Data Privacy Statement (KVKK)

1. Data Controller

In accordance with the Law on the Protection of Personal Data No. 6698 ("Law"), your personal data; may be processed by ID CERT Certification and Training Services ("Company") as the data controller within the scope explained below. Our company shows maximum sensitivity regarding ensuring the security of your data and processing it in accordance with the law.

2. Purpose of Processing Personal Data

Your collected personal data is processed for the following purposes:

• Service Provision: Execution of certification, training, and consulting services.
• Communication: Contacting you, managing proposal processes, and providing customer support services.
• Legal Compliance: Fulfilling obligations arising from relevant legislation (Invoicing, official notifications, etc.).
• Marketing (With Consent): Informing about new services and campaigns if you have explicit consent.

3. Transfer of Processed Personal Data

Your personal data; in line with the realization of the purposes specified above, may be transferred to legally authorized public institutions (e.g., Revenue Administration), suppliers we cooperate with to provide our services (IT support, financial advisor), and the relevant certification authority required by accreditation processes, within the framework of Articles 8 and 9 of the Law.

4. Method and Legal Reason for Data Collection

Your personal data is collected via application forms on our website, email, phone calls, or face-to-face meetings. These data are processed based on the legal reasons of "Establishment or performance of a contract", "Legal obligation of the data controller", and "Legitimate interest provided that it does not harm the fundamental rights of the data subject".

5. Rights of the Personal Data Owner

As data owners under Article 11 of the Law, you have the following rights:

• To learn whether personal data is processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used appropriately,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction if personal data is incomplete or incorrectly processed and to request deletion.