EDUSAMA YAZILIM EGITIM HIZMETLERI SANAYI VE TICARET LTD STI PERSONAL DATA PROTECTION AND PROCESSING POLICY

Edusama Yazilim Egitim Hizmetleri Sanayi Ve Ticaret Ltd Sti
Personal Data Protection and Processing Policy Information Form

Document Title: Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI Personal Data Protection and Processing Policy

Target Audience: All natural persons whose personal data are processed by Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI, excluding employees of Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI

Prepared By: Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI Personal Data Protection Committee

Version: 1.0

Approved By: Approved by Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI

Effective Date: 20/06/2022

In the event of any inconsistency between the Turkish version of the Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI Personal Data Protection and Processing Policy and any version translated into a foreign language, the Turkish text shall prevail.

 © Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI., 2022

This document may not be reproduced or distributed without the prior written consent of Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI.

Edusama Yazilim Egitim Hizmetleri Sanayi ve Ticaret LTD STI Personal Data Protection and Processing Policy

1. INTRODUCTION

Edusama Yazılım Eğitim Hizmetleri Sanayi ve Ticaret LTD ŞTİ (“Edusama”) attaches great importance to the protection of personal data and considers it among its top priorities.
The Personal Data Protection and Processing Policy of Edusama Yazılım Eğitim Hizmetleri Sanayi ve Ticaret LTD ŞTİ (“Policy”) explains the fundamental principles adopted by Edusama to ensure compliance with the personal data processing principles regulated under the Personal Data Protection Law No. 6698 (“Law”).
In line with these principles, Edusama ensures the necessary transparency by informing personal data subjects. Personal data are processed and protected with the highest level of responsibility and awareness of Edusama, in accordance with the procedures and principles set forth in this Policy.

1.1. Purpose

The purpose of this Policy is to ensure that Edusama is aligned with the Law and that the Policy is effectively implemented in its operations.
In line with “ANNEX 1 – Purposes of Personal Data Processing” below, all necessary administrative and technical measures regarding the processing and protection of personal data shall be taken by Edusama, required internal procedures shall be established, and all necessary training activities shall be conducted to raise awareness.
All necessary measures shall be taken to ensure the compliance of shareholders, authorized persons, employees, and business partners with the processes stipulated under the Law, and appropriate and effective audit mechanisms shall be established.

1.2. Scope

This Policy covers all personal data of individuals other than Edusama employees, which are processed either by fully automated means or by non-automated means provided that they form part of any data recording system.
Information regarding personal data subjects is listed in “ANNEX 2 – Personal Data Subjects”, which is attached to this Policy.

The protection of personal data of Edusama employees is carried out under the Edusama Yazılım Eğitim Hizmetleri Sanayi ve Ticaret LTD ŞTİ Employee Personal Data Protection and Processing Policy, which has been prepared in accordance with the principles set forth in this Policy.

1.3. Legal Basis

This Policy shall be applied together with the applicable legislation currently in force regarding the processing and protection of personal data.
In the event of any inconsistency between the applicable legislation and this Policy, the provisions of the applicable legislation shall prevail.
The regulations prescribed by the relevant legislation are reflected in this Policy and incorporated into Edusama’s practices.

1.4. Terms and Definitions

Relevant User
• Except for the person or unit responsible for the technical storage, protection, and backup of data, individuals who process personal data within the data controller’s organization or in accordance with the authority and instructions received from the data controller.

Disposal
• The deletion, destruction, or anonymization of personal data.

Recording Medium
• Any environment in which personal data processed wholly or partially by automated means or by non-automated means provided that it forms part of any data recording system is stored.

Personal Data
• Any information relating to an identified or identifiable natural person.

Processing of Personal Data

• Any operation performed on personal data such as obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, whether wholly or partially by automated means or by non-automated means provided that it forms part of a data recording system.

Anonymization of Personal Data

• Rendering personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data.

Deletion of Personal Data

• The process of rendering personal data inaccessible and unusable for Relevant Users in any manner.

Destruction of Personal Data

• The process of rendering personal data completely inaccessible, irretrievable, and unusable by anyone under any circumstances.

Board

• Personal Data Protection Board.

Special Categories of Personal Data

• Personal data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Periodic Disposal

• The deletion, destruction, or anonymization of personal data carried out ex officio at recurring intervals as specified in the personal data retention and disposal policy, in cases where the conditions for processing personal data stipulated in the Law have completely ceased to exist.

Data Subject / Relevant Person

• A natural person whose personal data is processed.

Data Controller

• A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

2. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

2.1. Ensuring the Security of Personal Data

Edusama takes the necessary measures stipulated under Article 12 of the Law, in accordance with the nature of the data, in order to prevent unlawful disclosure, access, transfer, or any other security breaches that may occur with respect to personal data.
In line with the guidelines published by the Personal Data Protection Board, Edusama implements appropriate safeguards and carries out audits to ensure the required level of personal data security.

2.2. Protection of Special Categories of Personal Data

The measures taken to protect special categories of personal data, including data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data, are implemented with due diligence and are subject to necessary audits.

Detailed information regarding the processing of special categories of personal data is provided under Article 3.3 of this Policy.

2.3. Raising Awareness on the Protection and Processing of Personal Data

Edusama provides the necessary training to relevant persons in order to raise awareness regarding the lawful processing of personal data, access to such data, data retention, and the exercise of data subject rights.

To enhance employees’ awareness of personal data protection, Edusama establishes the required business processes and, where necessary, seeks support from external consultants. Any deficiencies encountered in practice and the outcomes of training programs are evaluated by Edusama’s management. Based on these evaluations and any changes in applicable legislation, additional training programs may be organized when deemed necessary.

3. 
   PROCESSING OF PERSONAL DATA

3.1. Processing of Personal Data in Compliance with Legislation

Personal data are processed in compliance with the applicable legislation in accordance with the principles set out below.

1. Processing in Accordance with the Law and the Principle of Good Faith

Edusama processes personal data to the extent required by its fields of business activities, limited thereto, in a manner that does not infringe upon individuals’ fundamental rights and freedoms, and in accordance with the principles of good faith and trust.

1. Ensuring That Personal Data Are Accurate and Up to Date

Edusama takes the necessary measures and operates the required systems to ensure that the personal data it processes are accurate and kept up to date.

III. Processing for Specific, Explicit, and Legitimate Purposes

Edusama processes personal data in connection with its business activities solely for specific, explicit, and legitimate purposes that have been determined and disclosed.

1. Being Relevant, Limited, and Proportionate to the Purpose of Processing

Edusama collects and processes personal data in a manner that is relevant to, limited to, and proportionate with the purposes for which they are processed and the requirements of its business activities.

1. Retention for the Period Necessary for the Purpose

Edusama retains personal data for the minimum period stipulated under the relevant legislation or, if no such period is specified, for the period necessary for the purposes for which the personal data are processed.
Upon the expiration of the applicable retention periods, personal data are disposed of in accordance with periodic disposal schedules or data subject requests, using appropriate methods such as deletion, destruction, or anonymization.

3.2. Conditions for Processing Personal Data

3. Except where the data subject has given explicit consent, personal data may be processed based on one or more of the conditions listed below. The processing of special categories of personal data is subject to the conditions set out in Article 3.3 of this Policy (Processing of Special Categories of Personal Data).
4. Explicit Consent of the Data Subject
   Personal data may be processed based on the explicit consent of the data subject. Explicit consent means consent that is informed, specific, and freely given.
   In the presence of any of the conditions listed below, personal data may be processed without obtaining explicit consent from the data subject.
5. Explicitly Stipulated by Law
   Where personal data processing is explicitly stipulated by law, personal data may be processed without obtaining the consent of the data subject.
6. Inability to Obtain Explicit Consent Due to Actual Impossibility
   Where it is not possible to obtain consent due to actual impossibility, and processing is necessary to protect the life or physical integrity of the data subject or another person, personal data may be processed.
7. Directly Related to the Establishment or Performance of a Contract
   Where personal data processing is directly related to the establishment or performance of a contract to which the data subject is a party, personal data may be processed.
8. Fulfillment of Edusama’s Legal Obligations
   Where processing personal data is mandatory for Edusama to fulfill its legal obligations, personal data may be processed.
9. Public Disclosure of Personal Data by the Data Subject
   Where the data subject has made their personal data public, such data may be processed, limited to the purpose of disclosure.
10. Mandatory Processing for the Establishment or Protection of a Right
    Where processing is mandatory for the establishment, exercise, or protection of a right, personal data may be processed.
11. Mandatory Processing for Edusama’s Legitimate Interests
    Provided that it does not harm the fundamental rights and freedoms of the data subject, personal data may be processed where processing is mandatory for Edusama’s legitimate interests.

3.3. Processing of Special Categories of Personal Data

When processing special categories of personal data, Edusama processes such data in accordance with the principles set out in the Law and this Policy, by taking all necessary administrative and technical measures using the methods to be determined by the Board, under the following conditions:

1. Special categories of personal data other than health and sexual life may be processed without obtaining the explicit consent of the data subject where there is an explicit provision in the law permitting such processing. In cases where there is no explicit legal provision, the explicit consent of the data subject shall be obtained.
2. Special categories of personal data relating to health and sexual life may be processed without obtaining the explicit consent of the data subject by persons under the obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing. In other cases, the explicit consent of the data subject shall be obtained.

3.4. Informing the Personal Data Subject

Edusama informs personal data subjects, in accordance with the applicable legislation, about the purposes for which their personal data are processed, the purposes and parties with whom such data are shared, the methods by which personal data are collected, the legal grounds for processing, and the rights of data subjects regarding the processing of their personal data.

3.5. Transfer of Personal Data

In line with its personal data processing purposes, Edusama may transfer personal data and special categories of personal data to third parties (including third-party companies, group companies, and third-party natural persons) in a lawful manner by taking the necessary security measures.
Edusama carries out data transfer operations in accordance with the regulations set forth in Article 8 of the Law, based on the document titled “ANNEX 4 – Third Parties to Whom Personal Data Are Transferred and Purposes of Transfer,” which is attached to this Policy.

1. Transfer of Personal Data

Although the explicit consent of the personal data subject is required for the transfer of personal data, personal data may be transferred to third parties by taking all necessary security measures, including the methods prescribed by the Board, based on one or more of the conditions listed below:

1. Where it is explicitly stipulated by law,
   b. Where it is directly related to and necessary for the establishment or performance of a contract,
   c. Where it is mandatory for Edusama to fulfill its legal obligations,
   d. Where the personal data have been made public by the data subject, limited to the purpose of disclosure,
   e. Where it is mandatory for the establishment, exercise, or protection of the rights of Edusama, the data subject, or third parties,
   f. Where it is mandatory for the legitimate interests of Edusama, provided that it does not harm the fundamental rights and freedoms of the data subject,
   g. Where processing is mandatory to protect the life or physical integrity of the data subject or another person who is unable to express consent due to actual impossibility or whose consent is not legally valid.

Personal data may be transferred to foreign countries that have been declared by the Board as having “Adequate Protection”, provided that at least one of the conditions listed above is met.
In cases where adequate protection is not available, personal data may be transferred, in accordance with the conditions stipulated in the legislation, to foreign countries where the data controllers have provided a written undertaking to ensure adequate protection and where the approval of the Board has been obtained, referred to as “Foreign Countries Where the Data Controller Undertakes Adequate Protection.”

1. Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred by taking all necessary administrative and technical measures, including the methods determined by the Board, in accordance with the principles set out in this Policy, under the following conditions:

1. Special categories of personal data other than health and sexual life may be transferred without obtaining the explicit consent of the data subject where there is an explicit legal provision permitting such processing; otherwise, they may be transferred with the explicit consent of the data subject.
2. Special categories of personal data relating to health and sexual life may be transferred without obtaining explicit consent by persons under the obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing; otherwise, the explicit consent of the data subject shall be obtained.

Personal data may be transferred to countries classified as “Foreign Countries with Adequate Protection” where any of the above conditions are met, or, in the absence of adequate protection, to “Foreign Countries Where the Data Controller Undertakes Adequate Protection,” in accordance with the data transfer conditions stipulated in the applicable legislation.

4. CATEGORIZATION OF PROCESSED PERSONAL DATA AND PURPOSES OF PROCESSING

The purpose of Edusama in processing personal data is to inform the relevant persons in accordance with Article 10 of the Law and other applicable legislation, and to process personal data in a limited manner based on at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law, in compliance primarily with the principles set out in Article 4 of the Law and the general principles stipulated therein.

Edusama processes the personal data of its shareholders and authorized persons in order to fulfill its legal obligations arising from the Turkish Commercial Code, Tax Procedure Law, Labor Law, and other relevant legislation.

Edusama records the personal data of persons conducting activities with Edusama for the purposes of ensuring compliance with the determined rules, enabling the issuance of warning notices in case of breach of obligations, initiating enforcement and legal proceedings, and taking other necessary measures to ensure performance in accordance with contracts. The personal data of branches are obtained through lease agreements, addenda, supplementary contracts, protocols, and email correspondence.

Edusama records the information of suppliers providing goods and/or services in order to verify whether they fulfill their responsibilities and to ensure the orderly conduct of activities. Personal data of suppliers are obtained through emails sent and received as a result of communication established with them, telephone conversations, business cards, and information shared via their websites.

Edusama requests and processes the personal data of its employees and job candidates for the purposes of completing mandatory documents required to be included in personnel files within the scope of the Labor Law and Occupational Health and Safety Law in force, and for the registration of employees with the Social Security Institution. Such personal data are obtained through resumes and job application forms submitted with explicit consent during recruitment and job application stages, resume viewing methods provided by human resources software platforms offering job postings and candidate pool services (such as Kariyer.net and LinkedIn), and responses given with consent to questions asked during interviews. Edusama requests and processes personal data from individuals applying for employment for the purpose of establishing communication for interview processes and determining whether the individual’s qualifications and experience are compatible with the vacant position. These personal data are obtained through resumes voluntarily submitted by applicants, answers provided voluntarily during interviews, or resume viewing methods offered by job posting and candidate pool service platforms (such as Kariyer.net and LinkedIn).

Edusama records the personal data of employees and authorized representatives of its business partners within the scope of the purposes of establishing business partnerships.

Edusama records supplier personal data for the purpose of procuring and supervising the goods and/or services required to carry out its commercial activities. Such personal data are obtained through signed contracts, issued invoices, equipment delivery reports, email correspondence, telephone communications, other communication channels, and business cards.

Edusama processes the information contained in complaint and request forms submitted to it for the purpose of ensuring service quality. Images of individuals registered at Edusama premises are obtained through 24/7 security camera recording systems.

Detailed information regarding the categories of processed personal data is provided in the Policy annex “ANNEX 3 – Personal Data Categories,” and detailed information regarding personal data processing purposes is provided in the Policy annex “ANNEX 1 – Personal Data Processing Purposes.”

5. 
   MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA

In accordance with the conditions stipulated under the Law, Edusama takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of personal data it processes, to prevent unlawful access to such data, and to ensure the preservation of personal data. Within this scope, Edusama conducts or commissions the necessary audits.

In the event that processed personal data is obtained by third parties through unlawful means despite all technical and administrative measures having been taken, Edusama shall notify the relevant authorities as soon as possible.

5.1. Technical Measures

1. Technical measures in line with technological developments are implemented, and such measures are periodically updated and renewed.
2. Access and authorization technical solutions are implemented in accordance with the legal compliance requirements determined on a departmental basis.

III. Access authorizations are restricted, and authorization rights are regularly reviewed.

1. Implemented technical measures are periodically monitored, and technological solutions are developed by reassessing issues that may pose risks.
2. Software and hardware including antivirus systems and firewalls are installed.
3. Personnel knowledgeable in technical matters are employed, and system vulnerabilities are monitored and controlled.

VII. Applications through which personal data are collected are regularly subjected to security scans in order to detect security vulnerabilities, and identified vulnerabilities are remedied.

VIII. Personal data are destroyed in a manner that prevents recovery and leaves no audit trail.

5.2. Administrative Measures

1. Employees are trained on the technical measures to be taken in order to prevent unlawful access to personal data.
2. Employees are provided with training regarding the Law.

III. Within Edusama, access and authorization processes for personal data are designed and implemented in accordance with legal compliance requirements on a departmental basis.

1. Edusama has included provisions in all documents regulating its relationship with its personnel and containing personal data, stating that obligations stipulated by the Law must be complied with for the lawful processing of personal data, that personal data must not be disclosed, that personal data must not be used unlawfully, and that the obligation of confidentiality regarding personal data shall continue even after the termination of the employment contract with Edusama. Failure to comply with these obligations may result in sanctions up to and including termination of the employment contract.
2. Employees are informed that they may not disclose personal data they have learned to third parties in violation of the provisions of the Law, nor use such data outside the purpose of processing, and that this obligation shall continue after the termination of their employment; necessary undertakings are obtained from employees accordingly.
3. Provisions are included in contracts concluded with persons to whom personal data are lawfully transferred by Edusama, requiring such persons to take the necessary security measures for the protection of personal data and to ensure compliance with such measures within their own organizations.

VII. In the event that processed personal data are obtained by third parties through unlawful means, Edusama notifies the relevant data subject and the Board as soon as possible.

VIII. Edusama employs personnel who are knowledgeable and experienced in the processing of personal data and provides its personnel with the necessary training within the scope of personal data protection legislation and data security.

1. Edusama conducts or commissions the necessary audits within its own legal entity to ensure compliance with the provisions of the Law and remedies any confidentiality and security vulnerabilities identified as a result of such audits.
2. Pursuant to Article 12 of the Law, Edusama is responsible for ensuring that third parties to whom personal data are transferred also fulfill their obligations to lawfully process, store, and access personal data in accordance with the Policy and the Law. Accordingly, Edusama shall obtain undertakings in contracts and all related arrangements regarding data transfers to third parties, ensuring compliance with these requirements and granting Edusama the right to conduct audits. Edusama shall also specifically inform all its personnel of the responsibilities arising from the processes of transferring personal data to third parties.
3. 
   RETENTION AND DESTRUCTION OF PERSONAL DATA

Edusama retains personal data for the minimum period required by the relevant legislation or for the period necessary for the purpose of processing. Primarily, if a retention period is stipulated under the applicable legislation, Edusama retains personal data in accordance with such period; if no statutory retention period is prescribed, personal data are retained for the period necessary for the purpose for which they are processed. Upon the expiration of the determined retention periods, personal data are destroyed by the specified methods (deletion, destruction, or anonymization) in accordance with periodic destruction periods or upon the request of the data subject.

7. 
   RIGHTS OF DATA SUBJECTS AND EXERCISE OF SUCH RIGHTS

7.1. Rights of the Data Subject

Data subjects have the following rights:

1. To learn whether personal data are processed,
   II. To request information if personal data have been processed,
   III. To learn the purpose of the processing of personal data and whether they are used in accordance with such purpose,
   IV. To know the third parties to whom personal data are transferred domestically or abroad,
   V. To request the correction of personal data if they are processed incompletely or inaccurately and to request notification of such correction to third parties to whom the personal data have been transferred,
   VI. To request the deletion or destruction of personal data where the reasons requiring their processing no longer exist, even though they have been processed in accordance with the Law and other applicable legislation, and to request notification of such action to third parties to whom the personal data have been transferred,
   VII. To object to the occurrence of a result against the data subject arising from the analysis of processed data exclusively through automated systems,
   VIII. To request compensation for damages in case personal data are processed unlawfully

7.2. Exercise of the Data Subject’s Rights

Data subjects may submit their requests regarding the rights listed in Article 6.1 to Edusama by using the methods determined by the Board. Applications may be submitted to Edusama by completing the “Edusama Yazılım Eğitim Hizmetleri Sanayi ve Ticaret LTD ŞTİ Data Subject Application Form” available at
www.edusama.com/kisisel-verilerin-korunmasi.

7.3. Edusama’s Response to Applications

Edusama shall conclude applications submitted by data subjects in accordance with the Law and other applicable legislation. Requests duly submitted to Edusama shall be finalized as soon as possible and no later than thirty (30) days, free of charge. However, if the processing of the request requires an additional cost, a fee may be charged in accordance with the tariff determined by the Board.

7.4. Rejection of the Data Subject’s Application by Edusama

Edusama may reject the application of the applicant by stating the justification, in the following cases:

1. Where personal data are processed for purposes such as research, planning, or statistics by rendering them anonymous for official statistical purposes,
   II. Where personal data are processed for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, the right to privacy, or personal rights, and does not constitute a crime,
   III. Where personal data are processed within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,
   IV. Where personal data are processed by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial, or execution proceedings,
   V. Where the processing of personal data is necessary for the prevention of a crime or for a criminal investigation,
   VI. Where personal data have been made public by the data subject themselves,
   VII. Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, carried out by authorized public institutions and organizations or professional organizations having the status of public institutions, based on the authority granted by law,
   VIII. Where the processing of personal data is necessary for the protection of the State’s economic and financial interests relating to budgetary, tax, and financial matters,
   IX. Where the request of the data subject may restrict the rights and freedoms of other individuals,
   X. Where the request requires disproportionate effort,
   XI. Where the requested information is publicly available.
2. 
   IMPLEMENTATION

The Board of Directors of Edusama, as the data controller, is responsible for the implementation of the Law and this Policy. Department managers are responsible for monitoring, coordinating, and supervising all procedures and processes within this scope.

9. EFFECTIVE DATE AND PUBLICATION

This Policy entered into force on 20/06/2022. Any amendments to the Policy shall be published on Edusama’s website (www.edusama.com) and made accessible to data subjects and relevant parties. Amendments to the Policy shall take effect as of the date of their publication.

ANNEXES

ANNEX 1 – Purposes of Personal Data Processing

ANNEX 2 – Categories of Data Subjects

ANNEX 3 – Categories of Personal Data

ANNEX 4 – Third Parties to Whom Personal Data Are Transferred and Purposes of Transfer