Privacy notice on the protection of personal data

Under Law No. 6698 on the Protection of Personal Data, the data controller is Ankara University. This site and its panels are operated as part of the activities of Ankara University TEKMER (Technology Development Centre), which is part of Ankara University.

The table is based on the fields the system actually collects.

The processing activities listed in the table above rely on the following legal grounds set out in Article 5 of the Law.

• Performance of a contract (Article 5/2-c) — company accounts, space bookings, event registrations and companies submitting their own news. These are necessary to establish and carry out the relationship between the centre and the venture.
• Compliance with a legal obligation of the data controller (Article 5/2-ç) — record-keeping, reporting and information duties arising from legislation.
• Legitimate interests (Article 5/2-f) — information security and the prevention of abuse. The rate limiting that blocks repeated attempts against the forms and the sign-in relies on this ground; it does not store the IP address itself, only an irreversible digest of it. This ground is relied on provided that it does not harm the fundamental rights and freedoms of the data subject.
• Explicit consent (Article 5/1) — the consent box you tick before submitting the application or quick contact form. The version of the notice consented to and the time of consent are stored with the record. You can withdraw your consent through the application routes below.

Your personal data may be transferred only for the purposes listed in the table above and in line with the conditions in Article 8 of the Law.

• Authorised public institutions and bodies — where there is an obligation arising from legislation or where a duly made request is received, limited to the scope of that request. In relation to entrepreneurship support, this includes KOSGEB.
• Service providers — the hosting (server) and email delivery providers used to run the site and its panels. These providers process personal data only to the extent the service requires and on the instructions of the data controller.

Beyond these two headings your personal data is not shared with third parties; it is not sold and is not transferred for marketing purposes.

The servers that host the site and the servers of the providers used to deliver email may be located abroad. In that case your personal data is transferred abroad to the extent needed to provide the service.

Any such transfer is made within the framework of Article 9 of the Law: transfer to countries for which the Personal Data Protection Board has issued an adequacy decision; where there is no adequacy decision, one of the appropriate safeguards listed in Article 9; and failing those, one of the exceptional cases likewise listed in Article 9. Because the set of providers can change over time, this notice does not commit to a single mechanism; you can find out which country a transfer is made to and which safeguard it relies on through the application routes below.

Personal data is collected electronically and directly from the data subject through the application and quick contact forms on the site and through the company panel. Before a record is created, the forms ask for confirmation that the privacy notice has been read; the version of the notice and the time of confirmation are stored with the record.

Under Article 11 of the Law, by applying to the data controller you have the following rights in respect of yourself.

• To learn whether your personal data is being processed.
• To request information about it if your personal data has been processed.
• To learn the purpose of the processing and whether your data is used in line with that purpose.
• To know the third parties, in Türkiye or abroad, to whom your personal data is transferred.
• To request that your personal data be corrected if it has been processed incompletely or inaccurately.
• To request the erasure or destruction of your personal data within the conditions set out in Article 7 of the Law.
• To request that correction, erasure and destruction be notified to the third parties to whom your personal data has been transferred.
• To object to a result against you that arises from the analysis of your data exclusively by automated systems.
• To claim compensation for damage you suffer because your personal data has been processed unlawfully.

To exercise these rights, apply to the data controller through the contact channels given in the “Data controller” section above.

Your request must state your name and surname and, if it is in writing, carry your signature; your Turkish identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or identity number if you are a foreign national; your residential or business address for service; your email address, telephone and fax number for notification, if any; and the subject of your request. These are the minimum details required by the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ); attaching the related information and documents will speed up the assessment.

Your request is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the process incurs an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is refused, if you find the response insufficient, or if no response is given in time, you can lodge a complaint with the Personal Data Protection Board.

The periods below are proposals and become final after the institution approves them. Automatic deletion of expired records is not active yet.