CLARIFICATION TEXT ON PERSONAL DATA PROTECTION (PDPL)

As Zem Akademi Mühendislik Ltd. Şti. (“thezem.com”), we attach great importance to the security and privacy of your personal data. In accordance with the Personal Data Protection Law No. 6698 (“PDPL”), acting as the “Data Controller,” we would like to inform you about the purposes for which we process your personal data and to whom we may transfer them.

1. Your Processed Personal Data

During your use of our platform, the following personal data may be processed:

• Identity and Contact Information: Name, surname, Turkish ID number (required for invoicing), e-mail address, phone number, billing address.
• Customer Transaction Information: Your order history, purchased training/consultancy packages, payment information (your credit card details are not stored by us and are directly transmitted to the payment institution).
• Transaction Security Information: IP address, website login-logout information, system records (logs).

2. Purpose of Processing Personal Data

Your collected personal data are processed for the following purposes in accordance with the personal data processing conditions specified in Articles 5 and 6 of the PDPL:

• Providing the purchased online training, video courses, and consultancy services and defining access authorizations,
• Keeping financial and accounting records, managing e-invoice / e-archive processes,
• Managing order, cancellation, and refund processes,
• Handling user requests, complaints, and support processes,
• Providing information to authorized public institutions and organizations due to legal obligations,
• Executing information security processes and protecting the system infrastructure.

3. Method and Legal Reason for Collecting Personal Data

Your personal data is collected electronically via membership forms, order screens, contact forms, and cookies on the thezem.com website.

The legal grounds we rely on while processing this data are; PDPL Article 5/2(c) “Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract”, Article 5/2(ç) “It is necessary for compliance with a legal obligation to which the data controller is subject,” and Article 5/2(f) “Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.”

4. Transfer of Personal Data

In line with realizing the aforementioned purposes, your personal data may be securely transferred to; authorized public institutions per legal legislation, BRSA-licensed payment institutions (virtual POS infrastructure) for carrying out payment transactions, and our financial advisors/legal counsels to fulfill our legal obligations.

5. Rights of the Data Subject under Article 11 of the PDPL

In accordance with Article 11 of the Law, data subjects have the right to; learn whether their personal data is processed, request information if processed, learn the purpose of processing and whether they are used in accordance with their purpose, know the third parties to whom they are transferred domestically or abroad, request correction if incomplete or incorrectly processed, and request their deletion or destruction within the framework of the conditions stipulated in Article 7 of the PDPL.