INFORMATION NOTICE ON THE PROCESSING OF STUDENTS PERSONAL DATA

1. Data Controller

Pursuant to the Personal Data Protection Law No. 6698 (“PDPL” or the “Law”), your personal data is processed by İstanbul Bilgi University (the “University”), acting as the data controller, within the scope and for the purposes explained below.

This Information Notice has been prepared to explain the fundamental principles concerning the processing of personal data belonging to prospective students who apply to the University, enrolled students, exchange students, graduates, and other relevant individuals who benefit from the University’s educational and student services.

2. Categories of Personal Data Processed

Depending on the nature of the student relationship and to the extent required for the relevant process, the following categories of personal data may be processed:

Identity Information: Name, surname, Turkish ID number, passport information, date and place of birth, nationality, and similar information.

Contact Information: Address, telephone number, e-mail address, emergency contact information, and similar information.

Student and Academic Information: Student number, faculty, school, department/program, year of study, course registrations, attendance records, examination and grade information, academic performance information, academic advising information, information relating to disciplinary proceedings, and other information concerning student status.

Education and Career Information: Previous education information, diplomas and certificates, internship information, professional experience, career applications, and information obtained within the scope of career services provided by the University.

Financial Information: Tuition fees, scholarship and discount information, payment information, bank account information, and other information required for the fulfillment of financial obligations.

Transaction Security Information: IP address, user account information, access and log records, system usage information, device and connection information, and other records necessary to ensure information security.

Physical Premises Security Information: Campus and building entry/exit records, visitor records, camera footage, and other information obtained for physical security purposes.

Visual and Audio Records: Photographs, video recordings and, where necessary, audio recordings obtained within the scope of the University’s educational activities, events, meetings, ceremonies, promotional activities, and corporate communications.

Health Information and Other Special Categories of Personal Data: Where necessary for the provision of education and training, internship processes, occupational health and safety, services for students with disabilities, healthcare services, or processes arising from applicable legislation, health information and other personal data classified as special categories of personal data under the Law may be processed.

Special categories of personal data are processed in accordance with the conditions set forth under Article 6 of the PDPL.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

3.1. Conducting Student Application and Registration Processes

Conducting application and admission processes for the University;
Completing student registration procedures;
Establishing and managing student status;
Creating and keeping student files up to date;
Conducting processes relating to transfer between higher education institutions, vertical transfer, double major, minor, exchange programs, and similar programs;
Conducting graduation and termination of student registration procedures.

3.2. Conducting Education and Training Processes

Completing course registrations;
Managing courses, examinations, and academic calendar processes;
Conducting and evaluating examinations;
Maintaining records of grades and academic performance;
Conducting academic advising processes;
Monitoring attendance;
Evaluating academic performance and educational processes;
Providing education and training services to students.

3.3. Providing Student Support Services

Providing student affairs services;
Conducting career and employment support services;
Providing psychological counseling and guidance services where the necessary legal conditions are met;
Providing support services for students with disabilities;
Managing scholarship and social support processes;
Conducting support processes relating to students’ academic and administrative needs.

3.4. Conducting Internship, Practical Training and Cooperation Processes

Conducting internship application and admission processes;
Monitoring internship and practical training processes;
Conducting necessary processes with relevant public institutions, employers, and practical training partners;
Fulfilling notifications and obligations arising from applicable legislation.

3.5. Conducting Tuition Fee, Scholarship and Financial Processes

Managing the assessment and collection of tuition fees;
Managing scholarship, discount, and financial support processes;
Carrying out payment and accounting procedures;
Fulfilling tax and other financial obligations.

3.6. Ensuring Campus and Information Security

Ensuring campus and building security;
Operating camera surveillance systems;
Controlling campus entry and exit;
Ensuring the security of information systems;
Creating and managing user accounts;
Preventing unauthorized access;
Detecting and managing information security incidents.

3.7. Student Clubs, Events and Social Activities

Conducting student club activities;
Planning and organizing events held by the University;
Conducting student activities and organizations;
Managing participation in events;
Conducting the University’s academic, cultural, and social activities.

Where membership of a student club constitutes special category personal data, the relevant data shall only be processed on the basis of an applicable legal ground permitted under Article 6 of the PDPL.

3.8. Communication and Announcement Activities

Your contact information may be used through institutional communication channels allocated to students by the University for the purpose of communicating:

educational and training announcements;
examination and course announcements;
academic and administrative information;
announcements concerning the University’s activities and student-related processes.

For communications that constitute commercial electronic communications, the requirements stipulated under the applicable legislation shall also apply separately.

3.9. Conducting Academic, Institutional and Quality Processes

The University may conduct:

academic evaluations and reporting;
quality assurance processes;
accreditation activities;
notifications and reporting required under higher education legislation;
institutional statistics and planning activities;
analyses aimed at improving educational services.

Where possible, anonymized or de-identified data shall be used for these purposes.

3.10. Promotional, Communication and Visual Content Activities

Photographs, video recordings, and audiovisual recordings of you may be taken during the University’s events, ceremonies, educational activities, social activities, promotional films, and corporate communication activities.

Where publication of such recordings in publicly accessible channels for promotional purposes requires explicit consent, separate explicit consent shall be obtained for the relevant activity in addition to this Information Notice.

4. Methods and Legal Grounds for the Collection of Personal Data

Your personal data may be collected through the following means:

Application and registration forms submitted to the University;
Student information systems;
The University’s electronic applications;
Physical and electronic documents;
Examinations, courses, and educational activities conducted by the University;
Student affairs and academic departments;
Information and documents provided directly by the student;
Information received from authorized public institutions and organizations;
Internship and practical training processes;
Camera surveillance systems and campus security systems;
Events, meetings, and organizations.

Your personal data may be collected and processed through automatic or non-automatic means based, depending on the nature of the specific processing activity, on one or more of the applicable legal grounds set forth under Article 5 of the PDPL, including:

It is expressly provided for by law;
It is necessary for the establishment or performance of a contract, provided that it is directly related to the parties to the contract;
It is necessary for the University to fulfill its legal obligation;
It has been made public by the data subject;
Processing is necessary for the establishment, exercise, or protection of a right;
Processing is necessary for the legitimate interests of the University, provided that such processing does not adversely affect the fundamental rights and freedoms of the data subject;
Where necessary, the existence of explicit consent.

With respect to special categories of personal data, the specific conditions set forth under Article 6 of the PDPL shall apply.

5. Transfer of Personal Data

Your personal data may be transferred, to the extent relevant to and limited by the purpose of processing and in accordance with the applicable legal requirements, to:

The University’s academic and administrative departments;
The University’s management and authorized employees;
The Council of Higher Education and relevant higher education institutions;
Authorized public institutions and organizations;
Relevant institutions and organizations where necessary within the scope of internship and practical training processes;
Relevant institutions involved in scholarship and social support processes;
Suppliers and service providers from which the University receives services in connection with education, information technologies, information security, archiving, consultancy, and other University services;
Legal, financial advisory, auditing, and other professional service providers;
Private-law entities authorized by law.

Such transfers shall be carried out in accordance with the conditions stipulated under Article 8 of the PDPL.

Where your personal data needs to be transferred to individuals or organizations located outside Türkiye, such transfers shall be carried out in accordance with the conditions set forth under Article 9 of the PDPL.

For international transfers of personal data, the applicable mechanism under the Law—including an adequacy decision, appropriate safeguards, or an applicable exceptional transfer condition stipulated by the Law—shall be relied upon, as applicable to the specific circumstances.

6. Retention Period of Personal Data

Your personal data shall be retained for the periods required by higher education legislation, financial and legal legislation, other legal obligations to which the University is subject, the continuation of the student relationship, and the relevant processing purpose.

In determining retention periods, the University’s Personal Data Retention and Destruction Policy and the applicable provisions of relevant legislation shall be taken into consideration.

Once the purpose of processing ceases to exist and the applicable statutory retention period expires, your personal data shall be deleted, destroyed, or anonymized in accordance with the PDPL and applicable legislation.

7. Security of Personal Data

The University takes appropriate technical and administrative measures in accordance with the nature of the personal data processed and the relevant risks in order to prevent the unlawful processing of and unauthorized access to personal data and to ensure that personal data is securely maintained.

8. Website, Social Media and Publicly Accessible Sharing

The publication of students’ personal data on the University’s website or social media accounts constitutes a separate personal data processing activity.

Accordingly, the public disclosure or publication of a student’s name and surname, photograph, video, academic achievement information, event footage, student work, or similar personal data shall be carried out in accordance with the relevant provisions of the PDPL, depending on the nature of the processing activity.

Where publication for promotional purposes requires explicit consent, separate explicit consent shall be obtained in addition to this Information Notice.

9. Your Rights Under Article 11 of the PDPL

Pursuant to Article 11 of the PDPL, you have the right to:

Learn whether your personal data has been processed;
Request information regarding the processing of your personal data if it has been processed;
Learn the purpose of processing your personal data and whether it has been used in accordance with that purpose;
Know the third parties, whether in Türkiye or abroad, to whom your personal data has been transferred;
Request the correction of your personal data if it has been processed incompletely or inaccurately;
Request the deletion or destruction of your personal data under the conditions stipulated in Article 7 of the PDPL;
Request that the correction, deletion, or destruction of your personal data be notified to third parties to whom the data has been transferred;
Object to a result arising against you as a result of the analysis of your personal data exclusively by automated systems;
Request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

10. Application Procedure

You may submit your requests under the PDPL to İstanbul Bilgi University in accordance with the application procedures stipulated under the applicable legislation.

Your applications shall be concluded as soon as possible depending on the nature of the request and, in any event, within thirty days at the latest.

Where the processing of a request requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

Application and Contact E-mail Address: info@bilgi.edu.tr

İstanbul Bilgi University Personal Data Protection and Privacy Unit

Effective Date: […../……./………]

Update Date: […../……./………]

Document No./Version: […………………]