Law on the Protection of Personal Data

TURKISH MAARIF FOUNDATION PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA FOR THE COMMUNICATION AND NOTIFICATION ACTIVITIES

Dear Sir/Madam,

Pursuant to the Personal Data Protection Law of the Republic of Turkey No. 6698 and the European Union General Data Protection Regulation (GDPR) (“Law”), Turkish Maarif Foundation hereinafter referred to as “MAARIF”) holds the legal status of data controller for the processing of your personal data regarding the communication and notification activities it conducts. The information pertaining to the data controller is as follows:

Data Controller:TURKISH MAARIF FOUNDATION

Address:Altunizade Mahallesi, Ord. Prof. Dr. Fahrettin Kerim Gökay Caddesi, Erdem Sokak, No: 5, Üsküdar / İstanbul

Phone Number:+90 216 323 35 35

E-Mail Address:iletisim@turkiyemaarif.org

This information notice has been prepared by MAARİF in its capacity as the data controller under the Law.

Within the scope of e-newsletter subscription and information processes, your identity, contact, and transaction security data—provided by you—are processed by MAARIF in accordance with the Law, for the purposes of promoting educational events, activities, seminars, and summits intended for parents, participants, or other relevant individuals; carrying out communication activities related to these events; and announcing developments regarding MAARIF. These data are processed for the purposes of conducting communication activities, executing information security processes, carrying out corporate communication and promotional activities, planning and managing organizational processes, monitoring event participation processes, ensuring the security of data controller operations, and providing information to authorized persons, institutions, and organizations.

Within this scope, the personal data you provide may be processed through written, verbal, or electronic means, and by way of automated or non-automated methods, on the basis of the following legal grounds:

– where it is directly related to the establishment or performance of a contract and the processing is necessary for the personal data of the parties to the contract;

– where it is necessary for the data controller to comply with a legal obligation;

– where it is necessary for the establishment, exercise, or protection of a right;

– where it is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject;

– where the data subject has given explicit consent.

Within the scope of communication and notification processes, the personal data you share with MAARIF are transferred — based on the legal basis of your explicit consent — to service providers located abroad that are used in e-newsletter, information, and event announcement delivery processes, for the purposes of conducting communication activities, ensuring data security, system management, and carrying out audit/ethical compliance processes. It should be noted that, within the scope of this international data transfer, there is a risk that the third countries to which your personal data may be transferred might not provide an adequate level of data protection. This situation lies entirely outside of MAARIF’s authority and responsibility.

Within the scope of the process described above, the personal data obtained by MAARIF shall be processed in accordance with the data processing conditions set forth under the applicable data protection legislation and this Privacy Notice, for the purposes specified herein, and may be transferred to the following parties:

a) E-mail and SMS delivery, automation, and reporting service providers,

b) Cloud infrastructure and server service providers,

c) To relevant persons and entities, shareholders, affiliated legal entities (“Maarif Group”), and/or direct or indirect domestic or foreign subsidiaries, as well as the business partners and subcontractors of the Maarif Group, where such transfer is required for the planning and execution of operational, commercial, and corporate strategies;

d) To our business partners, consulting firms, suppliers, private institutions, courts, public authorities, and competent regulatory bodies, where such transfer is necessary for MAARIF to fulfill its legal obligations;

All personal data processing and transfers carried out by MAARIF are conducted in accordance with the Law. Your personal data are retained only for as long as the purposes related to your e-newsletter subscription and information activities remain valid. In the event of subscription cancellation, withdrawal of explicit consent, or the cessation of the data processing purpose, your data will be destroyed during the next six-month periodic destruction cycle.

In accordance with the Law, you have the following rights concerning all personal data you have shared with the Foundation:

a) To learn whether your personal data is being processed,

b) To request information if your personal data has been processed,

c )To learn the purpose of the processing of your personal data and whether it is being used in accordance with its purpose,

d) To know the third parties to whom your personal data is transferred domestically or abroad,

e) To request correction of your personal data if it has been processed incompletely or inaccurately,

f) To request the deletion or destruction of your personal data,

g) To request that third parties to whom your personal data has been transferred be notified of any correction, deletion, or destruction of personal data due to incomplete or incorrect processing,

h) To object to any result arising against you from the analysis of your processed data exclusively through automated systems,

i) To demand compensation if you suffer damage due to the unlawful processing of your personal data.

Should you have any hesitations regarding the processing of your personal data, please apply to the MAARIF, Data Controller, whose address and contact information are shown on our website.

In accordance with the Law, you may submit your request to exercise your rights concerning the protection of your personal data either in writing or by using the email address you previously provided to MAARIF and which is registered in our system.

The necessary explanations, along with the application and information request form, can be accessed through the application link on our website at https://turkiyemaarif.org/policies/law-on-the-protection-of-personal-data. You may also send your application to our e-mail address. In your application submitted within this scope, the following information must be included:

a) Your full name and, if the application is in writing, your signature,

b) Your nationality, passport number, or, if applicable, your identification number,

c) Your address for notification purposes, either residential or workplace,

d) Your email address, phone number, or fax number for notification purposes, if available, and

e) The subject of your request.

Relevant information and documents should be attached to the application.

MAARIF will respond to your requests within this scope as promptly as possible and at the latest within thirty days, free of charge, depending on the nature of the request. However, if processing the request incurs an additional cost, the applicable fee may be charged. Additionally, only the portion of your application that concerns you personally or the student for whom you are the guardian will be addressed; applications made on behalf of your spouse, relative, or friend will not be accepted.

Turkish Maarif Foundation

Name and Surname:

Date:

Signature: