Disclosure Statement

As required by the right to "privacy and protection of private life" in Article 20 of the Constitution, "Everyone has the right to request the protection of personal data about him. This right also includes being informed about personal data about the person, accessing these data, requesting their correction or deletion, and learning whether they have been used for their purposes. Personal data can only be processed in cases stipulated by law or with the express consent of the person. The principles and procedures regarding the protection of personal data are regulated by law. " provision is included.

The Law on the Protection of Personal Data (KVKK) No 6698 was published in the Official Gazette dated 07.04.2016 within the framework of the governing provision of the Constitution, and regulations and board decisions, which are derivative legislation in terms of implementation of the law, were published. The aforementioned law regulates the obligations of natural and legal persons who process personal data and the procedures and principles to be followed, protecting the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data.

As the data controller of Hacettepe University, importance is attached to the protection of personal data processed within the scope of The Law on the Protection of Personal Data (KVKK) No 6698. Personal data are stored as long as the data processing purpose is valid. Necessary security measures are taken to prevent the loss of stored and recorded data, to prevent unauthorized and unlawful use.

Hacettepe University KVKK Committee Members

Hacettepe University KVKK Inventory Preparation Group Members

A. Definitions

Explicit consent: It refers to the consent that is based on the information and expressed with free will regarding a specific subject.

Anonymization: It refers to the rendering of personal data that cannot be associated with an identified or identifiable natural person under any circumstances, even by matching with other data.

Related person: Refers to the real person whose personal data is processed.

Personal data: It refers to all kinds of information related to an identified or identifiable natural person.

Processing of personal data: Obtaining, recording, storing, preserving, changing, rearranging, disclosure, transferring, taking over, making available, using non-automatic means, provided that personal data are fully or partially automated or are part of any data recording system, It refers to all kinds of operations performed on data such as classification or prevention of use.

Personal data of special nature: Data on race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures and biometric and refers to genetic data.

Data processor: Refers to the natural or legal person who processes personal data on behalf of the data controller, based on the authority given by him.

Data controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

B. Basic Principles of Processing Personal Data

Hacettepe University accepts that it will process personal data in both internal and external procedures by Article 4 of the KVKK by the following principles:

• Compliance with the law and good faith
• Accuracy and timeliness
• Processing for specific, explicit, and legitimate purposes
• Processing data in connection with the purpose for which it is processed, in a limited and measured manner
• Processing limited to the period stipulated by the provisions of the legislation or required by the purpose of processing

C. Conditions of Processing Personal Data

By Article 5 of the KVKK, the processing of personal data by Hacettepe University is carried out by the following conditions specified in the KVKK and the relevant legislation:

• Having the explicit consent of the person concerned
• Processing of data due to legal requirements
• The processing of the data of the person who cannot explain the consent of the person concerned or whose consent cannot be given legal validity due to the actual impossibility to be processed for the protection of himself or someone else's life or body integrity
• It is mandatory to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment and execution of a contract
• It is mandatory for the data controller to fulfill his legal obligation
• Processing of personal data made public by the person concerned
• Processing of data that is mandatory for the establishment, use, or protection of a right
• Processing personal data for the legitimate interests of the data controller

D. Conditions for Processing Special Quality Personal Data

According to Article 6 of the KVKK, people's ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, costume and dress, membership in associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric data and its genetic data are personal data of special nature.

It is forbidden to process sensitive personal data without the express consent of the person concerned. It is the basic principle that Hacettepe University employees do not process special quality data in terms of personal data. Hacettepe University has adopted the basic rule and principle not to process the personal data of students and visitors, provided that the following legal exceptions and obligations are reserved.

Exceptions to the main principle are as follows:

• Processing of Special Qualified Personal Data in the Event of the Explicit Consent of the Related Person: The provisions stipulated by the KVKK regarding the processing of special quality personal data without express consent are reserved.
• Processing of Special Qualified Personal Data Due to the Stipulation of the Legislative Provisions Despite the Lack of Explicit Consent of the Related Person: In cases where it is stipulated that special quality personal data can be processed by the provisions of the legislation, the special quality personal data of the relevant person, except for the health and sexual life, may be processed by the provision of KVKK. In this case, data processing activities to be carried out by the University will be limited to the requirements of the underlying legislative provision. In terms of Hacettepe University, these requirements and limits, especially in contracts, legal processes such as lawsuits, enforcement proceedings arising from legal relations, the submission of special quality personal data to legal processes on the condition that it is related to the essence of the relevant legal process, and in these processes, it All legislation that stipulates administrative and criminal sanctions in the event of non-processing, especially in the case of taking part in legal processes of special quality personal data collected by you or by parties or by third parties and storing personal data for the period required for legal processes, especially the processing of personal data, higher education legislation, Labor Law Due to the relevant provisions of the labor law legislation, the legislation stipulating the responsibility of the University regarding public order and security, or due to the legal requirements within the framework of the YÖK legislation and without any other legal provisions that do not result in explicit consent. It also includes inspiration.
• Processing of Special Quality Personal Data Related to Health and Sexual Life for the Purpose to Implement Preventive Medicine, Medical Diagnosis, Treatment and, Care Services, Planning and Management of Financing with Health Services, with the Obligation of Confidentiality: As required by KVKK, private health and sexual life The processing of qualified personal data is subject to the condition of their express consent, and in cases where there is no express consent, it is regulated that the personal data in question can only be processed by persons under the obligation of secrecy for the purpose of conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. . In this regard, without prejudice to the legal requirements that do not result in explicit consent, especially the Labor Law and other legislation regulating the Labor Law and other labor law, the Higher Education Legislation, the legal obligations requiring public order and security, but with the express consent, the health and sexual life Related special quality data is processed.
• Measures to be taken in the Processing of Special Quality Personal Data: To process special personal data, necessary technical and administrative measures are taken, especially to prevent unauthorized access and cyber-attacks with encrypted access, as required by the KVKK. This issue is monitored and coordinated by the Personal Data Protection Committee. Employees are obliged to comply with these administrative and technical measures.

E. The Purpose for Which Personal Data Can Be Processed

Collected personal data, personal data for the purposes listed below; It can be processed provided that it is within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698:

• Ensuring the legal and commercial security of our university and those who are in business relations with our university; Determining and implementing the academic processes and business strategies of our university
• Accreditation and evaluation studies of our university, ensuring public order and security, increasing efficiency and quality in call center and telephone communication, preventing violence, academic guidance activities
• Establishing emergency lists and conducting emergency operations
• Creation of emergency analysis reports 
• Within the scope of ensuring the execution of the human resources policies of our university
• Maintaining and developing effective educational management in line with the goals of the university,
• Auditing of performance processes,
• Carrying out performance evaluation processes,
• Carrying out career development activities,
• Making assignments abroad,
• Grouping according to their characteristics to notify public institutions, within the scope of ensuring that the university fulfills its obligations arising from internal academic legislation,
• Receiving records within the scope of ensuring that the requirements arising from internal regulations are fulfilled,
• Keeping disciplinary records and resumes submitted before the study,
• Collecting the reasons for the disease reports,
• Efficient and modern planning and execution of the university's educational policies and processes,
• Carrying out the necessary work by our relevant business units for the realization of the educational activities carried out by the university and carrying out the related business processes,
• Carrying out the necessary work by our business units to benefit the relevant people / students from the products and services offered by the University and carrying out the relevant business processes,
• Ensuring the legal, commercial, and job security of the university and students,
• Planning and execution of the university's business and / or educational strategies,
• To plan and execute the necessary activities for the recommendation, promotion, and presentation of the education and services offered by the University according to the tastes and needs of the relevant persons

F. To Whom and For What Purpose the Processed Personal Data Can Be Transferred

The collected personal data is not limited to those here, to the extent permitted and required by the KVKK and derivative legislation and according to the conditions of the situation;

• to our affiliates and business partners of which we are a member, legally authorized public institutions and private persons and other persons for the purposes stated in your contract,
• To maintain and develop effective employee management, fulfilling contractual obligations, providing legal and legal administrative procedures, referral and information supply between departments, evaluating the performance of employees, ensuring and improving occupational safety, and also in business relations with our University and the University. To ensure the legal and commercial security of the people who are involved,
• Determining and implementing the business strategies of the university, enforcement of the requirements arising from internal regulations,
• Grouping according to your characteristics to notify public institutions to ensure that the university fulfills its obligations arising from internal academic legislation,
• Conducting performance evaluation processes,
• Effective and modern planning and implementation of the university's educational policies and processes,
• Carrying out the necessary work by our relevant business units for the realization of the educational activities carried out by the university and carrying out the related business processes,
• Carrying out the necessary work by our business units to benefit relevant people / students from the products and services offered by the University and carrying out the relevant business processes,
• Ensuring the legal, commercial, and job security of the university and students,
• Planning and execution of the university's business and / or educational strategies,
• For planning and executing the necessary activities for the recommendation, promotion, and presentation of the education and services offered by the University to the relevant people by customizing them according to the tastes and needs of the relevant people;
• Higher Education Law, Labor Law, Occupational Health and Safety Law, Social Insurance and General Health Insurance Law, Law on Regulating Publications on the Internet and Combating Crimes Committed Through These Publications, Turkish Commercial Code, Tax Procedure Law, Personal Institutions or organizations permitted by the Data Protection Law and other legislative provisions,
• Public legal entities such as the Personal Data Protection Authority, the Council of Higher Education, the Ministry of Finance, the Ministry of Customs and Trade, the Ministry of Labor and Social Security, and the Information Technologies and Communication Authority; university networks we are a member of; our subsidiaries and / or direct / indirect domestic / foreign affiliates,
• Program partner domestic / international organizations that are jointly and jointly responsible with us in taking workplace security measures such as the protection of all kinds of personal data, prevention of unauthorized access, and illegal processing of your data, with which we contractually serve and cooperate to carry out our activities as a university and other 3rd parties

can be transferred limited to the terms and purposes of processing specified in Articles 8 and 9 of Law No. 6698.

G. Method and Legal Reason for Collecting Personal Data

Your data can be obtained by the University based on different channels and different legal reasons; It convenes for the effective planning and execution of university education and training activities. Your data collected in this process; is collected in a physical and electronic environment by all legal regulations that require the fulfillment of obligations arising from contracts, the evaluation of the performance of the employees, and all institutions and units of the University to be able to effectively fulfill their higher education activities. Your data collected for this legal reason can also be processed and transferred for the purposes specified in Articles (E) and (F) of this notification within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

H. Transfer of Personal Data

With Article 8 of Law No. 6698, the transfer of personal data to third parties in the country is regulated. As a rule of thumb, personal data cannot be transferred to third parties without the express consent of the person concerned. Our employees are also acknowledged by this Form that the personal data of the addressees cannot, as a rule, be transferred to third parties. Compliance with the following criteria is ensured in the processes of transferring personal data. It is the responsibility of the University to act by the provisions of all legislation regarding the transfer of personal data and to adapt the transfer processes according to the provisions of the legislation in force or to come into force, and these processes will be followed and coordinated by the Personal Data Protection Committee.

Obtaining the explicit consent of the relevant person for the transfer of personal data The main rule for transferring personal data to third parties by Article 8 of Law No. 6698 is the explicit consent of the person concerned. Transfer of personal data, provided that the conditions for the processing of personal data are met, even if the person concerned does not have explicit consent, in cases where the person concerned does not have an explicit consent for the transfer of personal data domestically, paragraph 2 of Article 5 and adequate measures regarding the data processing conditions It is possible to transfer personal data to third parties under the conditions regulated by paragraph 3 of Article 6, provided that they are received. The University will be able to transfer the said personal data to third parties to the extent required by the effective execution, financing, and promotion of the university education activities, by complying with paragraph 2 of Article 5 and paragraph 3 of Article 6 in the presence of adequate measures. Third parties to whom personal data of special nature will be transferred must also take these measures. The determination and coordination of the necessary measures in the transfer processes are carried out under the supervision of the relevant department and the Personal Data Protection Board.

I. Transfer of Personal Data Abroad

By Article 9 of Law No. 6698, personal data cannot be transferred abroad without the express consent of the person concerned. In case of consent, personal data will be shared with our affiliates abroad in proportion to the legitimate requirements arising from educational activities, taking into account the safe country list to be published by the Data Protection Board. In cases where the person concerned does not have explicit consent for the transfer of personal data abroad, processing and transfers permitted within the scope of KVKK and relevant legislation regarding the processing and transfer of personal data may be made.

J. Deletion, Destruction, Anonymization of Personal Data

Even if personal data is processed by this form with the provisions of KVKK and other legislation, it should be deleted, destroyed, or anonymized by the request of the person concerned or by the University itself, in case the reasons requiring the processing of the data are eliminated. The University provides the administrative and technical infrastructure suitable for fulfilling all new legislative provisions that are in force or will come into force regarding the deletion, destruction, or anonymization of data. Employees are obliged to apply all new legislative provisions that are, or will come into force regarding the deletion, destruction or anonymization of data.

K. Rights of Personal Data Owner

As personal data owners, by filling in the Personal Data Information and Request Form regarding your rights, delivering it to the address of the University you have established a business relationship as a student / visitor with a signature, sending it through a notary public, sending an e-mail signed with your secure electronic signature, or by sending a secure electronic If you send a signed Word or PDF file with an e-mail to bhim@hacettepe.edu.tr; The university will finalize the request as soon as possible and free of charge within thirty days at the latest, depending on the nature of the request.

However, if the transaction requires an additional cost except for free legal requirements, the fee in the tariff determined by the Personal Data Protection Board by Hacettepe University may be charged.

In this context, personal data owners;

• Learning whether personal data is processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used appropriately for their purpose,
• To know the third parties in the country or abroad to whom personal data have been transferred,
• To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data are transferred
• To request the deletion or destruction of personal data if the reasons requiring its processing disappear, even though it has been processed by the provisions of Law No. 6698 and other relevant laws, and to request notification of the transaction made within this scope to third parties to whom personal data have been transferred
• Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• In case of damage due to unlawful processing of personal data, it has the right to demand compensation for the damage.