Personal Data Protection and Processing Policy

Target audience: all natural persons whose personal data is processed within the scope of the Attendify+ mobile application and website.

Prepared and approved by: Adil Onur Karahan Şahıs Şirketi.

1. Introduction

Adil Onur Karahan Şahıs Şirketi (the “Company”) provides its users, through the Attendify+ mobile application and website (the “Platform”), with the services of course schedule, attendance and absence tracking, exam, homework and note management, and storage of data on the server and its synchronization.

The Company attaches importance to the protection of personal data in the activities it carries out. This Personal Data Protection and Processing Policy (the “Policy”) is the basic regulation on the application of the procedures and principles laid down by Law No. 6698 on the Protection of Personal Data (KVKK; the “Law”) to the business processes within the scope of the Platform.

1.1. Purpose

The purpose of this Policy is to ensure the effective application of the procedures and principles stipulated by the Law and the related legislation in the business processes within the scope of the Platform. The Company takes the necessary administrative and technical measures for the processing and protection of personal data and raises awareness.

1.2. Scope

The Policy covers all personal data obtained in the business processes within the scope of the Platform by automated means, or by non-automated means provided that they form part of a data filing system. In guest use, data kept only on the user’s device and not transmitted to the Company is not processed by the Company.

1.3. Basis

The Policy is based on the Law and the related legislation. Personal data is also processed in order to fulfill the obligations arising from the legislation to which the Company is subject, in particular Law No. 6563 on the Regulation of Electronic Commerce, Turkish Commercial Code No. 6102, Law No. 5651 on the Regulation of Publications on the Internet, Turkish Penal Code No. 5237 and Law No. 6502 on Consumer Protection. In the event of any inconsistency between the legislation in force and the Policy, the legislation in force shall apply.

1.4. Definitions

2. Protection of personal data

2.1. Ensuring the security of personal data: In order to prevent the unlawful disclosure of, access to or transfer of personal data, or security problems that may arise in other ways, the Company takes the measures stipulated in Article 12 of the Law according to the nature of the data and takes into account the guidelines published by the Authority.

2.2. Special categories of personal data: The operation of the Platform does not require special categories of personal data, and such data is not requested. If a user voluntarily enters such data in notes or reasons, this data is stored solely as the user’s content, is not processed for any other purpose, and is protected in accordance with Article 6 of the Law and the measures determined by the Board.

2.3. Awareness: The Company ensures that persons who access personal data are aware of the need to process and protect the data lawfully, and updates these efforts in line with changes in the legislation.

3. Processing of personal data

3.1. General principles — Personal data is processed in accordance with the principles set out in Article 4 of the Law:

• Compliance with the law and the rules of good faith: processing to the extent required by business processes and without harming the fundamental rights and freedoms of individuals.
• Being accurate and, where necessary, up to date: taking the necessary measures to keep the processed data accurate and up to date.
• Processing for specified, explicit and legitimate purposes.
• Being relevant, limited and proportionate to the purposes for which they are processed.
• Retention for the period stipulated in the legislation or necessary for the purpose of processing; erasure, destruction or anonymization at the end of the period.

3.2. Conditions for processing — Personal data is processed on the basis of at least one of the conditions listed in Article 5 of the Law:

• It is expressly provided for by law,
• It is necessary to protect the life or physical integrity of the person, or of another person, who is unable to express consent due to actual impossibility,
• It is directly related to the establishment or performance of a contract (operations under the membership agreement are based on this condition),
• It is necessary for the Company to fulfill its legal obligation,
• It has been made public by the data subject themselves,
• It is necessary for the establishment, exercise or protection of a right,
• It is necessary for the legitimate interests of the Company, provided that the fundamental rights and freedoms of the data subject are not harmed,
• Where none of the above conditions exist, the data subject has given explicit consent.

Data processing necessary for membership is not made conditional on explicit consent. Explicit consent is sought only for matters for which it must be obtained separately and optionally, and it may be withdrawn at any time.

3.3. Informing the data subject: Data subjects are informed, through the KVKK Privacy Notice and the Privacy Policy published on the Platform, about the purposes for which their data is processed, with whom it is shared, the methods by which it is collected, the legal grounds, and the rights they have.

3.4. Sharing of personal data: Personal data may be shared with third parties in line with the purposes of processing and by taking the necessary security measures, in accordance with Article 8 of the Law and, for transfers abroad, Article 9 of the Law.

4. Data categories and recipient groups

The main data categories processed within the scope of the Platform are: account and contact information, Platform usage information (courses, attendance, exams, homework, notes, voice notes and attachments, Pomodoro sessions), Explore and community information (profile, school information, posts, likes, votes and reports), transaction security information, advertising information, and request and legal transaction information. Which data is processed for which purpose and on which legal ground is set out in detail in the KVKK Privacy Notice.

Personal data may be shared with the following recipient groups for the specified purposes and in accordance with the principles in 3.4:

5. Measures for the protection of personal data

The Company takes the necessary technical and administrative measures to protect the personal data it processes. In this context, data is encrypted with SSL/TLS during transmission, passwords and session keys are stored in irreversible form, access to personal data is restricted by authorization, each user’s data can be accessed only through their own session, and regular checks for security vulnerabilities are carried out. If, despite all the measures taken, personal data is obtained by third parties through unlawful means, the Company will notify the data subjects and the Board of this situation as soon as possible.

6. Retention and destruction of personal data

The Company retains personal data for the period stipulated in the relevant legislation, if any, or, if no period is stipulated, for the period necessary for the purpose of processing. Retention periods by data category are set out in the Personal Data Retention and Destruction Policy. Personal data whose retention period has expired is destroyed by one of the methods of erasure, destruction or anonymization. Destruction carried out upon the application of the data subject is subject to the same principles.

7. Rights of data subjects

7.1. Rights — Pursuant to Article 11 of the Law, data subjects have the following rights:

• to learn whether your personal data is being processed,
• to request information about it if it has been processed,
• to learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• to know the third parties in Türkiye or abroad to whom it has been transferred,
• to request its rectification if it is incomplete or inaccurately processed, and to request that this operation be notified to the third parties to whom it has been transferred,
• to request its erasure or destruction if the reasons requiring its processing no longer exist, even though it has been processed in accordance with the Law, and to request that this operation be notified to the third parties to whom it has been transferred,
• to object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems,
• to claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

7.2. Exercise of rights — Data subjects may submit their requests regarding these rights, using the Data Subject Application Form on our Policies page or with a petition in accordance with the Communiqué, through the following channels:

We kindly ask that you write “Data Subject Request under the Law on the Protection of Personal Data” in the subject line of the application envelope or email.

*For applications in person, only the front side of a document proving your identity needs to be presented (with the blood type and religion fields not visible).

7.3. Responding to applications — The Company concludes duly submitted applications free of charge as soon as possible and within 30 (thirty) days at the latest. If the process additionally requires a cost, a fee may be charged according to the tariff determined by the Board.

7.4. Cases in which an application may be rejected — The Company may reject an application, stating its reasons, in the cases listed in Article 28 of the Law (such as processing for statistical purposes through anonymization; processing for artistic, historical, literary or scientific purposes or within the scope of freedom of expression; judicial and enforcement proceedings; prevention or investigation of crime; data made public by the data subject themselves; supervisory and regulatory duties of public institutions; protection of the economic and financial interests of the State), and where the application is likely to impede the rights and freedoms of others, requires disproportionate effort, or concerns information that is publicly available.

7.5. Right to complain to the Board — If the application is rejected, the response given is found insufficient, or no response is given in due time, the data subject may file a complaint with the Board within thirty days from the date on which they learn of the Company’s response and, in any event, within sixty days from the date of application.

7.6. Information that may be requested from the applicant — The Company may request additional information from the data subject and ask questions about the application in order to determine whether the applicant is the data subject and to clarify the application.

8. Implementation

The Policy has been put into force upon approval by the Company’s authorized representative. The Company’s authorized representative is responsible for the implementation and updating of the Policy and for following up on the related work and transactions. The technical implementation of the Policy is ensured through the Personal Data Retention and Destruction Policy.

9. Entry into force and publication

The Policy enters into force on the date of its publication on the Platform. Amendments to the Policy are made available to data subjects by being published on the Platform and take effect on the date of their publication.