KVKK Privacy Notice

1. Data controller

• Seller / provider: Meryem Suzan Civiroğlu - ELQA Yönetim Sistemleri Eğitim ve Danışmanlığı
• Tax office: Tire Tax Office
• Tax number: 9950250263
• Address: Fatih Mah. Taksim Cad. No: 4/1 D: 4, Tire / İzmir, Türkiye
• Phone: +90 541 738 71 07
• Email: suzan.civiroglu@elqa.com.tr
• Website: https://elqa.com.tr

2. Categories of personal data that may be processed

• Identity data: name and surname; tax or national ID details where required for invoicing or by legislation.
• Contact data: email, telephone, address and communication preferences.
• Customer transaction data: order or registration number, the product or training purchased, cart and payment result, discounts, contract and consent versions, delivery, access and download records, support requests.
• Financial data: invoice and collection details, payment status, payment transaction and reference numbers. Payment instrument data such as the card number and security code may be processed through the secure infrastructure of the payment service provider used.
• Training data: pre-registration and registration details, attendance, any assessment result and certificate information.
• Transaction security and technical data: IP address, session and access logs, error logs, device and browser information, cookie preferences and information security records.
• Request and complaint data: messages and support content sent by email, through forms or other channels.

3. Purposes of processing

• Providing products and services and creating and managing order and training records.
• Assessing pre-registration requests and running the final registration and payment process.
• Carrying out payment, invoicing and accounting operations.
• Delivering digital products, providing access to recorded training and sending live training links.
• Carrying out distance contract, pre-information, withdrawal, cancellation and refund processes and statutory record-keeping obligations.
• Customer support and the management of requests and complaints.
• Ensuring the security of systems, accounts, payments and access, and preventing misuse and unauthorised access.
• Fulfilling legal obligations and establishing, exercising or protecting a right.
• Carrying out promotional or marketing communication where explicit consent or commercial electronic message consent has been given, and only within the scope of that permission.

4. Legal grounds

Depending on the specific processing activity, personal data may be processed on the legal grounds set out in article 5 of Law no. 6698: necessity for the conclusion or performance of a contract, compliance with a legal obligation of the data controller, the establishment, exercise or protection of a right, and the legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed. Where a separate processing activity requires explicit consent, that consent is obtained separately and freely.

5. Method of collection

Personal data may be collected electronically, or in physical form where necessary, through website forms, product and training order screens, pre-registration forms, payment and invoicing processes, email and telephone communication, the customer account, the training platform, online meeting tools and the technical records of the website.

6. Parties to whom personal data may be transferred

Personal data may be transferred to the following groups of recipients, limited to and to the extent necessary for the purpose of processing:

• Payment service providers, banks and financial institutions.
• Accounting, e-document and e-invoice, and financial advisory service providers.
• Hosting, software, backup, email and SMS, information security and technical support service providers.
• Online training and meeting platforms used to deliver live or recorded training.
• Competent public authorities and bodies entitled to request information under a legal obligation.
• Lawyers, advisers and competent judicial or administrative authorities in the event of a legal dispute.

7. Transfers abroad

The ELQA website and database are hosted on a server operated by Hostinger International Limited and located in a data centre in Frankfurt, Germany. Personal data collected through the site is therefore processed in Germany.

The email service runs on servers located in Türkiye and payments are processed through the infrastructure of PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., established in Türkiye; no transfer abroad takes place in these two processes.

Where Google Analytics is used to measure site usage, the related technical data may be processed by Google outside Türkiye. Those cookies are only run if you give consent in the cookie preference panel.

Transfers abroad are carried out in accordance with the conditions set out in article 9 of Law no. 6698 and limited to the purpose of processing. This section is updated when the service providers used change.

8. Recordings of live training

Where ELQA is to make an audio or video recording of live training, participants are informed separately before recording begins. Where the recording is to be used for purposes other than delivering the training, such as advertising, promotion or social media, the necessary legal conditions are satisfied separately. Recording by participants without permission is prohibited.

9. Retention periods

• Pre-information, contract, delivery and related transaction documents under a distance contract: for the minimum period prescribed by the applicable legislation (at least 3 years under the Regulation on Distance Contracts).
• Invoices and accounting and tax documents: for the periods prescribed by the applicable tax and commercial legislation.
• Dispute and legal claim records: for the applicable limitation and statutory retention periods.
• Records that do not result in a sale, such as pre-registrations and information requests: deleted, destroyed or anonymised once the purpose of processing has ended and no other legal ground for retention exists.
• Marketing communication permissions: until the permission is withdrawn and, in order to evidence the permission or refusal record, for the period required by the applicable legislation.

10. Your rights under Law no. 6698

You may send requests relating to your rights under article 11 of Law no. 6698, together with information suitable for verifying your identity, to suzan.civiroglu@elqa.com.tr or to Fatih Mah. Taksim Cad. No: 4/1 D: 4, Tire / İzmir, Türkiye. Applications are assessed in accordance with the applicable legislation.

11. Distinction between information and explicit consent

Presenting this notice is not a request for “acceptance” or “explicit consent” to the processing of your personal data. Where considered necessary, only a confirmation of the form “I have read and understood the KVKK Privacy Notice” may be obtained. Transactions requiring explicit consent or commercial electronic message consent are presented through a separate text and a separate selection mechanism.