Privacy Notice

Dear Sir/Madam, As CY Education Construction Industry and Trade Limited Company – Private Oran Nursery and Daycare Center (the “Institution”), we attach great importance to ensuring the security of your personal data. Your personal data is processed, stored, and protected by the Institution in accordance with the fundamental principles and conditions for the processing of personal data as set out in the Turkish Personal Data Protection Law No. 6698 (the “Law 6698”). To this end, as an Institution that takes all necessary measures and exercises the utmost care for data protection, we would like to inform you regarding the processing of your personal data. In this regard, this Notice has been prepared for the personal data of the Institution’s visitors, shareholders, authorized personnel, employees, job candidates, institutions with whom we have business and/or service relationships, employees, shareholders, and authorized representatives of such institutions, visitors, and all other relevant third parties, which will be collected, recorded, stored, processed, retained, used, transferred, or otherwise acquired as outlined in the text.

1. Our Principles for the Processing of Personal Data

Your personal data is processed by us in accordance with the following principles:

• Compliance with the law and honesty,
• Accuracy and, when necessary, keeping it up to date,
• Processing for specific, explicit, and legitimate purposes,
• Being relevant, limited, and proportionate to the purpose for which it is processed,
• Retention for the period required by the relevant legislation or the purpose for which it is processed.

2. Obligation of Disclosure

Article 10 of the Personal Data Protection Law (Law 6698) imposes an obligation on data controllers to inform the data owners while obtaining their consent for the processing of personal data. In this context, The Institution, which has the title of “data controller” informs the within the scope of the relevant article, “data owners”:

• The identity of the data controller and, if applicable, their representative,
• The purposes for which personal data will be processed,
• To whom and for what purpose the processed personal data may be transferred
• The methods and legal grounds for collecting personal data,
• The rights of the data owner under Article 11 of the Law 6698.

This notification is provided through this Notice,  and the relevant information is outlined below.

3. Collection, Method, Purpose, and Legal Grounds for Processing of Personal Data

Our Institution collects personal data primarily through written agreements, emails, physical submission of documents, camera systems, notifications from administrative and judicial authorities, and occasionally through other communication channels, in compliance with the conditions for processing personal data set forth in the Law and the legal grounds stated in this Notice. Your personal data can be collected and processed in fully automated, partially automated, or non-automated methods, subject to your explicit consent or under one of the conditions stipulated in Articles 5 and 6 of the Law, or other relevant legal provisions. The following situations justify such processing:

• Clearly stipulated in laws,
• Necessity for the protection of life or physical integrity of a person who is unable to express consent due to physical impossibility or whose consent is not legally valid,
• Necessary for the performance of a contract with the data owner,
• Necessary for the fulfillment of legal obligations by the data controller,
• The personal data has been made public by the data owner,
• Necessary for the establishment, exercise, or protection of legal rights,
• Necessary for the legitimate interests of the data controller, provided that the data owner’s fundamental rights and freedoms are not harmed.

The following personal data of our students and their parents are processed:

1. Identity (Full Name, Parent’s Name, Date of Birth, Place of Birth, Marital Status, ID Card Serial and Order Number, Turkish ID Number, ID Copy, Driver’s License, Gender, Signature, Citizenship Information)
2. Contact (Address, Email Address, Contact Address, Phone Number, Workplace Address)
3. Legal Actions (Correspondence with Public Authorities)
4. Security (Student and Parent Entry and Exit Records, Camera Recordings)
5. Finance (Income Status, Debt Amount, Bank Account Number)
6. Professional Experience and Education (School Information, Courses Attended, Language Proficiency, Occupation, Exam Results)
7. Health Information (Health Report, Blood Type, Medication Information, Disability Status, Medical History)
8. Other (Absence Status, Evaluation Notes, Reason for Departure)

Purposes for Processing Personal Data include:

1. Conducting educational activities,
2. Ensuring compliance with relevant legislation,
3. Ensuring security of the premises,
4. Conducting communication activities,
5. Managing occupational health and safety activities,
6. Organizing and managing events,
7. Conducting storage and archiving activities,
8. Managing contract processes,
9. Ensuring the security of data controller operations.

Our Institution, in accordance with the Law, takes all necessary measures for the protection and processing of personal data, and operates in compliance with the general principles set forth by the Law and relevant legislation. Our Institution ensures that the personal data is processed in accordance with the Law, maintaining compliance with the rules of law and honesty, adhering to the proportionality principle, ensuring the accuracy and up-to-date nature of the data, and taking all necessary measures. The personal data will only be processed for specific, explicit, and legitimate purposes, and will be limited to what is necessary for those purposes. Personal data will not be processed beyond the original purposes, and will not be expanded for future potential needs. The Institution commits to act in accordance with these principles.

4. To Whom and For What Purposes the Processed Personal Data May Be Transferred

The personal data collected by our Institution may be transferred, in accordance with the procedures and principles established by the applicable legal regulations, within the framework of the services provided and the contracts concluded by our Institution, to the Ministry of National Education, the Social Security Institution (SGK), Ministries, Judicial Authorities, and other authorized public and private institutions, as well as to real or legal persons with whom we have contractual relationships, suppliers, service providers from whom we receive services for educational and communication purposes, our legal, financial, or other consultants, and the authorized representatives of our institution, as well as to other third parties with your explicit consent. We only share your personal data with the persons and parties related to the services within the scope of the contract signed with our Institution. Your personal data may be transferred, both domestically and internationally, with your explicit consent and/or in cases where one or more of the conditions set out in Articles 8 and 9 of the Law 6698 exist, even without seeking explicit consent. For the purposes mentioned above, your personal data may be transferred to persons/entities that are legally permitted and/or required, our affiliates, and/or our direct or indirect domestic/international subsidiaries and third parties with whom we have entered into contractual relationships for the purpose of performing activities, cooperating, and ensuring data security measures, including the preservation of personal data, prevention of unauthorized access, and prevention of unlawful processing.

5. Deletion, Destruction, and Anonymization of Personal Data

In accordance with Articles 1 and 2 of the Law 6698, personal data collected by our Institution and/or representatives authorized by our Institution shall be retained for the period required by the relevant regulations, unless there is a legal obligation to retain the data for a longer period. This period is determined in compliance with the Turkish Penal Code, Article 138, and Article 7 of the Law 6698. In the event that the purpose for processing personal data no longer exists, the data will be deleted, destroyed, or anonymized, either ex officio or upon the request of the data owner.

6. Rights of the Data Owner under Article 11 of the Law 6698

As a data owner, you have the right to submit requests regarding your rights as specified in this Disclosure Text and/or under the Law 6698 and/or other specified methods. Our Institution will respond to your request within thirty days at the latest, free of charge, depending on the nature of the request. However, if a fee is set by the Personal Data Protection Authority, the fee specified by our Institution will be charged. In this context, data owners have the following rights:

• Learn whether personal data is being processed,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether it is being used in accordance with its purpose,
• Learn about third parties to whom personal data is transferred, domestically or internationally,
• Request the correction of personal data if it is incomplete or inaccurate and request that this correction be communicated to third parties to whom the data has been transferred,
• Request the deletion or destruction of personal data when the reasons for processing the data no longer exist, in accordance with the Law 6698 and other relevant legal provisions, and request that this action be communicated to third parties to whom the data has been transferred,
• Object to the processing of personal data, if processed solely through automated systems, that leads to a decision that significantly affects the person,
• Request compensation for damages arising from unlawful processing of personal data.

To exercise the above rights, you may submit your request, including the necessary identification information and the relevant explanation regarding the right you wish to exercise as stated in Article 11 of the Law 6698, by filling out the form on https://www.oranmontessori.com, submitting a signed copy of the form with identification documents to our address: İlkbahar, 616. Sk. No:5, 06190 Çankaya/Ankara, by hand, via notary, or by other methods specified in the Law 6698, or by sending the form via your registered e-mail address with a secure electronic signature or mobile signature to the e-mail address …………………………… or, if applicable, to the email address previously registered in our system.