirty days, depending on the nature of the request. If your request is rejected, your application will be answered with a justification.