Text on Processing of Personal Data

DISCLOSURE TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

At NONA ACADEMY, we want you to know that we have taken all legal, technical, and administrative measures to protect your privacy within the scope of collecting, processing, transferring, deleting, destroying, or anonymizing your personal data and/or special categories of personal data in accordance with the Law on the Protection of Personal Data (KVKK) No. 6698. We wish to inform you about the purpose for which your personal data and/or special categories of personal data will be processed, to whom and for what purpose they will be transferred, the method of data processing, the legal grounds, and your rights.

1. Data Controller In accordance with the Law on the Protection of Personal Data No. 6698, your personal data and/or special categories of personal data may be recorded, stored, processed, classified, updated, and disclosed/transferred to third parties, within the scope explained below, by NONA ACADEMY as the "Data Controller" in a manner consistent with the law and good faith, and only to the extent permitted by law and/or for the purposes for which they are processed.

2. Collection, Processing, and Processing Purposes of Personal Data Your personal data and/or special categories of personal data may vary depending on your relationship with NONA ACADEMY. They may be collected and processed verbally, in writing, or electronically, through automatic or non-automatic methods, via all units of the COMPANY, corporate email, corporate portal, corporate website, social media channels, mobile applications, and similar means. Your personal data and/or special categories of personal data may be processed and transferred based on the information you have confirmed within the scope of your relationship with the COMPANY.

To research and develop our services and your personal preferences related to them, to contact you via the communication channels you have directly shared with us, to inform you about educational activities, to conduct promotions/advertisements/announcements/meetings/conferences/events/courses/development programs/exhibitions, to carry out projects where the COMPANY is the executor or a stakeholder, to ensure the efficiency and service quality of your registration with the COMPANY, to implement the COMPANY's privacy policies, to manage and develop the COMPANY's business and academic processes, and to benefit from these services within the scope of educational activities;

Depending on your relationship with NONA ACADEMY, as a student/employee/visitor/student's family/third party, the personal data and/or special categories of personal data collected, including your identity information, contact information, education and professional information, photographs, health information, scholarship information, family information, financial information, SGK (Social Security Institution) information, CV information, residence information, internet access information obtained using the COMPANY's network, and entry-exit information to the COMPANY, may be collected, processed, updated, transferred, and anonymized for the purposes explained below:

2.1. Preparation of printed and/or non-printed materials such as booklets, brochures, magazines, emails for the promotion, advertisement, and announcement of our COMPANY's goals, activities, education, meetings, and events. 2.2. Fulfillment of all obligations determined by education-related legislation and the Ministry of National Education, and the provision of rights and obligations arising from educational activities within the scope of the COMPANY's regulations, directives, and internal rules. 2.3. Continuation of educational activities, improvement of service quality, ensuring service continuity, and carrying out listings, reporting, verification, analysis, and evaluations to reduce costs and workload, producing statistical and scientific information, conducting measurement and evaluation and success tracking, and organizing and announcing events, courses, development programs, and conferences both inside and outside the COMPANY. 2.4. Ensuring the protection and fulfillment of the rights and obligations of students and trainees studying within the COMPANY's units or at external institutions. 2.5. Informing and promoting about the areas of work needed for the COMPANY's educational and training activities to ensure the continuation of the educational and/or business relationship with former trainees and students, and to submit offers. 2.6. Protecting the life and property of the personnel working within the COMPANY, visitors, trainees, students, parents, and third parties, including compliance with rules in this regard; fulfilling legal obligations, ensuring the continuity of the educational service, meeting the requirements or requests of judicial bodies or authorized administrative bodies, transferring information to IT infrastructures to achieve these purposes by taking necessary security and legal measures, and archiving it in electronic or physical environments to fulfill legal obligations. 2.7. Within the scope of the business processes created in line with the COMPANY's business strategies: determining and implementing commercial and business strategies, managing internal system and application operations, financial operations, purchasing operations, legal operations, commercial and legal evaluation processes, legal and commercial risk analysis, legal compliance process, management of financial affairs, communication, market research, and social responsibility activities. 2.8. Within the scope of the COMPANY's Human Resources policies: managing its operations in line with the COMPANY's Human Resources policies, supplying personnel for open positions, fulfilling obligations and taking necessary precautions within the framework of the Labor Law, Social Security Law, relevant legal regulations governing working life, and occupational health and safety. 2.9. Fulfilling rights and obligations arising from contracts with all real and legal persons and their affiliates with whom the COMPANY has a contractual relationship. 2.10. Use of information technology services provided by the COMPANY (corporate email, corporate portal, corporate wireless network, corporate internet, online education, etc.).

3. To Whom and for What Purpose Processed Personal Data May Be Transferred Your processed personal data and/or special categories of personal data—including your identity information, contact information, location information, education and professional information, photographs, health information, scholarship information, family information, financial information, SGK information, CV information, internet access information obtained using the COMPANY network, customer information, transaction security information, marketing information, information on race and ethnic origin, religious information, criminal record information, fingerprint information, and course entry-exit information—may be transferred to the founder, authorities such as the Ministry of National Education, Social Security Institution, Ministry of Finance, and legally authorized public institutions like judicial authorities, ministries, consultants, organizations, parties with whom it cooperates, contracted institutions, and payment systems organizations, to continue the education-training activities provided by NONA ACADEMY, to plan educational policies and processes, to carry out educational activities, to manage administrative and academic processes to ensure the continuity of the COMPANY's services, to ensure the legal and commercial security of the COMPANY and real or legal persons with whom the COMPANY has a business relationship, to ensure physical security and control inside and around the educational center and buildings, to carry out legal compliance processes, to perform financial affairs, and to determine and implement commercial and business strategies, all within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698.

4. Method and Legal Ground for Collecting Personal Data Your personal data and/or special categories of personal data may vary depending on your relationship with our COMPANY. They may be collected, processed, and transferred for the purpose of enabling the COMPANY to provide its services and to fully and accurately fulfill its responsibilities arising from internal regulations (regulations, directives, policies, and procedures), contracts, and the law, within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law, through all verbal, written, or electronic means, directly or indirectly, for the purposes stated above.

5. Obligations of the Data Controller

5.1. Obligation to Inform The Data Controller and/or other authorized persons must provide information to the data subjects whose data are processed regarding the collected personal data and/or special categories of personal data, within the scope of the following:

• The identity of the data controller and, if any, their representative,

• The purpose for which personal data will be processed,

• To whom and for what purpose personal data may be transferred,

• The method and legal ground for collecting personal data,

• The other rights of the data subject listed in Article 11 of the Law.

• The obligation to inform can be fulfilled by the data controller and/or the authorized person using a physical or electronic medium such as verbal communication, writing, sound recording, or a call center.

5.2. Obligations Regarding Data Security In accordance with Article 12 of the Law on the Protection of Personal Data No. 6698, the obligations of NONA ACADEMY, as the data controller, regarding data security are as follows:

• To take all necessary technical and administrative measures to prevent the unlawful processing of personal data,

• To prevent unlawful access to personal data,

• To ensure the protection of personal data by providing an appropriate level of security,

• To carry out or have carried out the necessary audits to ensure the implementation of the provisions of this Law within its own institution or organization,

• To notify the data subject and the Board as soon as possible if the processed personal data is obtained by others through unlawful means.

• Data controllers and their authorized persons cannot disclose the personal data they learn to anyone else in violation of the provisions of this Law, nor can they use it for purposes other than the processing purpose. This obligation continues even after they leave their position.

5.3. Deletion, Destruction, or Anonymization of Personal Data Even if personal data has been processed in accordance with Law No. 6698 and other relevant legal provisions, if the reasons for processing cease to exist, the personal data will be deleted, destroyed, or anonymized by the data controller, either ex officio or upon the request of the data subject.

6. Rights of the Personal Data Subject under the KVKK As personal data subjects, if you submit your requests regarding your rights under the Law on the Protection of Personal Data No. 6698 to the COMPANY using the procedures and methods set out below, the COMPANY will finalize the request free of charge within a maximum of thirty (30) days, depending on the nature of the request. However, if the process requires an additional cost, a fee may be charged according to the tariff determined by the Board. In this context, personal data subjects, in accordance with Article 11 of the Law on the Protection of Personal Data No. 6698, have the right to:

6.1. Learn whether personal data is being processed, 6.2. Request information if their personal data has been processed, 6.3. Learn the purpose of the processing of personal data and whether it is used for its intended purpose, 6.4. Know the third parties to whom personal data is transferred at home or abroad, 6.5. Request the correction of incomplete or incorrectly processed personal data and request that the transactions made be notified to third parties to whom personal data has been transferred, 6.6. Request the deletion or destruction of personal data if the reasons for its processing have ceased to exist, even though it was processed in accordance with the Law and other relevant legal provisions, and request that the transactions made be notified to third parties to whom personal data has been transferred, 6.7. Object to a result against the person themselves arising from the analysis of the processed data exclusively through automated systems, 6.8. Demand compensation for damages in case of suffering a loss due to the unlawful processing of personal data.

The channels and procedures for submitting your applications under Article 11 of the Law on the Protection of Personal Data No. 6698 are explained below.

The following information is mandatory for applications to be made by personal data subjects:

• Name, surname, and signature if the application is in writing,

• For Turkish citizens, T.R. identity number; for foreigners, nationality, passport number, or identity number if any,

• Address of residence or workplace for notification purposes,

• E-mail address, phone, and fax number for notification purposes, if any,

• Subject of the request.

In accordance with Article 13, paragraph 1 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your request, which includes your explanations for the right you wish to exercise, in writing or in person with your identity information to the address "NONA ACADEMY Çınarlı Mah. 1572 Sokak No:33 PK.35170 Konak, İzmir, Türkiye" or via the e-mail address "hello@nona.academy" belonging to our Institution, or by other methods specified in the Law on the Protection of Personal Data No. 6698.