Privacy Notice (KVKK)

Data controller

Your personal data is processed by the Yiğit Sezer Education and Health Foundation (Çankaya Tax Office, tax no. 980 108 8858) as data controller. Address: Kızılırmak Mah., Dumlupınar Bulvarı No: 9A, YDA Center A2 Blok No: 731, 06510 Çankaya/Ankara, Türkiye. Email: info@yigitsezervakfi.org.

Scholarship applications

The scholarship application form collects:

• Identity: first name, surname, date of birth; optionally gender.
• Contact: mobile phone, email and district of residence; for high school students, the parent's or guardian's name and phone number.
• Education: school or university, department, year, grade point average, LGS score or YKS ranking.
• Family and financial situation: whether the parents are alive and their employment, household size, monthly net household income, housing, and any other scholarship received.
• Siblings: age and education only (we do not ask for siblings' names).
• Your personal statement and how you heard about us.
• Optional, and only with your explicit consent: health or disability information about you or your family.

We use this information to assess your application, inform you of the result, establish the scholarship relationship and prevent false or duplicate applications. Legal bases: necessity for entering into a contract (KVKK art. 5/2-c), our legal obligations under foundation law (art. 5/2-ç) and our legitimate interest in ensuring scholarships reach the right people (art. 5/2-f). Health information is special category data and is processed only with your explicit consent (art. 6/2). Turkish ID numbers, photos, full address, student certificates and bank details are not requested in the form; they are collected only from shortlisted candidates at the document stage, with a separate notice. Our scholarship holders are never identified publicly on the website, on social media or in reports.

Applicants under 18

Most high school applicants are under 18. We therefore ask for the parent's or guardian's name and phone number, and ask the student to confirm that they apply with their parent's knowledge and permission. Where necessary we verify the application with the parent. For applicants under 18, explicit consent for health information is given together with a parent. We use children's photos in our work only with parental or school permission and never in a way that reveals their identity.

Contact form and email

The contact form collects your name, email, optionally your phone number, the subject and your message. We use them only to reply to you and resolve your request, based on necessity for handling your request (art. 5/2-c) and our legitimate interest (art. 5/2-f). Please do not include sensitive information such as Turkish ID numbers or health details in your message.

Donations

For bank transfers we process the sender name, IBAN, amount and description provided by the bank; for online card donations, your name, email, amount and order number. Card number, expiry date and security code never reach our servers; they are entered only on Garanti BBVA's 3D Secure payment page. We use this information to record your donation, issue a receipt and meet our record-keeping obligations under foundation and tax law (art. 5/2-c and 5/2-ç). When you are redirected to the bank, your name, email, amount and order number are emailed to the foundation for the receipt; records of attempts the bank does not approve are deleted within 30 days.

Website security

To protect our forms from abuse, your IP address, browser information and request time are processed briefly. Bot verification is performed with Cloudflare Turnstile. To limit excessive requests we do not store your IP address; we keep only an irreversible hash of it for at most one hour. The legal basis is our legitimate interest in keeping the site and its visitors secure (art. 5/2-f). For cookies, see the Privacy and Cookie Policy.

Who we share your data with

We never sell your personal data or share it for advertising or marketing. We transfer it only as far as necessary and only for the stated purposes to:

• Competent public authorities (e.g. the General Directorate of Foundations, tax offices, courts): under our legal obligations, upon request.
• Garanti BBVA: to process online card donations.
• Our infrastructure providers: website hosting (Vercel Inc.), security, bot verification and email forwarding (Cloudflare Inc.), delivery of form notifications by email (Resend), our mailbox (Google LLC) and the rate-limit counter (Upstash Inc.). These providers process data only on our behalf and on our instructions.

Transfers abroad

The servers of the infrastructure providers listed above are located outside Türkiye (mainly in the United States and the European Union), so the information you submit through our forms is transferred abroad. We carry out these transfers under KVKK art. 9 by signing the standard contracts published by the Personal Data Protection Board with the providers and notifying the Authority within five business days of signing.

How long we keep your data

We keep your data only as long as the purpose requires, then delete, destroy or anonymise it in line with our Retention and Destruction Policy:

• Applications that do not receive a scholarship: 6 months from the announcement of results.
• Scholarship holders: for the duration of the scholarship and afterwards for the period required by foundation and tax law (up to 10 years).
• Donation records: for the period required by tax and foundation law (up to 10 years).
• Card donation attempts not approved by the bank: 30 days.
• Contact form correspondence: 2 years after the request is resolved.
• The scholarship form draft on your device: deleted when you submit, when you clear it, or automatically after 7 days at the latest.
• The IP hash in the rate-limit counter: at most 1 hour.

Explicit consent for health information

Sharing health or disability information about you or your family in the scholarship form is entirely optional. If you do not share it, your application is still assessed in full. If you choose to share it, ticking the consent box means you agree that this information is processed only to be taken into account in the scholarship assessment, only by the foundation officials carrying out the assessment, and transferred abroad through the infrastructure providers listed above. If you are under 18 you must give this consent together with your parent. You can withdraw your consent at any time by writing to info@yigitsezervakfi.org; the information is then removed from the assessment and deleted.

Your rights

Under KVKK art. 11 you may apply to us to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties in Türkiye or abroad to whom it is transferred.
• Request correction of incomplete or inaccurate data, and deletion or destruction where the conditions of KVKK art. 7 are met, and request that these actions be notified to recipients.
• Object to an adverse outcome resulting solely from automated analysis.
• Claim compensation for damage arising from unlawful processing.

How to contact us

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request with information that allows us to verify your identity: by signed letter to our address above, via registered electronic mail (KEP) or secure electronic signature, or from an email address you have previously given us and that is registered in our records, to info@yigitsezervakfi.org. We respond free of charge within 30 days at the latest. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Board (KVKK art. 14).