Data Privacy

YEREBATAN CISTERN MUSEUM PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

Dear event participants,

This Privacy Notice has been prepared by our organization in its capacity as the data controller, in accordance with Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information, for the purpose of informing you regarding the processing of your personal data.

We exercise the utmost care and diligence in processing your personal data in accordance with the law.

We process your personal data only based on the legal grounds specified in the law (Articles 5 and 6 of the KVKK) and in compliance with the principles set forth below (Article 4 of the KVKK):

Compliance with the law and principles of good faith
Accuracy and, where necessary, timeliness
Processing for specific, explicit, and legitimate purposes
Processing that is relevant, limited, and proportionate to the purposes for which they are processed
Retention for the period prescribed by the applicable legislation or as necessary for the purpose of processing

In addition, we take all necessary technical and organizational measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data, prevent unauthorized access, and ensure its protection.

Detailed information is provided under the specific headings within this Privacy Notice.

IDENTITY OF THE DATA CONTROLLER
Data Controller: 1048 Vakıf Enerji A.Ş.
MERSIS No: 0001215289500001
Address: Ümit Mahallesi 2480 Cadde Kafkas No:14 Çankaya/Ankara/TÜRKİYE
Email Address: sarnickvkk@1048vakifenerji.com.tr
Registered Electronic Mail (KEP) Address: 1048vakifenerji@hs01.kep.tr
Phone Number:+90 312 240 10 48
Website: www.yerebatansarnici.gov.tr
METHODS OF PERSONAL DATA COLLECTION
Your personal data is collected through written channels, phone calls, our website, email, social media accounts, instant messaging applications, computers, and other smart devices.
CATEGORIES OF PERSONAL DATA PROCESSED
The personal data we process is categorized and listed below:
- Identity: Name, surname, national ID number
- Contact: Email address, mailing address, phone number, social media contact information
- Customer Transactions: Invoices, order information, request/complaint information
- Legal Proceedings: Information originating from correspondence with judicial authorities, information within lawsuit files
- Finance: Bank/credit card information, IBAN, bank account number
- Physical Premises Security: Entry and exit log records
- Transaction Security: IP address information, website log-in and log-out records (traffic data)

PURPOSES OF AND LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

ACTIVITY	CATEGORIES OF PERSONAL DATA PROCESSED	PURPOSE OF PROCESSING	LEGAL BASIS
Sales of Goods and Services	Identity, Contact, Finance	Execution of Goods and Services Sales Processes	It is expressly provided for by the laws (Article 5/2/a of the KVKK) Establishment or performance of a contract (Article 5/2/c of the KVKK) Compliance with a legal obligation (Article 5/2/ç of the KVKK)
Execution of Request and Complaint Management Processes, and Follow-up of Legal Matters	Identity,Contact,Customer Transactions,Finance,Legal Proceedings	Follow-up and Execution of Legal Matters Providing Information to Authorized Institutions and Organizations	It is expressly provided for by law (Art. 5/2/a of the KVKK) Establishment or performance of a contract (Art. 5/2/c of the KVKK) Compliance with a legal obligation (Art. 5/2/ç of the KVKK) Mandatory for the establishment, exercise, or protection of a right (Art. 5/2/e of the KVKK) Legitimate interests of the data controller (Art. 5/2/f of the KVKK)
Execution of Information Security Processes	transaction security	Implementation of information security processes	It is expressly provided for by law (Art. 5/2/a of the KVKK) Compliance with a legal obligation (Art. 5/2/ç of the KVKK) Legitimate interests of the data controller (Art. 5/2/f of the KVKK)
Execution of Finance and Accounting Affairs	Identity, Contact, Finance, Customer	Management of Finance and Accounting Affairs	It is expressly provided for by law (Art. 5/2/a of the KVKK) Establishment or performance of a contract (Art. 5/2/c of the KVKK) Compliance with a legal obligation (Art. 5/2/ç of the KVKK)
Execution of Physical Premises Security Processes	Identity, Physical Premises Security	Execution of Physical Premises Security Processes	It is expressly provided for by law (Art. 5/2/a of the KVKK) Establishment or performance of a contract (Art. 5/2/c of the KVKK) Compliance with a legal obligation (Art. 5/2/ç of the KVKK)

RECIPIENTS, PURPOSES, AND LEGAL BASES OF PERSONAL DATA TRANSFERS
We may transfer your personal data to individuals, institutions, and organizations acting in the capacity of data controllers or data processors, in accordance with the relevant legislation, for the purposes of providing our products and services to you, enabling the exercise of your legal rights, defending our legal rights, and fulfilling our obligations arising from legal regulations. Such transfers are conducted within the framework of the following legal bases: it is expressly provided for by the laws (Article 5/2/a of the KVKK), the establishment or performance of a contract (Article 5/2/c of the KVKK), and compliance with a legal obligation (Article 5/2/ç of the KVKK).
RIGHTS OF THE DATA SUBJECT AS SET FORTH IN ARTICLE 11 OF THE KVKK
You may submit your requests regarding your rights specified in Article 11 of the KVKK in accordance with the provisions of the Communiqué on the Procedures and Principles for Applications to the Data Controller, using the contact channels provided in the “IDENTITY OF THE DATA CONTROLLER” section of this Privacy Notice.
If your application is in writing, you may deliver it in person (by hand) or submit it through a notary public, via secure electronic signature, mobile signature, Registered Electronic Mail (KEP) address, or via the email address previously notified to us and registered in our systems. To facilitate your request, you may also use the Data Subject Application Form prepared by our organization in accordance with Article 13 of the KVKK and the relevant Communiqué.