KAYSERI UNIVERSITY

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

As Kayseri University, personal data will be processed within the scope explained below in accordance with the Law on the Protection of Personal Data No. 6698 (KVKK) and relevant legal regulations, and as a "data controller".

The Kayseri University Information Notice on the Processing of Personal Data ("Information Notice") has been prepared in accordance with Article 10 of the KVKK titled "Data Controller's Obligation to Inform", in order to transparently inform data subjects about the identity of the data controller, the method and legal basis of collecting personal data, the purposes for which these data will be processed, to whom and for what purposes these data may be transferred, the duration of data processing, and the rights listed in Article 11 of the KVKK. The explanations made for "Personal Data" in the Information Notice also cover "Sensitive Personal Data".

Method and Legal Basis of Collecting Personal Data:

Personal data, depending on the relationship between the University and the personal data owner, can be processed by automatic or non-automatic methods, will be created and updated by the University units, and can be kept in both digital and physical environments.

Personal data will be processed within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK, and may be transferred within the scope of Articles 8 and 9 of the same Law for the purposes listed below.

Purposes of Processing Personal Data:

Your collected personal data may be processed by Kayseri University for the following purposes in accordance with the basic principles stipulated by the KVKK and within the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK:

• Providing and conducting services offered/to be offered by Kayseri University,
• Ensuring the legal and commercial security of individuals, institutions, and organizations that have a business relationship with Kayseri University,
• Conducting activities that Kayseri University deems necessary to increase the level of education,
• Determining, implementing, and ensuring the sustainability of Kayseri University's corporate strategies,
• Planning, auditing, and implementing information security processes,
• Ensuring transparency that can demonstrate that the examination evaluation process is conducted objectively,
• Fulfilling students' accommodation, social, financial, and personnel rights,
• Conducting the financial and personnel rights of all employees within the University,
• Keeping records required by relevant legislation for personnel and students,
• Conducting procurement processes and making payments arising from the goods and services received,
• Ensuring that individuals (students, employees, alumni, job candidates, student candidates, visitors, suppliers, business partners, employees of institutions with which we cooperate, etc.) who have a relationship with the University can benefit from the services provided by the University and/or units affiliated with the University,
• Ensuring the safety of life and property and legal, commercial, occupational health and safety of individuals (students, employees, alumni, job candidates, student candidates, visitors, suppliers, business partners, employees of institutions with which we cooperate, etc.) present in the University and/or units affiliated with the University,
• Fulfilling legal and regulatory requirements arising from/all secondary regulations and taking necessary precautions within this scope,
• Conducting auditing and/or regulatory tasks by authorized public institutions and organizations and professional organizations that are public institutions,
• Managing disciplinary investigation processes initiated/that may be initiated about students and academic and administrative personnel,
• Providing health services to students and staff receiving education at the University,
• Supporting alumni in career planning, monitoring alumni success, and establishing an alumni network,
• Conducting sports activities and enabling membership in the University student community, benefiting from the work, activities, and organizations conducted under the club roof,
• Fulfilling the information and document requests of judicial authorities and/or administrative authorities,
• Developing products and services offered in all units affiliated with the University, increasing satisfaction, making necessary changes within this scope, and producing statistical and scientific information,
• Conducting market research, promotion, and necessary information regarding products and services, evaluating complaints and suggestions, and directly contacting through communication channels shared with the University,
• Conducting all kinds of activities related to academic education, scientific research, project applications, applications, and transfers related to rights under the Law on Intellectual and Artistic Works and the Industrial Property Law,
• Conducting human resources processes and policies of the University,
• Determining, developing, and implementing the strategies of the University and its affiliated units,
• Conducting accreditation and evaluation studies of the University and its affiliated units,
• Fulfilling participation requests for training, seminars, etc. organizations,
• Conducting educational and research collaborations, educational programs, staff exchanges, joint events, and activities with similar institutions operating abroad and country representations of foreign country-origin employees,
• Taking all necessary technical and administrative measures for system and application security within the scope of data security.

To Whom and For What Purposes Personal Data Can Be Transferred:

Personal data processed within the scope of the purposes specified in the "Purposes of Processing Personal Data" section of this "Information Notice" in accordance with the principles set out in Article 4 of the KVKK titled "General Principles" and the conditions for processing personal data specified in Article 5 and the conditions for processing sensitive personal data specified in Article 6, may be transferred to the University and/or units affiliated with the University, legally authorized real and/or legal persons (business partners, subcontractors, suppliers, those who receive services for the conduct of products and services or those who cooperate in any field, real and/or legal persons located domestically and/or abroad) within the framework of the conditions specified in Articles 8 and 9 of the KVKK, if necessary.

Data Processing Period:

Personal data will be processed within the scope of the purposes specified in the "Purposes of Processing Personal Data" section of this Information Notice and in compliance with the data processing and statute of limitations periods stipulated in all relevant laws and other legal regulations, primarily the Higher Education Law No. 2547, to which the University and/or its affiliated units are subject. In case of a change in data processing periods in the laws, the newly determined periods will be taken as the basis.

Rights of the Personal Data Owner Listed in Article 11 of the KVKK:

The personal data owner, within the framework of Article 11 of the KVKK, has the right to apply to the University and;

• Learn whether personal data is processed or not,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data are transferred domestically or abroad,
• Request the correction of personal data if they are incomplete or incorrectly processed, and request the notification of the transaction made within this scope to third parties to whom the personal data has been transferred,
• Despite being processed in accordance with the KVKK and other relevant law provisions, request the deletion or destruction of personal data in case the reasons for processing no longer exist and request the notification of the transaction made within this scope to third parties to whom the personal data has been transferred,
• Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
• Request compensation for the damage in case of suffering damage due to unlawful processing of personal data.

Applications will be made in writing or electronically to the University after filling out the "Personal Data Owner Application Form" available on the University's website at 'www.kayseri.edu.tr' via the methods specified below.

If applying in writing; A wet-signed copy of the Data Owner Application Form will be personally delivered to the University General Document Unit with an identity document or submitted by proxy with a notarized power of attorney showing that the applicant is authorized to apply regarding the rights listed in Article 11, or sent to the University via a notary.

If applying electronically; The Data Owner Application Form will be signed with an electronic or mobile signature defined as a "secure electronic signature" in the Electronic Signature Law No. 5070 and sent using the University's Registered Electronic Mail (KEP) address "kayseriuni@hs01.kep.tr" or using the electronic mail address previously notified by the data owner to the University and registered in the University's system, or, if there is a software or application developed by the University for the purpose of the application, through these means.

Requests conveyed to the University will be answered in writing or electronically, depending on the nature of the request, as soon as possible and within thirty days at the latest, within the framework of the procedure fee determined in Article 7 of the Communiqué on the Procedures and Principles of Application to the Data Controller published in the Official Gazette dated 10/03/2018 and numbered 30356.