Personal Data Processing & Privacy Notice

This Personal Data Processing & Privacy Notice is prepared by Study First Academy ("the Company") in its capacity as the Data Controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("the Law"). It informs natural persons ("Data Subjects") about the methods, processes and purposes by which their personal data is collected, processed, stored, protected and erased, and explains their rights under the Law and how to exercise them.

1. What Does Processing of Personal Data Mean?

Under Article 3(e) of the Turkish KVKK, "processing of personal data" refers to any operation performed on personal data, whether wholly or partially automated or carried out by non-automated means as part of a data filing system — including collection, recording, storage, retention, modification, reorganisation, disclosure, transfer, takeover, making available, classification, or restriction of use.

2. Our Data Policy

Throughout the long years we have served our users, we have always respected the privacy of your personal and commercial data. The data of our users and employees — referred to herein as "Data Subjects" — are processed strictly within the boundaries imposed by Turkish Commercial Code, Tax Procedure Law, Code of Obligations and related legislation, and have never been shared with third parties outside of these legal obligations.

Our personnel receive ongoing training and information regarding the protection of Data Subjects' personal data. This Notice may be updated from time to time due to legal changes or other operational reasons; updates become effective upon publication on our website.

3. Purposes of Processing Your Personal Data

As the Data Controller, we may process your personal data for the following purposes within our education consultancy and exam preparation activities:

• Providing education consultancy; building a roadmap tailored to your target country, university and programme,
• Preparing and submitting applications to universities, language schools and educational institutions at home and abroad,
• Registering you for international exams (IELTS, TOEFL, SAT, ACT, GRE, GMAT, DELE, DELF/DALF, TestDaF and similar) and tracking results,
• Enrolling you in preparation programmes, planning lessons and monitoring academic progress,
• Supporting student visa applications and preparing the required documents,
• Preparing and following up scholarship and financial aid applications,
• Arranging accommodation, airport pickup and orientation services where you request them,
• Negotiating, concluding and performing consultancy agreements,
• Invoicing and collecting service fees,
• Contacting you by phone, email and messaging channels throughout the application and service process,
• Sending announcements about new programmes, campaigns and updates where you have given explicit consent,
• Measuring service quality, assessing satisfaction and resolving complaints,
• Keeping participant records for information events, education fairs and seminars,
• Evaluating job applications and administering our employees' personnel processes,
• Managing judicial and administrative proceedings, responding to requests from public authorities, fulfilling legal obligations and resolving disputes,
• Ensuring the physical security of our offices and examination rooms and the information security of our website,
• Analysing website usage and improving our services,
• Compiling a personal data inventory and monitoring regulatory compliance,
• Evaluating and responding to all written, verbal or electronic enquiries, requests, suggestions, complaints and applications.

4. Third Parties to Whom Your Personal Data May Be Transferred

Your personal data may be transferred to the following parties only to the extent required by the purposes listed above and strictly within the scope of the service you have requested:

• Universities, language schools and educational institutions at home and abroad to which we apply on your behalf,
• International examination and certification bodies and their authorised representatives (British Council, IDP, ETS, Pearson, Cambridge, College Board and similar),
• Consulates, embassies and visa application centres of the relevant countries, within the scope of a student visa application,
• Accommodation providers, student residences, insurance companies and transport providers, where you request such services,
• Our partners and local representatives abroad,
• Our financial and legal advisors and independent auditors,
• Our IT infrastructure, hosting and email service providers,
• Banks and payment institutions,
• Judicial authorities and competent public authorities.

5. Categories of Data Processed, Collection Methods and Legal Bases

Within our services we process the following main categories of data: identity data (name, surname, date of birth, nationality, passport and ID details), contact data (phone, email, address), education data (diploma, transcript, grade average, exam result documents), application file contents (statement of purpose, reference letters, CV), financial data (bank receipts, payment records and the financial documents required for a visa), visual records (office security cameras) and transaction security data (IP address, cookie records).

We collect this data on the legal bases set out in Articles 5 and 6 of the Law — conclusion and performance of a contract, compliance with a legal obligation, legitimate interest and, where required, explicit consent — through the following methods:

• The consultancy application and contact forms on our website,
• Preparation programme and camp registration forms,
• Your contact with us by phone, email, WhatsApp and social media,
• Face-to-face consultations at our office,
• Documents you send us as part of your application file,
• Information you share during international exam registration,
• Our online payment page and bank transfer records,
• Cookies used on our website,
• Registration forms for education fairs, seminars and information events,
• Job application forms and CVs sent to us,
• Camera systems installed in our offices for security purposes,
• Business cards shared in printed or electronic form.

6. Your Rights as a Data Subject

Pursuant to Article 11 of the Law, as a Data Subject you have the right to apply to our Company to:

• Learn whether your personal data is being processed,
• Request information regarding such processing,
• Learn the purpose of processing and whether the data is used in accordance with that purpose,
• Know the third parties — domestic or international — to whom your data is transferred,
• Request the correction of incomplete or inaccurate data and that such correction be communicated to third parties,
• Request the erasure or destruction of your data when the reasons for processing no longer exist, and that such action be communicated to third parties,
• Object to automated decisions producing adverse consequences,
• Claim compensation for damages arising from unlawful processing.

Pursuant to Article 28/2 of the Law, the above rights — except the right to claim compensation — cannot be exercised in the following situations: processing necessary for prevention or investigation of crime; processing of personal data made public by the data subject themselves; processing carried out by authorised public bodies for supervisory or regulatory duties; and processing necessary to protect the State's economic and financial interests in matters of budget, tax and fiscal policy.

7. Cookies

Our website uses cookies to automatically obtain certain data such as your IP address, browser, operating system, internet connection, and site-usage information. Cookies are small text files transmitted by a web server to your hard drive. The cookies on our site are not used to deliver harmful viruses.

Cookies are generally stored on your computer to recognise you and facilitate your use during each visit. The Company may process your data through cookies and transfer the obtained information to third parties — domestic or international — for analysis purposes. If you wish to view our site without cookies, you may change your device/browser settings at any time.

For details, please see our Cookie Policy. You can update your cookie preferences at any time through the Cookie Preferences panel.

8. Explicit Consent

Do not upload your personal information without your consent. The Company will not collect any personal data other than that obtained via cookies unless you give consent. By approving this notice, you declare that:

• You are 18 years of age or older,
• If you are under 18 and have legal capacity, you have obtained the consent of your parent or legal guardian,
• You acknowledge, accept and consent to the processing of your personal data in accordance with the Law and this Notice, for the purposes described herein,
• You accept that the Company and the Data Controller have fulfilled their disclosure obligation under the Law,
• You have read and understood this notice and are aware of your rights and obligations.

9. Applications & Contact

To exercise the rights listed above, you may apply in writing to the Data Controller at info@studyfirstacademy.com. Your application will be answered within 30 days at the latest, pursuant to Article 13 of the Law.