Data Controller and Scope of the Notice
This Privacy Notice has been prepared pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“Law No. 6698” or the “KVKK”) and the applicable secondary legislation.
The data controller in respect of your personal data is the Yücel Cultural Foundation. yucelkulturvakfi.org, bursverenler.org and sanateserleri.org are operated by the same data controller. The use of data between these platforms within the Foundation, where necessary to provide the relevant service, does not constitute a transfer to a separate third party.
Data controller contact details
- Data Controller
- Yücel Cultural Foundation
- Address
- Alemdar Mah. Alemdar Cad. No: 3, 34110 Sultanahmet Fatih - Istanbul, Türkiye
- Telephone
- +90 212 522 10 74
- Website
- www.yucelkulturvakfi.org
- info@yucelkulturvakfi.org
This notice is addressed to persons who visit or use the websites, create an account, apply for scholarships or programmes, attend events, make reservations or donations, submit content, participate in national or international programmes, visit Yücel Arts Center or otherwise communicate with the Foundation.
Categories of Personal Data and Collection Methods
Personal data may be collected through electronic or paper forms, websites and user accounts, SMS verification, email, telephone, payment and donation transactions, event and reservation processes, in-person meetings, cookies, server and security logs, CCTV systems and documents supplied by the data subject. Data may be collected wholly or partly by automated means, or by non-automated means provided that the processing forms part of a data filing system.
Identity and Contact
Name, surname, date of birth or age, Turkish or foreign identity information, passport information, telephone number, email address and postal address.
Membership and Transactions
User account, membership status, SMS verification, application, assessment, registration, attendance, reservation, donation and transaction history.
Scholarships, Programmes and Events
Education, school, department, academic achievement, social circumstances, programme preferences, attendance status, reserve lists, event leadership and volunteering information.
Finance and Payments
Donation or payment amount, date, transaction status, bank or payment-service-provider reference, accounting and refund information. Full payment-card details are not stored by the Foundation.
Transaction Security
IP address, device and session information, system and access logs, security incidents, verification records and misuse-detection information.
Visual and Audio Records
Event photographs, video and audio recordings, together with CCTV footage recorded at Yücel Arts Center.
Travel and International Programmes
Passport, visa, travel, accommodation, insurance, emergency-contact information and other documents required by the relevant programme.
Content and Communications
Articles, comments, artworks, images, photographs, videos, audio recordings, requests, questions, complaints and other content submitted to the Foundation.
Legal Matters
Contracts, permissions and consent records, disputes, applications, reports, incident records and official correspondence.
Purposes of Processing and Legal Bases
Personal data is processed only to the extent necessary for the following processes:
Membership and Account Management
Creating accounts, login and verification, account security, updates, suspension and termination of membership.
Applications and Participation
Applications, assessment, registration, admission, reserve lists and follow-up for scholarship, culture, arts, education, volunteering, exchange and other programmes.
Reservations and Contracts
Receiving and assessing reservation requests for Yücel Arts Center and related spaces, entering into agreements and providing the service.
Kültür Avcıları and Similar Programmes
Establishing programme status, enabling participation rights, organising activities, managing event leadership and applying programme rules.
Event Organisation
Creating participant lists, providing information, ensuring organisational safety and coordinating, where necessary and proportionate, with event leaders and responsible organisers.
Donations, Payments and Accounting
Donation and payment transactions, accruals, accounting, receipts, refunds, financial records and compliance with statutory financial obligations.
Communications and Request Management
Operational notifications relating to applications, reservations, donations, programmes and events, and responding to requests and complaints.
Information and Physical Security
Protecting accounts, information systems and premises; logging; preventing unauthorised access, fraud, spam, malware and other misuse.
Content and Publicity
Assessing and publishing user-submitted content and, where separately permitted by law and consented to where required, using photographs, videos or audio recordings for publicity.
Service Development
Measuring service quality, user experience and website performance and carrying out statistical or aggregated assessments.
Legal and Institutional Obligations
Managing official requests, audits, legal disputes, the establishment or protection of rights and institutional records.
Depending on the specific processing activity, personal data is processed on the basis of one or more of the following legal grounds:
Expressly Provided by Law - KVKK Article 5(2)(a)
Accounting, financial records, official notifications and other processing expressly required by applicable legislation.
Performance of a Contract - KVKK Article 5(2)(c)
Membership, application, reservation, programme participation, donation and payment processes.
Compliance with a Legal Obligation - KVKK Article 5(2)(ç)
Foundation, financial and other statutory obligations and lawful requests from competent authorities.
Establishment, Exercise or Protection of a Right - KVKK Article 5(2)(e)
Applications, disputes, incident records, complaints, defence and evidential processes.
Legitimate Interests - KVKK Article 5(2)(f)
Provided that fundamental rights and freedoms are not adversely affected: system and premises security, prevention of misuse, planning of activities and improvement of services.
Explicit Consent - KVKK Article 5(1)
Optional publicity uses, non-essential cookies or other processing for which no separate lawful basis is available and explicit consent is required.
Special Categories of Personal Data and Children’s Data
Health, disability, accessibility, allergy and similar special-category data is processed only where necessary for programme safety, accessibility, travel, insurance, emergency response or the provision of appropriate support.
Reports of abuse, sexual harassment or other incidents may contain information concerning health or sexual life. Such information is subject to restricted access, handled confidentially and used only for investigation, support, legal compliance or protection of rights.
Special categories of personal data are processed in accordance with an applicable condition under Article 6 of the KVKK and with appropriate technical and organisational measures. Explicit consent is obtained where no other lawful condition is available.
Children and Legal Representatives
Identity, contact, application, event, safety, health, accessibility and visual or audio data concerning participants under the age of 18 is processed only to the extent required by the relevant programme.
Where necessary, information about a parent or legal representative, permission and consent records and emergency-contact information may be obtained. Data minimisation, security and the best interests of the child are taken into account in processes involving children.
Transfers of Personal Data
Personal data may be transferred to the following categories of recipients, only where limited and proportionate to the stated purposes and in accordance with Articles 8 and 9 of the KVKK:
Public Authorities and Judicial Bodies
Public authorities legally entitled to request information, regulatory and supervisory bodies, courts, public prosecutors and enforcement authorities.
Banks and Payment Service Providers
Processing, verification, accounting and refund of donations, reservations and payments. Full payment-card details are not retained in the Foundation’s systems.
Technical Service Providers
Suppliers providing hosting, cloud, information technology, software, security, SMS, email, backup and technical-support services.
Programme, Scholarship and Event Stakeholders
Where necessary for the relevant activity: scholarship providers, project partners, educational or cultural institutions, event leaders and responsible organisers.
International Programme Stakeholders
Where necessary: host organisations, project partners, travel and accommodation providers, insurance companies, consulates and competent authorities.
Legal, Accounting and Audit Advisers
Compliance with legal obligations, financial records, audits, disputes and the protection of rights.
Publicity and Publication Channels
Where explicit consent or another lawful basis exists: websites, social-media platforms, press organisations and relevant publication-service providers.
yucelkulturvakfi.org, bursverenler.org and sanateserleri.org are operated by the Yücel Cultural Foundation. Data held on these platforms may be processed within the systems of the same data controller where necessary to provide the relevant service.
International Transfers and Technical Infrastructure
The Foundation may use internationally connected cloud and technical-infrastructure services, including Amazon Web Services (AWS), for its websites, information security, system logs and email-delivery processes. Depending on the service, communication data, IP and device information, transaction-security records, system logs and email-delivery data may be processed on systems located abroad.
International transfers are carried out in accordance with the transfer conditions and appropriate safeguards set out in Article 9 of the KVKK. Transfers are limited to the data categories necessary for the service and are subject to appropriate technical and organisational measures.
Where the technical services used by the Foundation or the relevant data flows change, this notice and the corresponding data inventory are updated.
Cookies, Electronic Communications and Visual Records
Cookies and Similar Technologies
The websites may use cookies and similar technologies to maintain sessions, protect accounts and systems, remember preferences, measure website performance and improve services.
Cookies that are not strictly necessary for providing a service are used in accordance with the applicable lawful basis and the user’s preferences. The name, provider, purpose, duration and first- or third-party status of cookies are explained in the relevant website’s cookie notice.
Operational and Promotional Communications
Operational emails and SMS messages necessary for membership, applications, reservations, donations, payments, events or programmes may be sent on the lawful basis applicable to the relevant process.
Newsletters, announcements, campaigns and promotional communications are sent only where the approvals required under the applicable electronic-communications legislation are in place. Communication preferences may be changed through the relevant channels.
Photographs, Video and Audio Recordings
Photographs, videos or audio recordings may be made during events for organisational purposes, activity records, archiving and institutional communications.
Where required by law, separate and optional explicit consent is obtained for recordings that prominently identify a person or are published on public channels for promotional purposes. Participation in an event is not made conditional on optional promotional consent.
Retention Periods, CCTV and Data Security
Personal data is retained for the period prescribed by applicable legislation or for no longer than is necessary for the purpose of processing. The nature of the data, the purpose of processing, statutory obligations, limitation periods and the need to establish, exercise or protect rights are taken into account when determining retention periods.
When the purpose and lawful basis for processing cease to exist, personal data is deleted, destroyed or anonymised in accordance with applicable law. Where a continuing dispute, official review or statutory obligation exists, the relevant records may be retained solely for that process.
CCTV Footage
Security-camera footage recorded at Yücel Arts Center and other premises used by the Foundation is, as a rule, retained for 15 days for physical-security and incident-review purposes.
Financial and Transaction Records
Donation, payment, accounting, receipt, refund and related transaction records are retained for the periods required by financial legislation and statutory obligations.
Membership, Application and Programme Records
Records are retained with regard to the continuation of the relevant account, application or programme and any dispute or statutory retention requirement.
Logs and Security Records
Records are retained for the period necessary for information security, misuse prevention, incident analysis and statutory obligations.
Visual and Audio Archives
Retention takes account of the recording purpose, permissions granted, archival value and the rights of the data subject; use ceases when the lawful basis no longer applies.
KVKK Requests and Incident Files
Files are retained for the resolution of the request or incident and within the scope of applicable statutory obligations and limitation periods.
The Foundation applies technical and organisational measures appropriate to the nature of the data, including authorisation, access restrictions, logging, backup, firewall protection, malware prevention, confidentiality obligations and service-provider controls.
Rights of Data Subjects
Under Article 11 of the KVKK, you have the following rights in relation to your personal data:
- To learn whether your personal data is being processed.
- To request information where your personal data has been processed.
- To learn the purpose of processing and whether the data is being used in accordance with that purpose.
- To know the third parties to whom your personal data has been transferred in Türkiye or abroad.
- To request correction of incomplete or inaccurate personal data.
- To request deletion or destruction of personal data under the conditions set out in Article 7 of the KVKK.
- To request notification of correction, deletion or destruction to third parties to whom the data has been transferred.
- To object to a result arising against you through analysis of processed data exclusively by automated systems.
- To request compensation where you suffer damage as a result of unlawful processing of personal data.
Application Methods, Entry into Force and Updates
- By submitting a written and signed request in person or through a notary public to Alemdar Mah. Alemdar Cad. No: 3, 34110 Sultanahmet Fatih - Istanbul, Türkiye.
- By sending a request signed with a secure electronic signature or mobile signature to info@yucelkulturvakfi.org.
- By sending a request from an email address previously notified to the Foundation and registered in the Foundation’s systems to info@yucelkulturvakfi.org.
An application should include the applicant’s name and surname, signature for written applications, Turkish identity number or, for foreign nationals, passport or identity number, an address for service, available email or telephone details for notifications and the subject of the request. Where an application is submitted by a representative, evidence of authority must be provided.
Where an application is made from an email address that is not registered in the Foundation’s systems, additional information or documents may be requested to verify identity and authority and to prevent personal data from being disclosed to an unauthorised person.
Applications are answered free of charge as soon as possible and no later than 30 days, depending on the nature of the request. Where the process involves an additional cost, a fee may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.
Entry into Force and Updates
This Privacy Notice enters into force on the date it is published on the Foundation’s website. It may be amended following changes in legislation, technical infrastructure or operational processes. The updated version becomes effective on the date of publication.