Informative Text on the PPD

Informative Text on the Processing of Personal Data

As Kadir Has University (“the University”), we pay maximum sensitivity regarding the security of your personal data. With this awareness, we, as the University, attach great importance to the processing and retention of all personal data of all individuals associated with the University pursuant to Law No. 6698 on the Protection of Personal Data (“PPD Law”). With a full understanding of this responsibility and acting in the capacity of “Data Supervisor” defined within the scope of the PPD Law, we process your personal data as explained below and within the limits prescribed by the legislation.

1. Collection, Processing and Processing Purposes of Personal Data

The personal data acquired may vary depending on your relationship with our University; however, all your data shall be collected verbally, in writing or electronically, by automatic or non-automatic methods, through the departments and relevant units of the University, website, social media channels, mobile applications and similar means. Your personal data may be collected and updated as long as your relationship with our University is maintained.

Your personal data shall be processed in line with the personal data processing terms, conditions and purposes specified in Articles 5 and 6 of the PPD Law in accordance with the purposes such as allowing the relevant business units to carry out the necessary work in order for you to benefit from the services offered by our University, ensuring the legal and commercial security of our University and those who are in business relations with our University (administrative operations for communication carried out by our University, ensuring the physical security and supervision of the University locations, legal compliance, financial affairs, etc.), determining and implementing the strategies of our University and executing the human resources policies of our University.

2. To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your personal data may be transferred/disclosed to our business partners, suppliers, legally authorized public institutions and private persons in line with the personal data processing terms, conditions and purposes specified in Articles 8 and 9 of the PPD Law in accordance with the purposes such as allowing the relevant business units to carry out the necessary work in order for you to benefit from the services offered by our University, ensuring the legal and commercial security of our University and those who are in business relations with our University (administrative operations for communication carried out by our University, ensuring the physical security and supervision of the University locations, legal compliance, financial affairs, etc.), determining and implementing the commercial and business strategies of our University and executing the human resources policies of our University.

3. Methods and Legal Grounds of Personal Data Collection

Your personal data are acquired verbally, in writing or via any electronic environment in order to provide our services in line with the above-mentioned purposes and to completely and accurately fulfill our University’s contractual and legal responsibilities. Your personal data collected for this legal reason can also be processed and transferred within the context of the terms and purposes of personal data processing specified in Articles 5 and 6 of the PPD Law with the purposes specified in Articles (1) and (2) of this text.

4. Rights of Personal Data Owner As Per Article 11 of PPD Law

As personal data owners, in case you send your requests regarding your rights to our University with the methods regulated below, our University will finalize the request within a maximum of thirty days depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Authority, the fee in the tariff determined by our University shall apply.

In this context, personal data owners have the right to:

• Learn whether personal data is processed or not,
• Request information if the personal data has been processed,
• Learn the purpose of personal data processing and whether such data is used in accordance with its purpose,
• Know the third parties to whom the personal data is transferred domestically or abroad,
• Request correction of personal data if it is processed incompletely or inaccurately, and request notification of such correction to third parties to whom the personal data has been transferred,
• Request deletion or destruction of personal data if the reasons requiring its processing cease to exist, even though it was processed in accordance with the PPD Law and other relevant laws, and request notification of such action to third parties to whom the personal data has been transferred,
• Object to any outcome to his/her detriment arising from the analysis of processed data exclusively through automated systems,
• Request compensation for damages in case personal data is processed unlawfully

Pursuant to paragraph 1 of Article 13 of the PPD Law, you may send your request regarding the use of your rights specified above to our University in writing or by other methods specified by the Personal Data Protection Board. As the Personal Data Protection Authority has not yet determined any method at this stage, you are required to submit your application to our University in writing in accordance with the PPD Law. Within this framework, the channels and procedures for applications to be made within the scope of Article 11 of the PPD Law are disclosed below.

To exercise your rights stated above, you may submit your request specifying which of the rights set out in Article 11 of the PPD Law you wish to use by filling out the form at www.khas.edu.tr and delivering a printed and signed copy by hand, through a public notary, or via other methods specified in the PPD Law to “Kadir Has Üniversitesi, Kadir Has Cad. Cibali 34083 İstanbul” together with the necessary personal identity information. You may also send the relevant form to [email protected] with a secure electronic signature.

5. Kadir Has University’s Purposes and Legal Basis for Processing Personal Data

Kadir Has University will only process your personal data for lawful purposes under the GDPR related to the University’s charitable, educational and scientific purposes and arising from your relationship with the University as a prospective, current, or former student (or such a student’s parent or guardian), faculty or staff member, employee, contractor, donor, supporter, research subject, visitor to the University or its website, or attendee at a University event.

When Kadir Has University cannot rely on one of these legal grounds, it will seek your prior consent. For example, GDPR Article 9 generally requires Kadir Has University to obtain your prior consent if it collects special categories of personal data protected under the GDPR (e.g. racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic or biometric data used to uniquely identify a natural person, health data, or data related to one’s sexual activities or orientation).

The purposes for which Kadir Has University collects personal data, and the legal bases for processing such personal data, are summarized below.

PURPOSE FOR PROCESSING

LEGAL BASIS FOR PROCESSING

Student Admissions Applications and Other Student Data: Obtaining admissions applications, transcripts, test scores, and related documents from applicants to determine their qualification for admission, and preparing related correspondence, including acceptance and rejection letters; obtaining job applications, resumes, background checks, motor vehicle records, and other background materials from students applying for jobs.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in collecting information needed to evaluate an applicant’s personal, educational, and work background in order to make admissions and employment decisions and otherwise process such applications, and in compiling statistical information to evaluate the University’s diversity, affirmative action, and equal opportunity performance.

Staff and Faculty Job Applications: Preparing acceptance and rejection letters; obtaining job applications, resumes, background checks, motor vehicle records, and other background materials from job applicants.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in collecting information needed to evaluate an applicant’s personal, educational, and work background in order to make an employment decision and otherwise process such applications, and in compiling statistical information to evaluate the University’s diversity, affirmative action, and equal opportunity performance.

Managing Student Accounts: Establishing and administering student accounts, issuing invoices, processing payments and refunds, preparing related correspondence, and, if necessary, pursuing collection efforts.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in charging tuition, fees, and other charges and collecting amounts due related to a student’s education in order to maintain the University’s fiscal stability.

Managing Payroll Accounts: Collecting forms needed to satisfy regulatory requirements, and other documents necessary to prepare payroll checks, bank account information, make withholdings, process pension and retirement contributions and payments, and related employee payroll matters.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in collecting necessary information so that the University can, in a timely and accurate manner, and in compliance with applicable laws, pay its employees their salaries, make appropriate withholdings, and make required reports to and file required documents with the tax authorities.

Managing Expenses, Purchasing, and Reimbursements: Collecting, issuing, and processing expense requests, purchasing invoices, receipts, approvals, payment records, bank accounts, checks, and electronic payments.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in collecting necessary information so that the University can account for expenses, pay bills on time, recover amounts owed to the University, and otherwise administer the University’s day-to-day financial affairs.

Administering Grant, Scholarship, and Financial Aid Programs: Accepting, reviewing, and making decisions related to financial assistance programs, including preparing, executing, monitoring, and enforcing grant, scholarship, and loan agreements and notes documenting such financial assistance.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in helping students find financial resources to pay for their education, in complying with third-party lender and federal and state requirements, and in documenting and administering such financial assistance programs.

Class Registration, Enrollment, and Education Records: Registering students for courses, confirming completion of required course work, accepting, reviewing, and evaluating student course work, operating education software to support teaching, conducting institutional statistical research to measure effectiveness, and for accreditation and collaborative purposes.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in establishing that students are enrolled and completing classes necessary to satisfy enrollment requirements and degree requirements, and in scheduling and staffing courses, assigning and evaluating homework, administering tests, and facilitating group instruction and learning.

Evaluating Academic Performance and Granting Degrees: Assigning grades and other performance measures; confirming satisfaction of required classwork and out-of-class requirements applicable to the awarding of degrees; preparing transcripts and diplomas; maintaining long-term graduation and performance records and providing these to employers.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in evaluating student performance, awarding degrees, recognizing outstanding achievements, holding graduation ceremonies, and providing its graduates and prospective employers with information confirming such performance, degrees, and achievements.

Evaluating Faculty and Staff Performance: Preparing and processing evaluations (including self-evaluations), maintaining personnel and disciplinary files, compiling other performance measure data.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in evaluating the performance of faculty and staff members for purposes of promotions, tenure decisions, disciplinary action, setting salaries, and improving productivity.

Issuing and Use of University Identification, Payment: Issuing identification cards bearing faculty, staff or student photos and embedded with personal information for use in accessing University facilities, events, and resources; making payments; and other University purposes, and monitoring all such uses.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in identifying whether an individual is a student, faculty, or staff member, or is otherwise authorized to be on University property and access University programs and services, in classifying persons as University community members or trespassers, in establishing the authority of individuals to take certain actions, and in facilitating the flow of persons, information, and payments throughout the University.

Campus Security Measures: Taking measures to protect persons and property (physical, personal, and digital) through encryption, firewalls, passwords, reset questions, surveillance cameras, login systems, card-swiping and similar entrance/exit tracking devices, and other security efforts.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in ensuring the physical and digital security of its campus and the members of the Kadir Has University community, and in preventing, detecting, and taking enforcement action with respect to criminal and other unlawful and/or unauthorized activity; such legitimate interest includes sharing security information with authorities as required or permitted by law.

Complaint and Grievance Procedures: Enabling students, staff and faculty to file and process complaints and grievances through such means as Campus Safety, sexual harassment complaints, Human Resources complaints, and Honor Code grievance appeals.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in providing procedures for University members to report dishonest behavior, wrongful actions, injurious conduct, and conflicts of interest, and to contest University decisions that are perceived to be unfair or otherwise inappropriate.

Offering Access to University Information Services: Providing a user identity account including a Kadir Has University email account, storing information on University servers (and servers of third-party processors), allowing students, faculty, staff, alumni and other authorized persons to use University-licensed software, and providing access to educational platforms, assessment tools, social media, library applications, archives, and digital collections.

Such processing is necessary for the performance of a contract.

Kadir Has University has a legitimate interest in providing access to University information services for learning and communication purposes, assuring compliance with applicable licenses and contracts, securing data on such systems, monitoring the systems, and performing system maintenance, analytics, and upgrades.

Recruitment and University Marketing: Tracking inquiries and website activity (including through the use of cookies and similar tracking files) to identify and recruit prospective students, faculty, and staff.

Kadir Has University has a legitimate interest in identifying qualified students to attend the University and qualified faculty and staff to work at the University.

Research: Conducting educational, scientific, and other research and related statistical analysis.

Kadir Has University has a legitimate interest in carrying out experiments, interviews, clinical evaluations, longitudinal studies and other research activities to advance knowledge and translate such research into activities and applications that benefit society.

Alumni and Advancement Communications: Maintaining contact information for alumni and donors in order to send correspondence, magazines, newsletters, online communications, invitations, and to seek and accept gifts and donations.

Kadir Has University has a legitimate interest in maintaining an ongoing relationship with alumni for informational, networking, job placement, continuing education, and fund-raising purposes, and in communicating the University’s programs and successes to the general public.

Categories of Personal Data Collected

In certain instances, Kadir Has University, in its capacity as a controller, may acquire your personal data from a third party, and not directly from you. If this occurs, then within a reasonable period of time, but not later than the earlier of (a) the first time Kadir Has University communicates with you, and (b) one month after Kadir Has University acquires such personal data, Kadir Has University will advise you of the categories of personal data collected, the source from which Kadir Has University acquired such personal data, and certain additional information required under GDPR Article 14.

Recipients / Categories of Recipients Who May Receive Your Personal Data

The specific categories of recipients who will receive your information depend on whether you are a prospective, current, or former student (or such a student’s parent or guardian), faculty or staff member, contractor, donor, supporter, research subject, or have some other status, and on the types of personal data that you provide.

The categories of recipients are likely to include one or more of the following:

• Responsible faculty and staff involved in the relevant University activities,
• Relevant Turkish Ministry of Education departments and agencies, and the Ministry of Treasury and Finance,
• Third parties who administer or provide services related to personnel health insurance, benefits, and pension / retirement programs,
• Lenders and other third parties involved in student loans, scholarships, and other financial aid programs,
• Third-party processors who host and process information in the cloud on servers located in Türkiye

If you would like more detailed information regarding the specific identity of recipients receiving particular personal data, please contact the Controller at [email protected].

Transfer of Personal Data

Personal data that you provide while in EU countries may be transferred outside the EU. The GDPR permits such transfer when necessary for the performance of a contract between you and Kadir Has University, or if Kadir Has University obtains your explicit consent to such transfer. In transferring your personal data to a processor, Kadir Has University will employ suitable safeguards, including those described in the Information Security section below, to protect the privacy and security of your personal data so that it is only used in a manner consistent with your relationship with the University and this privacy notice.

How Long Will Your Personal Data Be Stored?

The GDPR requires that your personal data be kept no longer than necessary. The applicable retention period will depend on the nature of such personal data and will also be determined by legal requirements imposed under applicable laws and regulations. If you have specific questions concerning how long a certain type of personal data will be retained, please contact the Controller at [email protected].

You Have Certain Rights to Control Your Personal Data

Articles 15–21 of the GDPR give you the right to control your personal data by directing Kadir Has University, as controller, to do one or more of the following, subject to certain conditions and limitations:

• Access your personal data to see what information the University has collected concerning you,
• Correct any inaccuracy in your personal data,
• Delete your personal data, unless Kadir Has University can demonstrate that retention is necessary or that it has overriding legitimate grounds for retention,
• Restrict the processing of your personal data,
• Transfer your personal data to a third party (portability),
• Upon your objection, stop processing personal data when Kadir Has University relies on a legitimate interest basis for processing unless it can demonstrate compelling legitimate grounds that override your interests

If You Consent to the Processing of Your Data, You Can Withdraw Such Consent

If Kadir Has University processes your personal data based on your consent, you may withdraw such consent at any time by contacting the Controller at [email protected].

GDPR Remedies Include the Right to File a Complaint with the Supervisory Authority

If you believe your privacy rights under the GDPR have been violated, the GDPR gives you the rights and remedies set forth in GDPR Articles 77–82. These include the right to file a complaint with the relevant EU data protection supervisory authority.

Are You Obligated to Provide Personal Data?

As discussed above, Kadir Has University will sometimes ask you to provide information necessary to perform contracts to which you are a party, or to satisfy certain legal requirements binding upon the University. If you do not provide such information, Kadir Has University will not be able to process such contracts or comply with such legal requirements, and you will not be eligible to receive the benefits that may result from the processing of such contracts or compliance with such requirements.

For example, if you do not provide personal data needed to process an admission, financial aid, student housing application or agreement, you will not be admitted to the University, awarded financial aid, or allowed to live in student housing. Similarly, if you do not provide legally required information needed to process a visa, or as part of a legally required background check process related to a job or internship position, your visa will not be approved and you will not be eligible for such job or internship.

You Have the Right to Know If Kadir Has University Uses Your Personal Data in Automated Decision-Making, Including Profiling

The GDPR limits Kadir Has University’s right to use your personal data for predictive purposes as part of an automated decision-making process, including profiling. Such a process uses your personal data, such as preferences, interests, behavior, locations, and personal movement, to make an analytically determined decision instead of a personalized, individual decision.

The GDPR limitation does not apply when such automated decision-making is necessary for the performance of a contract to which you are, or will be, a party. Kadir Has University does not intend to use personal data in an automated decision-making process, except in the context of such a contract. However, if it does, it will seek your consent for such use.

Information Security

All personal data and special categories of sensitive personal data collected or processed by Kadir Has University under the scope of this Policy must comply with the security controls, systems, process requirements and standards as set forth in the Kadir Has University Data Classification and Handling Policy.