Personal Data Processing & Privacy Notice

This Personal Data Processing & Privacy Notice is prepared by Study First Academy ("the Company") in its capacity as the Data Controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("the Law"). It informs natural persons ("Data Subjects") about the methods, processes and purposes by which their personal data is collected, processed, stored, protected and erased, and explains their rights under the Law and how to exercise them.

1. What Does Processing of Personal Data Mean?

Under Article 3(e) of the Turkish KVKK, "processing of personal data" refers to any operation performed on personal data, whether wholly or partially automated or carried out by non-automated means as part of a data filing system — including collection, recording, storage, retention, modification, reorganisation, disclosure, transfer, takeover, making available, classification, or restriction of use.

2. Our Data Policy

Throughout the long years we have served our users, we have always respected the privacy of your personal and commercial data. The data of our users and employees — referred to herein as "Data Subjects" — are processed strictly within the boundaries imposed by Turkish Commercial Code, Tax Procedure Law, Code of Obligations and related legislation, and have never been shared with third parties outside of these legal obligations.

Our personnel receive ongoing training and information regarding the protection of Data Subjects' personal data. This Notice may be updated from time to time due to legal changes or other operational reasons; updates become effective upon publication on our website.

3. Purposes of Processing Your Personal Data

As Data Controller, we may process your personal data for the following purposes:

• Delivery of products and services,
• Collection and invoicing of fees for products sold and services rendered,
• Payment for products and services purchased,
• Negotiation, execution and performance of all types of contracts,
• Tracking of licence, warranty and update agreements for software sold by the Company,
• Provision of call-center and remote support services; tracking call volume and content,
• Communication with persons and institutions with whom the Company has a commercial relationship,
• Announcement of new or existing products, services and campaigns; carrying out sales and marketing activities,
• Market research,
• Development of the Company's commercial strategies and planning,
• Evaluation of job applications and dealer/authorised distributor applications,
• Creation of participant registries for Company-organised events,
• Management of judicial/administrative proceedings, responding to requests from public authorities, fulfilment of legal obligations and resolution of disputes,
• In case of merger, demerger, or full/partial transfer of the Company, securing the consequences arising from such legal transactions,
• Provision of statutory and supplementary employment rights, performance evaluation,
• Recording of employee training participation and certifications,
• Creation and tracking of visitor logs,
• Ensuring internal and perimeter security of the Company premises, the Website and Applications,
• Website usage analysis,
• Compilation of a personal data inventory,
• Evaluation and response to all written, verbal or electronic enquiries, requests, suggestions, complaints and applications.

4. Third Parties to Whom Your Personal Data May Be Transferred

As Data Controller, your personal data may be transferred to:

• Our subsidiaries and affiliates,
• Our natural and legal person partners,
• Our business partners, dealers and authorised distributors,
• Our financial and legal consultants and other service providers,
• Technopark Management (Managing Company),
• Landlords of premises we occupy,
• Banks and financial institutions,
• Judicial authorities and public authorities.

5. Methods and Legal Bases of Collecting Personal Data

We collect your personal data in compliance with the Law and other relevant legislation, including the Turkish Commercial Code, Tax Procedure Law, Code of Obligations and related rules, through the following methods:

• Information you provide during software licensing,
• Any contracts,
• Mail-order forms,
• Our website's online payment page,
• Recorded telephone conversations with our call-center,
• Emails you send to the Company,
• Remote-support applications,
• Data backups you send for technical review (these are permanently deleted within 24 hours of the completion of the review),
• Information collected via web services during software updates or execution of critical operations, used solely for technical purposes,
• Website cookies,
• Mobile applications,
• CCTV systems installed at our headquarters and branch offices for security purposes,
• Job application forms submitted directly or through intermediary organisations,
• Business cards exchanged in printed or electronic form,
• Face-to-face meetings with the Data Subject.

6. Your Rights as a Data Subject

Pursuant to Article 11 of the Law, as a Data Subject you have the right to apply to our Company to:

• Learn whether your personal data is being processed,
• Request information regarding such processing,
• Learn the purpose of processing and whether the data is used in accordance with that purpose,
• Know the third parties — domestic or international — to whom your data is transferred,
• Request the correction of incomplete or inaccurate data and that such correction be communicated to third parties,
• Request the erasure or destruction of your data when the reasons for processing no longer exist, and that such action be communicated to third parties,
• Object to automated decisions producing adverse consequences,
• Claim compensation for damages arising from unlawful processing.

Pursuant to Article 28/2 of the Law, the above rights — except the right to claim compensation — cannot be exercised in the following situations: processing necessary for prevention or investigation of crime; processing of personal data made public by the data subject themselves; processing carried out by authorised public bodies for supervisory or regulatory duties; and processing necessary to protect the State's economic and financial interests in matters of budget, tax and fiscal policy.

7. Cookies

Our website uses cookies to automatically obtain certain data such as your IP address, browser, operating system, internet connection, and site-usage information. Cookies are small text files transmitted by a web server to your hard drive. The cookies on our site are not used to deliver harmful viruses.

Cookies are generally stored on your computer to recognise you and facilitate your use during each visit. The Company may process your data through cookies and transfer the obtained information to third parties — domestic or international — for analysis purposes. If you wish to view our site without cookies, you may change your device/browser settings at any time.

For details, please see our Cookie Policy. You can update your cookie preferences at any time through the Cookie Preferences panel.

8. Explicit Consent

Do not upload your personal information without your consent. The Company will not collect any personal data other than that obtained via cookies unless you give consent. By approving this notice, you declare that:

• You are 18 years of age or older,
• If you are under 18 and have legal capacity, you have obtained the consent of your parent or legal guardian,
• You acknowledge, accept and consent to the processing of your personal data in accordance with the Law and this Notice, for the purposes described herein,
• You accept that the Company and the Data Controller have fulfilled their disclosure obligation under the Law,
• You have read and understood this notice and are aware of your rights and obligations.

9. Applications & Contact

To exercise the rights listed above, you may apply in writing to the Data Controller at info@studyfirstacademy.com. Your application will be answered within 30 days at the latest, pursuant to Article 13 of the Law.