ISTANBUL FOUNDATION FOR CULTURE AND ARTS POLICY ON THE
PROTECTION AND PROCESSING OF PERSONAL DATA
Version 0.3
03/02/2022
1. INTRODUCTION
1.1 Purpose and Scope of the Policy
The Law numbered 6698 (“Law”) on the Protection of Personal Data has been enacted on April
7th, 2016. This İKSV Policy (“Policy”) on the Protection and Processing of Personal Data aims
to establish the principles to be observed, for İstanbul Kültür ve Sanat
Vakfı (“İKSV” or “Foundation”), and its affiliated commercial enterprise İstanbul Kültür ve
Sanat Vakfı Tur. Paz. Org. İktisadi İşletmesi (“İKSV”), for fulfilling the obligations relating to
the protection and processing of personal data, and to inform data subjects whose personal data
shall be processed. This Policy introduces the conditions and the main principles adopted byİKSV for the processing of personal data. In this regard, the Policy covers all the data processing
activities of İKSV, all the personal data, and all the data subjects whose data İKSV processes,
within the scope of the Law.
Regarding the processing of personal data of Foundation employees are regulated separately in
the Istanbul Foundation For Culture And Arts Employees Policy On The Protection And
Processing Of Personal Data.
1.2. Enforcement and Amendment
This Policy is approved previously by İKSV and has been published on the website as of
03/02/2022. İKSV reserves the right to amend this Policy in line with the legal regulations. The
current version of the Policy can be accessed on the Foundation website atwww.iksv.org/tr/footer-menu/personal-data-protection-and-processing-policy.
In case of conflict with the legislation in force, especially the Law, and the regulations in thisPolicy, the provisions of the current legislation shall apply.
2. DATA SUBJECTS WHOSE PERSONAL DATA ARE PROCESSED BY OURFOUNDATION, PURPOSES OF PROCESSING PERSONAL DATA, VARIOUS
CATEGORIES OF PROCESSED PERSONAL DATA, METHODS/CHANNELS ANDLEGAL PURPOSES OF COLLECTING PERSONAL DATA
2.1. Data Subjects
Data subjects covered by this Policy are natural persons, other than İKSV employees, whose
personal data are processed by İKSV. Within this framework, various data subject categories
are as follows:DATA
SUBJECT
CATEGORIESDEFINITION

1

Participant

A natural person who attends an event held by İKSV.

Guest

Real persons who benefit from the services offered by the Foundation without
being a member.

Voluntary

A natural person who voluntarily take part in the conduct of the Foundation's
activities

4

Donor

Natural persons who donate in order to contribute to the execution of thefoundation's activities

5

Visitor

A natural person who visits İKSV’s buildings, facilities, premises and website.

6

Job Candidate

A natural person who applies for a position in İKSV by sending a CV or byother means.

7

Refers to the board of directors of the Foundation and other authorized realFoundation Official persons.

2

3

DATA
SUBJECT
CATEGORIESDEFINITION

8Collaborating
Institution/Supplier A real person who work in institutions which the Foundation has all kinds of
Employees,
business relations, (eg supplier, business/solution partner, subcontractor, etc.),
Shareholders
or who are shareholders or officials of these institutions and who are shareholders
Authorities
or officials of these institutions.

9

Refers to the other natural persons who are the subject of the Foundation's
personal data processing activities, excluding the above categories of data
subjects and the employees of the Foundation.

Third Parties

2.2. Purposes of Processing Personal DataYour personal data and special category personal data can be processed by İKSV forthe following purposes in compliance with the conditions of personal data processing
specified by the Law and the relevant legislation:

MAIN PURPOSESSUB PURPOSES

Execution of human resources
1. Execution of personnel procurement processes
processes

Carrying out the necessary 1. Conducting business activities
studies for the realization of 2. Creation and management of information technology infrastructure
theactivitiesofthe 3. Execution of information security processes
Foundation and executing the 4. Event managementbusiness processes
5. Execution of corporate communication activities

MAIN PURPOSESSUB PURPOSES

6. Follow-up of finance and accounting works

Ensuring the legal, technical 1. Carrying out the necessary operational activities in order to carry out theand commercial-occupational activities in accordance with the procedures and relevant legislation
safety of the Foundation and 2. Ensuring the security of the campus and facilities
those who have a business 3. Follow-up of legal affairs
relationshipwiththe 4. Creation and tracking of visitor records
Foundation
5. Execution of audit activities

Planning and execution of
1. Management of relations with business partners and suppliers
corporate strategies

1. Execution of sales processes of products and services
Execution of activities related
2. Execution of marketing processes of products and services
tothepromotion
and
3. Carrying out customer/member satisfaction activities
marketingofcompany
4. Carrying out the processes of creating and increasing constancy to the
products and services
products and services offered

2.3. Categories of Personal DataYour personal data categorized as follows shall be processed by İKSV in line with theconditions of personal data processing specified by the Law and the relevant legislation:PERSONAL
CATEGORYDATA

DEFINITION

Identification

All information concerning a data subject’s identity available on documents likedrivers’ license, identification card, certificate of residence, passport, marriage
certificate

Contact Information

Information such as phone number, address and e-mail to communicate with adata subject

Information about the family members and relatives of the data subject, which is
Family Members and processed in order to protect the legal interests of the Foundation and the data
subject, related to the products and services we offer.
Relative Informatiom

Information about the
Security of Physical Video recordings and finger print records taken at the entry point or inside theVenuephysical venues, and personal data related to these documents

Personal data processed concerning any information, document and records thatshows any type of financial result produced depending on the type of legal
Financial Information relationship between the Foundation and the data subject

Job
Candidate Personal data processed concerning a person that applied for a position in the
Information
Foundation, or has been evaluated as a job candidate for the sake of customaryPERSONAL
CATEGORYDATA

DEFINITION

practices or good faith, in line with the human resource needs of our Foundation,
or a person who has professional relations with our Foundation

Legal Proceedings and Personal data processed concerning the calculation and tracking of our legal rights
Complianceand receivables, in compliance with our legal obligations and our Foundation’s
Information
policies

Transaction
Information

Data such as call center records, membership information, cookie records, which
are processed in order to protect the legal and other interests of the Foundation or
the personal data subject, related to the services provided within the frameworkof the activities carried out by the Foundation.

Data relating to race, ethnic origin, political opinions, philosophical or religious
beliefs, being part of a sect, other beliefs, dressing style, membership of anSpecialCategory association, foundation or a trade-union, physical or mental health, sexual life or
Data/Sensitive
sexual orientation, criminal conviction and security measures, genetic or
Personal Databiometric data

Personal data processed concerning the marketing of İKSV’s events and concerts
by customizing them based on the preferences and personal interests of İKSV’s
Marketing Information
followers; social media preferences and reports and evaluations brought together
as a result of such data processing

PERSONAL
CATEGORYDATA

DEFINITION

Information
about
Personal data concerning the reception and assessment of any request or complaint
Request / Complaint
addressed to our Foundation
Management

Reputation
Management
Information

Data concerning the data collected to protect the reputation of the foundation, theevaluation reports prepared and the actions taken.

3. PRINCIPLES AND CONDITIONS REGARDING THE PROCESSING OFPERSONAL DATA
3.1. Principles Regarding The Processing Of Personal Data
Personal data is processed by the Foundation in accordance with the personal data processing
principles set forth in Article 4 of the Law. These principles must be complied with in terms ofeach personal data processing activity:
Processing of personal data in accordance with the law and good faith; The Foundation acts
in accordance with the relevant laws, secondary regulations and general principles of law; It
places importance on the processing personal data limited to the purpose for which it isprocessed and to take into account the reasonable expectations of data owners.
Personal data should be accurate and up to date The Foundation ensures that the processed
personal data is up to date and accurate. In this context, data subjects are given the right torequest correction or deletion of their incorrect and outdated data.
Processing of personal data for specific, explicit and legitimate purposes; The Foundation
determines the purposes of data processing in accordance with the law prior to each personal
data processing activity.

Personal data should be relevant, limited and proportionate to the purpose for which it isprocessed; Data processing activities are limited to personal data which is necessary to fulfill
the purpose of collection. The Foundation takes all necessary steps in order to prevent theprocessing of personal data not related to the purpose.
Being stored for the period laid down by relevant legislation or required for the purpose forwhich the personal data are processed; In cases where a longer retention period is notdetermined by the Foundation in accordance with the laws by taking into account the sector
practices regarding the storage of personal data, the personal data processed by the Foundation
are erased, destroyed or anonymized after the purpose of personal data processing has been
removed or after the expiration of the period stipulated in the legislation.
3.2. Conditions of the Processing the Personal Data
Personal data is processed by the Foundation in the presence of at least one of the personal dataprocessing conditions in Article 5 of the Law. Explanations of these terms are as follows:

•

•

•

•

•

•

•

Explicit consent of the data subject: In the absence of other data processing conditions,Foundation may process the personal data of the data subject under the general principles whichis regulated in 3.1. section of the Law upon the freely given consent of the data subject who issufficiently informed about the personal data processing activity, leaving no room for doubt
and limited to the particular activity in question.
Explicit permission provided for by the Laws: In case it is explicitly permitted by the Laws,
the Foundation can process personal data without the explicit consent of the data subject.
Accordingly, the Foundation shall process personal data within the framework of the related
legislation.
When the data subject is physically incapable of giving explicit consent and it is necessary toprocess personal data, the Foundation can process the personal data of the data subject who is
physically or legally incapable of giving explicit consent providing that it is necessary to protect
the life or physical integrity of the data subject or a third person.
When processing of personal data is directly related to the conclusion or execution of acontract, personal data shall be processed if it is necessary to process the personal data of theparties of an existing or new contract between the data subject and the Foundation.
When it is necessary to process personal data to comply with a legal obligation to which thedata controller is subject to, the Foundation can process personal data in order to perform legal
obligations provided for by the current legislation.
When the data subject has made his/her personal data public, the Foundation may process the
personal data that are already made public to the extent of the intention by such publication,
without the explicit consent of the data subject,
When it is necessary to establish, exercise or protect a right, the Foundation can process
personal data without the explicit consent of the data subject within the context of suchnecessity.
When it is necessary for the legitimate interests of the data controller and provided that thefundamental rights and freedoms of the data subject shall not be violated, the Foundation canprocess personal data taking into consideration the balance between the Foundation`s and thedata subject`s interests. Within this framework, the Foundation shall primarily establish its
legitimate interests that it shall maintain in such data processing. The Foundation shall also
evaluate the potential impacts of data processing on data subject’s rights and freedoms andaccordingly, the personal data shall be processed if the Foundation considers that the balanceof benefits is maintained.
3.3. Conditions of Processing the Special Categories of Personal Data
In Article 6 of the Law, special categories of personal data are specified in a limited number.
These are personal data relating to the race, ethnic origin, political opinion, philosophical belief,religion, religious sect or other belief, appearance, membership to associations, foundations or
trade-unions, data concerning health, sexual life, criminal convictions and security measures,and the biometric and genetic data. The Foundation processes special categories of personal
data in accordance with the relevant legal regulations and by taking additional measuresdetermined by the Personal Data Protection Board (“KVK Board”) in the following cases:•
The processing of sensitive personal data other than health and sexual life may beprocessed without the explicit consent of the data owner, provided that it is expressly stipulated
in the law, in other words, there is a clear provision in the relevant law regarding the processingof personal data. Otherwise, the explicit consent of the data owner will be obtained in order toprocess the said special categories of personal data.
•
Personal data related to health and sexual life may be processed without the explicit
consent of persons or authorized institutions and organizations under the obligation of secrecy
for the purpose of protecting public health, conducting preventive medicine, medical diagnosis,
treatment and care services, planning and managing health services and financing. Otherwise,
the explicit consent of the data subject will be obtained in order to process the said special
categories of personal data.
4. TRANSFERRING PERSONAL DATAFoundation may share personal data with third parties residing in or out of Turkey in case thatconditions of the transferring the personal data within the scope of additional measures statedby the Board and data processing conditions specified in Articles 8 and 9 as set forth in the Law
are provided.
•

Transfer of Personal Data to third parties in Turkey,
Personal data may be transferred by the Foundation to third parties in the country,
provided that at least one of the data processing conditions included in the 5th and 6th
articles of the Law and explained under the 3rd title of this Policy are present and thatthe basic principles regarding the data processing conditions are complied with.

•Transfer of personal data to third parties abroad; In case the country to which thetransfer will be made is a safe country with adequate protection declared by the KVK
Board; Personal data may be transferred by the Foundation to third parties abroad,provided that at least one of the data processing conditions specified in Articles 5 and 6of the Law and explained under Title 3 of this Policy are present and provided that they
comply with the basic principles regarding data processing conditions.
In the event that the country to which the transfer will be made is not a safe country withadequate protection declared by the KVK Board, the personal data shall transferred to third
parties abroad in the following cases in accordance with the basic principles specified in Article
4 of the Law, and in the presence of at least one of the data processing conditions explained
under the 3rd Title of this Policy;••

Existence of the explicit consent of the person concerned
The Foundation and the data recipient in the relevant country undertake in writing toprovide adequate protection and obtain the permission of the KVK Board for the
relevant transfer.

In accordance with the general principles of the Law and the data processing conditions in
Articles 8 and 9, the Foundation can transfer data to the parties categorized in the table below:

CATEGORIESOFDATASHARINGPARTIESBusiness
Partner

SCOPE

PURPOSE
OF
TRANSFERRING(e.g.)

Parties with which İKSV develop a business partnership to carryout its business activities. The business partners to whom
personal data are transferred are listed below with the purposesof the transfer.
• In order to carry out the transactions related to events andorganizations, Passo• Banks with business partnerships in order to carry out financial
business processes• Audit firms that are being worked with for the purpose of Sharing of personal data
carrying out audit activities
limited to fulfilling the• Law firms that are working for the purpose of obtaining legal purposesfortheconsultancy
establishment of the• Business partnerships within the scope of projects to be carried business partnership in
out abroad
questionSupplierParties that render their services as instructed by Foundation andin compliance with their contracts with Foundation aimed atmaintaining Foundations activities

Sharing of personal data
limited to ensuring theexecution of strategicplanning,
human
resources, commercial
and audit activities.

Eczacıbaşı
Holding

Eczacıbaşı Holding A.Ş.

Legally
Authorized
Public Body

Sharing of personal data
limited to the purpose of
meeting the information
requests by relevant
Public bodies and institutions legally authorized to receive publicbodiesandinformation and documents from Foundation
institutions

Legally
Authorized
Private Body

Sharing of personal data
limited to the purpose of
meeting the information
request sent by private
Private bodies legally authorized to receive information and bodies within the scope
documents from Foundationof their legal authority

5. INFORMING THE DATA SUBJECTS AND THEIR RIGHTS
In compliance with the Article 10 of the Law, data subjects shall be notified about theprocessing of their personal data prior to or during the course of such processing at the verylatest. In accordance with the relevant article, a necessary in-house structure has been put inplace by Foundation to be able to notify data subjects in every case data would be processed by
the data controller, that is Foundation. In this context;•
For the purpose of processing personal data, please review section 2.2 of the Policy.
• For the parties to whom the personal data are transferred and for the purpose of transfer,please review to Section 4 of the Policy.
• To review the conditions regarding the processing of your personal data, which may becollected through different channels in physical or electronic environments, please
review 3.2 and 3.3 of the Policy.
As data subjects, you have the following rights as per Article 11 of the Law:
-To learn whether your personal data are processed or not,-In case your personal data are processed, to request information,-To learn the purpose of processing your data and whether they are used for the intended purposes
or not,-To learn the third parties at home or abroad to whom your personal data are transferred,-If your personal data are processed incompletely or inaccurately, to request correction, and,accordingly, to request that third parties to whom your personal data were transferred be notifiedof such action,-Even if your personal data are processed in compliance with the Law numbered 6698 and otherapplicable provisions, if the reasons requiring data processing are no longer valid, to request erasureor destruction of your personal data, and, accordingly, to request that the third parties to whom yourpersonal data were transferred be notified of such action,-To raise objections against the analyzing of your processed data exclusively by automatic means
if it leads to an unfavorable consequence for you, and-To request compensation for the damage arising from the unlawful processing of your personaldata.
As the data subject, you may deliver your claims regarding the abovementioned rights of yours to
the Foundation by filling in the Data Subject Application Form, which you can fing in[http://www.iksv.org/i/assets/iksv/documents/veri-sahibi-basvuru-formu.pdf]. Your request will be
addressed as soon as possible or, at the latest, within 30 (thirty) days, depending on the nature of
the claim; however, in case this transaction brings an extra cost, a compensation will be requested
from you as per the rates determined by the Personal Data Protection Board.
Foundation firstly determines whether the applicant is the real beneficiary during the evaluation of
the applications. However, Foundation may request detailed and additional information in order tobetter understand the request when it deems necessary.

Foundation provides replies to data subjects in writing or through electronic messages. In the eventthat such a claim may be denied, the data subject will be given information regarding the reasonsfor denying.
In case the personal data is not obtained directly from the data owner, the activities shall be carriedout to clarify the data subjects by the Foundation (i) within a reasonable time from the acquisitionof the personal data, (ii) during the first communication in case the personal data will be used forcommunication with the data subject, and (iii) at the latest when the personal data is transferred forthe first time in the case of the personal data to be transferred.

6. ERASURE, DESTRUCTION OR ANONYMIZATION OF PERSONALDATA
Personal data shall be erased, destructed or anonymized in accordance with the guides
published by the Personal Data Protection Authority subject to the periodic destruction periods
and the application of the data subject; in the event that the reasons requiring the processing of
personal data removed, in cases where a longer storage period is not determined by theFoundation in accordance with the laws and the sector practices regarding the storage of
personal data, upon the request of the data subject or ex officio (by own initiative).
Personal data processed by the Foundation are handled on a categorical basis, and maximum
data storage periods have been determined for each personal data category in line with the dataprocessing process it is related to. Detailed information on how the storage and destruction
process will be carried out, including the aforementioned maximum periods, is set forth in the
Personal Data Storage and Destruction Policy issued by the Foundation.