Policy on the Processing and Protection of Personal Data
This policy explains the principles, purposes and security measures applied by Rüya Preschool when processing personal data under Turkish Personal Data Protection Law No. 6698 (KVKK) and related regulations. The school carries out data processing, use, retention, transfer and destruction in accordance with defined procedures.
1. Purpose and Scope
The policy covers natural persons whose personal data is processed in connection with school activities, including parents and students, prospective parents and students, employees and candidates, visitors, business/solution partners and contractors. It aims to inform data subjects about the data processed, processing conditions, transfers, retention and destruction processes, and their rights.
2. Key Concepts
Any information relating to an identified or identifiable natural person.
Data categories considered sensitive by law, including health, biometric and genetic information.
The natural or legal person who determines the purposes and means of processing personal data.
Consent given freely, based on information and for a specific matter.
3. Core Principles of Personal Data Processing
- Processing lawfully and fairly.
- Keeping data accurate and, where necessary, up to date.
- Processing for specified, explicit and legitimate purposes.
- Ensuring processing is relevant, limited and proportionate to its purpose.
- Retaining data only for the period required by law or by the processing purpose.
4. Conditions for Processing
General personal data may be processed where explicit consent exists or another legal basis under KVKK applies, such as legal requirement, establishment/performance of a contract, compliance with a legal obligation, establishment/protection of a right or legitimate interest. Additional safeguards required by applicable law and the Personal Data Protection Board are applied to sensitive personal data.
5. Categories of Data Processed
Depending on school activities, processed data may include identity and contact information, student/parent registration data, employee personnel and education data, bank/payment information, visitor records and, when necessary, sensitive data such as health information. Each processing activity is limited to what is necessary for its purpose.
6. Purposes of Processing
- Providing education and school services and maintaining communication with parents and students.
- Managing contractual, financial and legal processes.
- Ensuring occupational health and safety, school/student safety and physical premises security.
- Managing employee and candidate processes.
- Improving service quality and carrying out institutional events and social activities.
- Fulfilling legal obligations and responding to lawful requests from competent authorities.
7. Data Security
Rüya Preschool takes administrative and technical measures against unauthorized access, data loss and unauthorized alteration. Measures may include access restrictions, logging, firewalls and current security software, backups, encryption, staff awareness training and confidentiality obligations for data processors.
8. Domestic / International Transfers
Personal data may be shared with authorized public institutions, business partners, suppliers and service providers for purposes such as fulfilling legal obligations, operating school activities and using service systems, provided legal conditions are met. International transfers are carried out in accordance with KVKK transfer requirements and security obligations.
9. Retention and Destruction
Data is retained for the period required by applicable law or the processing purpose. When processing conditions cease to apply or the retention period expires, data is deleted, destroyed or anonymized using the appropriate method. Records of destruction activities are retained as required by law.
10. Rights of Data Subjects
Under Article 11 of KVKK, data subjects may ask whether their personal data is processed, request information if it is, learn the purpose of processing and recipients, request correction of inaccurate/incomplete data, request deletion or destruction where conditions are met, object to results produced solely through automated analysis, and seek compensation for damage caused by unlawful processing.
11. Application and Contact
Requests under KVKK may be submitted to Rüya Preschool in a manner that allows identity verification. Applications are evaluated within the time limits set by applicable law according to the nature of the request.