DATA SUBJECT APPLICATION FORM

As Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”), we would like to inform you that you have the rights granted to relevant persons / data subjects under Article 11 of Law No. 6698 on the Protection of Personal Data (“Law”). Pursuant to the provisions of the Law, the Company, acting as the data controller, has published on its website at www.inovent.com.tr the Clarification Texts and policies regarding the protection of personal data, including the conditions for processing personal data, data security, and the procedures and principles governing the destruction of personal data.

As a data subject/relevant person, you may submit your requests regarding your personal data to us by using this Data Subject Application Form (“Application Form”), within the scope of Article 13 of the Law and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller.

RIGHTS OF THE DATA SUBJECT / RELEVANT PERSON

Your rights as a data subject under the Law are set out below, and you may submit your requests to us in writing, in Turkish / English, by using the application method specified in this Application Form.

You may submit the following requests through the Application Form:

a) To learn whether your personal data are being processed,

b) If your personal data have been processed, to request information regarding such processing,

c) To learn the purpose of the processing of your personal data and whether such personal data are used in accordance with such purpose,

d) To know the third parties to whom your personal data are transferred domestically or abroad,

e) To request the correction of your personal data where such data have been processed incompletely or inaccurately,

f) To request the deletion or destruction of personal data processed in accordance with the Law and applicable legislation where the reasons requiring their processing no longer exist,

g) To request that the actions taken pursuant to paragraphs (e) and (f) be notified to third parties to whom the personal data have been transferred,

h) To object to the occurrence of a result against the data subject arising from the analysis of processed personal data exclusively through automated systems,

i) To claim compensation for damages suffered as a result of the unlawful processing of personal data.

APPLICATION METHOD

Pursuant to Articles 11 and 13 of the Law, applications to the Company acting in its capacity as data controller shall be made by printing out this form and submitting it:

• In writing, by means of a wet-signed petition, to Sabancı Üniversitesi Yerleşkesi, Orta Mahalle, Üniversite Caddesi, Rektörlük Binası No: 27 P/1, 34956 Tuzla / Istanbul, or through a notary public,

or

• By sending it to info@inovent.com.tr using your registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address previously notified by you to the Company and registered in our data recording system.

• Applicant Data Subject Information

Relationship Between the Applicant and the Company

Please specify your relationship with the Company. (Visitor, applicant, entrepreneur, business partner, employee, job applicant, former employee, employee of a third-party company, etc.)

• Request

ANNEXES (If any, please list below the supporting documents relating to your application)

• Response to Application

Please select the method by which you would like to receive the response to your application.

• Written applications shall be deemed to have been made on the date the relevant documents are served upon the Company, acting as data controller, and/or its representative; applications made by other methods shall be deemed to have been made on the date the application reaches the data controller.
• Our response to your application shall be sent to the address you have selected no later than 30 (thirty) days from the date on which your application is served upon us.
• If you request a written response to your application, your application shall be processed free of charge for responses of up to 10 pages. For responses exceeding 10 pages, a fee shall be charged for each additional page in accordance with the tariff determined by the Personal Data Protection Authority.

We hereby inform you that we reserve the right to request additional documents in order to identify the personal data processed by the Company in relation to your application and to provide an accurate and complete response to your request. The Company shall not be liable for any errors or damages arising from information provided by you that is inaccurate, incomplete or not up to date.

Applicant (Data Subject)

Name-Surname :

Turkish Republic Identity / Passport No :

Application Date :

Signature :

CONSENT TEXT FOR SENDING COMMERCIAL ELECTRONIC MESSAGES

By approving this declaration, pursuant to Law No. 6563 on the Regulation of Electronic Commerce and the relevant legislation, I hereby give my explicit consent to Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”) contacting me and sending me commercial electronic messages, using the name, surname and contact information I have provided to the Company through the Company’s website at www.inovent.com.tr and through digital / physical channels, via SMS/text message, automated calls, telephone calls, e-mail, social media and online advertising networks, online communication applications and all other communication channels, for the purposes of providing all types of information, promotions, advertisements, satisfaction surveys and announcements, particularly in relation to other program processes.

Acceptance of the Consent Form shall remain valid until the right to withdraw consent is exercised, and failure to provide consent shall not affect the services to be provided to you by the Company. You may withdraw your consent to receive commercial electronic messages at any time by contacting us at info@inovent.com.tr. The sending of commercial electronic messages shall cease within 3 business days following the date on which your opt-out request is received by us.

SUBSCRIBER CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım Anonim Şirketi (the “Company”), acting in its capacity as data controller, shall, in accordance with Law No. 6698 on the Protection of Personal Data (the “Law”) and in particular with due regard to the principle of protecting the right to privacy, collect, record, classify, retain and update the personal data of data subjects; process such personal data in accordance with the conditions for processing stipulated under the Law; and transfer such personal data to third parties to the extent and in the circumstances permitted by applicable legislation.

This Clarification Text has been prepared in accordance with the applicable legislation in force, particularly the Law, as well as the rules set forth in the regulations, communiqués, decisions and guidelines issued by the Personal Data Protection Board (the “Board”). If, following the publication date of this Clarification Text, the Law or any other applicable legislation is amended and this Clarification Text becomes inconsistent with such amendments, the amended provisions and rules shall prevail and apply accordingly. All communiqués, decisions and guidelines issued by the Board are monitored by us on an ongoing basis, and the rules set forth in this Clarification Text are kept up to date accordingly.

1. DATA SUBJECT / RELEVANT PERSON

The data subjects within the scope of this Clarification Text are natural persons who register via their e-mail addresses in order to receive e-newsletters, announcements and informational content published by the Company.

2. IDENTITY OF THE DATA CONTROLLER AND ITS REPRESENTATIVE

Pursuant to the Law, your personal data may be collected and processed by the Company, acting as the data controller, within the scope set out below. For any questions regarding the processing of your personal data, you may contact the Company’s Contact Person via info@inovent.com.tr.

3. PURPOSES OF PROCESSING PERSONAL DATA, LEGAL BASES FOR PROCESSING AND METHODS OF COLLECTION

The Company may record, retain, update, transfer to third parties, classify and otherwise process your personal data to the extent and in accordance with the conditions set forth under Articles 5 and 6 of the Law under the heading “Conditions for Processing Personal Data.”. The Company clearly identifies the purposes for which personal data are processed and processes personal data, in connection with its business activities, only for purposes related to such activities.

Your personal data collected through the channels and methods specified in this Clarification Text are processed by the Company for the purposes and on the legal bases set out below:

4. YOUR RIGHTS UNDER THE LAW

As personal data subjects, if you submit your requests regarding your rights through the Data Subject Application Form published at www.inovent.com.tr, or by using the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller, the Company shall process and conclude your request free of charge, depending on the nature of the request, as soon as possible and in any event within thirty days at the latest. Within this scope, personal data subjects have the right to:

• learn whether their personal data are being processed;
• request information if their personal data have been processed;
• learn the purpose of the processing of their personal data and whether such personal data are used in accordance with the relevant purpose;
• know the third parties to whom their personal data are transferred, whether domestically or abroad;
• request correction of their personal data where such data have been processed incompletely or inaccurately, and request that the relevant correction be notified to third parties to whom the personal data have been transferred;
• request the deletion or destruction of their personal data where the reasons requiring their processing no longer exist, even though such personal data have been processed in accordance with the Law and other applicable legislation, and request that the relevant action be notified to third parties to whom the personal data have been transferred;
• object to the occurrence of a result against the data subject arising from the analysis of processed personal data exclusively through automated systems; and
• claim compensation for damages suffered as a result of the unlawful processing of personal data.

Our Website contains links to websites operated by third parties. The Company has no involvement in, or responsibility for, the policies and procedures applied by such third parties in relation to the processing of personal data.

CONTACT FORM CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım Anonim Şirketi (the “Company”), acting in its capacity as data controller, shall, in accordance with Law No. 6698 on the Protection of Personal Data (the “Law”) and in particular with due regard to the principle of protecting the right to privacy, collect, record, classify, retain and update the personal data of data subjects; process such personal data in accordance with the conditions for processing stipulated under the Law; and transfer such personal data to third parties to the extent and in the circumstances permitted by applicable legislation.

This Clarification Text has been prepared in accordance with the applicable legislation in force, particularly the Law, as well as the rules set forth in the regulations, communiqués, decisions and guidelines issued by the Personal Data Protection Board (the “Board”). If, following the publication date of this Clarification Text, the Law or any other applicable legislation is amended and this Clarification Text becomes inconsistent with such amendments, the amended provisions and rules shall prevail and apply accordingly. All communiqués, decisions and guidelines issued by the Board are monitored by us on an ongoing basis, and the rules set forth in this Clarification Text are kept up to date accordingly.

1. DATA SUBJECT / RELEVANT PERSON

The data subjects/relevant persons within the scope of this Clarification Text are natural persons who contact the Company by completing the contact form available under the “Contact” tab on the Company’s website at www.inovent.com.tr.

2. IDENTITY OF THE DATA CONTROLLER AND ITS REPRESENTATIVE

Pursuant to the Law, your personal data may be collected and processed by the Company, acting as the data controller, within the scope set out below. For any questions regarding the processing of your personal data, you may contact the Company’s Contact Person via info@inovent.com.tr.

3. PURPOSES OF PROCESSING PERSONAL DATA, LEGAL BASES FOR PROCESSING AND METHODS OF COLLECTION

The Company may record, retain, update, transfer to third parties, classify and otherwise process your personal data to the extent and in accordance with the conditions set forth under Articles 5 and 6 of the Law under the heading “Conditions for Processing Personal Data.”. The Company clearly identifies the purposes for which personal data are processed and processes personal data, in connection with its business activities, only for purposes related to such activities.

Your personal data collected through the channels and methods specified in this Clarification Text are processed by the Company for the purposes and on the legal bases set out below:

4. YOUR RIGHTS UNDER THE LAW

As personal data subjects, if you submit your requests regarding your rights through the Data Subject Application Form published at www.inovent.com.tr, or by using the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller, the Company shall process and conclude your request free of charge, depending on the nature of the request, as soon as possible and in any event within thirty days at the latest. Within this scope, personal data subjects have the right to:

• learn whether their personal data are being processed;
• request information if their personal data have been processed;
• learn the purpose of the processing of their personal data and whether such personal data are used in accordance with the relevant purpose;
• know the third parties to whom their personal data are transferred, whether domestically or abroad;
• request correction of their personal data where such data have been processed incompletely or inaccurately, and request that the relevant correction be notified to third parties to whom the personal data have been transferred;
• request the deletion or destruction of their personal data where the reasons requiring their processing no longer exist, even though such personal data have been processed in accordance with the Law and other applicable legislation, and request that the relevant action be notified to third parties to whom the personal data have been transferred;
• object to the occurrence of a result against the data subject arising from the analysis of processed personal data exclusively through automated systems; and
• claim compensation for damages suffered as a result of the unlawful processing of personal data.

Our Website contains links to websites operated by third parties. The Company has no involvement in, or responsibility for, the policies and procedures applied by such third parties in relation to the processing of personal data.

J-START PROGRAM APPLICANT CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım Anonim Şirketi (“Company”) acting in its capacity as data controller, and primarily in accordance with the principle of protecting the privacy of private life, shall record, classify, retain and update the personal data of data subjects in compliance with Law No. 6698 on the Protection of Personal Data (“Law”), process such personal data within the framework of the processing conditions set forth under the Law, and transfer such personal data to third parties where and to the extent permitted by applicable legislation.

This Clarification Text has been prepared in accordance with the applicable legislation in force, particularly the Law, as well as the rules set forth in the regulations, communiqués, decisions and guidelines published by the Board. If, following the publication date of the Clarification Text, the Law or any other relevant legislation is amended and the Clarification Text becomes inconsistent with such amendment, the amended provisions and rules shall apply. All communiqués, decisions and guidelines published by the Board are monitored by me/us, and the rules stipulated under the Clarification Text are kept up to date.

1. DATA SUBJECT/RELEVANT PERSON

The data subjects/relevant persons within the scope of this Clarification Text are natural persons who apply to the “J-Start Program” (“Program”).

2. IDENTITY OF THE DATA CONTROLLER AND ITS REPRESENTATIVE

Pursuant to the Law, your personal data may be collected and processed by the data controller within the scope set out below. For any questions regarding the processing of your personal data, you may contact the Company Contact Person via the e-mail address info@inovent.com.tr.

3. PURPOSES OF PROCESSING PERSONAL DATA, LEGAL BASES FOR PROCESSING AND METHODS OF COLLECTION

The Company may record, retain, update, transfer to third parties, classify and otherwise process your personal data to the extent and in accordance with the conditions specified under the heading “conditions for processing personal data” in Articles 5 and 6 of the Law. The Company clearly sets out the purposes for which personal data are processed and processes personal data, in line with its business activities, for purposes connected with such activities.

Your personal data collected through the channels and methods specified in this Clarification Text are processed by the Company for the purposes and on the legal bases set out below:

4. YOUR RIGHTS UNDER THE LAW

As personal data subjects, if you submit your requests regarding your rights through the Data Subject Application Form published at www.inovent.com.tr, or by using the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller, the Company shall process and conclude your request free of charge, depending on the nature of the request, as soon as possible and in any event within thirty days at the latest. Within this scope, personal data subjects have the right to:

• learn whether their personal data are being processed;
• request information if their personal data have been processed;
• learn the purpose of the processing of their personal data and whether such personal data are used in accordance with the relevant purpose;
• know the third parties to whom their personal data are transferred, whether domestically or abroad;
• request correction of their personal data where such data have been processed incompletely or inaccurately, and request that the relevant correction be notified to third parties to whom the personal data have been transferred;
• request the deletion or destruction of their personal data where the reasons requiring their processing no longer exist, even though such personal data have been processed in accordance with the Law and other applicable legislation, and request that the relevant action be notified to third parties to whom the personal data have been transferred;
• object to the occurrence of a result against the data subject arising from the analysis of processed personal data exclusively through automated systems; and
• claim compensation for damages suffered as a result of the unlawful processing of personal data.

Our Website contains links to websites operated by third parties. The Company has no involvement in, or responsibility for, the policies and procedures applied by such third parties in relation to the processing of personal data.

• The Applicant is responsible for providing the necessary information and ensuring that the applicable legal requirements are satisfied for the sharing of personal data relating to third parties.

PRIVACY & COOKIE POLICY

As Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”), we attach importance to the protection of your personal data and the privacy of your private life. The purpose of this Privacy and Cookie Policy is to provide information regarding the personal data collected from you during your visit to the Company’s website at www.inovent.com.tr and the cookies used on our website.

1. What Is a Cookie?

Cookies are small text files, generally consisting of letters and numbers, which are stored on your device or network server through the browser by the website you visit.

As the Company, we use cookies, pixels and similar technologies in connection with your visit to the Company’s website at www.inovent.com.tr. In this respect, cookies are used in compliance with Law No. 6698 on the Protection of Personal Data (“Law”), as well as all regulations, communiqués and decisions issued from time to time by the Personal Data Protection Authority.

You may at any time access detailed information regarding the processing, transfer, protection, retention and destruction of your personal data through the Clarification Texts and policies published by the Company on its website.

2. Purpose of Using Cookies

We use the data obtained through cookies from users visiting our website primarily for the following purposes:

• To ensure the operation of the essential functions and functionality of the website.
• To ensure the proper operation of the website.
• To ensure the legal security of you, the website and the Company.
• To conduct statistical analyses and performance measurements.
• To manage the website interface and session information.
• To analyze visitor sessions and patterns of website use.

3. Method and Legal Basis for Collecting Personal Data

Visitors may be required to provide certain personal data through the forms available on our website. Information regarding the personal data processed is set out in the relevant sections of the Clarification Texts available on our website. In addition, the personal data specified above, which are collected by the Company through cookies during your visit to our website, may be processed in accordance with Articles 5 and 6 of the Law. Furthermore, within the scope of web server access logs, IP address, user agent information (browser and operating system), request time, requested resource, HTTP status code and referrer address information are processed. Through Google Analytics and Google Tag Manager services, approximate geolocation based on IP address, page view, session, device and traffic source information are processed.

4. Cookies Used on Our Website

The types and characteristics of the cookies used on our website are set out below:

Session Cookies: Session cookies are cookies that are used temporarily for the duration of visitors’ use of the website and, as a rule, are deleted when the browser is closed. These cookies may be used for purposes such as ensuring the secure and proper operation of the website, managing session information, and performing the technical functions required during the visit.

Persistent Cookies: Persistent cookies are cookies that continue to be stored on the user’s device for a predetermined period of time even after the browser is closed. These cookies may be used for purposes such as remembering visitor and usage information, analyzing website usage and visitor traffic, conducting statistical measurements, and improving website performance.

Within this scope, the cookies used on our website are listed below:

5. Transfer of Personal Data

Within the scope of this Privacy and Cookie Policy, your personal data collected through cookies may be transferred to the following recipients, limited to the purposes specified below and in accordance with the applicable legislation:

• Authorized Public Institutions and Organizations: Sharing/transferring information and documents requested from the Company by the relevant public institutions and organizations, limited to the purpose of the request and the scope of the Company’s commercial activities.
• Suppliers: Sharing/transferring personal data with suppliers and service providers engaged in these areas, limited to the provision of the relevant services, for the purposes of creating, hosting and managing electronic application forms and providing website, information technology, cloud, e-mail, communication, archiving and analytics services.

6. Use and Control of Cookies

During your visit to our website, you have the right to determine and customize your preferences regarding the cookies used by changing the settings of the browser you use. To the extent permitted by the technical infrastructure of your browser, you may completely block the use of cookies, receive notifications before cookies are used, disable certain types of cookies, or delete existing cookies. The available options and methods may vary depending on the browser used and the technical specifications of the device. General information regarding cookie management is available at https://www.aboutcookies.org/. Cookie preferences are configured separately for each device and browser through which you access our website; therefore, preferences may need to be set separately for each device used to access the website.

Our website also contains links to other websites. The Company is not responsible for the privacy policies or content of such other websites.

7. Your Rights as a Data Subject

If, as personal data subjects, you submit your requests regarding your rights through the Data Subject Application Form published at www.inovent.com.tr or by using the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller, the Company shall conclude your request free of charge, depending on the nature of the request, as soon as possible and in any event within thirty days at the latest.

Within this scope, personal data subjects have the right to learn whether their personal data are being processed, request information if their personal data have been processed, learn the purpose of the processing of their personal data and whether such data are used in accordance with such purpose, know the third parties to whom their personal data are transferred domestically or abroad, request the correction of their personal data where such data have been processed incompletely or inaccurately and request that the relevant correction be notified to third parties to whom the personal data have been transferred, request the deletion or destruction of their personal data where the reasons requiring their processing no longer exist, even though such personal data have been processed in accordance with the Law and other applicable legislation, and request that the relevant action be notified to third parties to whom the personal data have been transferred, object to the occurrence of a result against them arising from the analysis of processed personal data exclusively through automated systems, and claim compensation for damages suffered as a result of the unlawful processing of personal data.

Our website contains links to websites operated by third parties, and the Company has no involvement in or responsibility for the policies and procedures applied by such third parties in relation to the processing of personal data.

The Company reserves the right to update and amend this Policy in line with any changes that may occur in its personal data processing activities.

8. Data Controller Information

POLICY ON THE PROTECTION, PROCESSING, RETENTION AND DESTRUCTION OF PERSONAL DATA

I. INTRODUCTION

1.1. Purpose of the Policy

Pursuant to Article 20 of the Constitution titled “Privacy of Private Life”, Law No. 6698 on the Protection of Personal Data (“Law”), and the provisions of the regulations and communiqués currently in force, the purpose of this Policy is to establish the principles governing the processing of personal data obtained by Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”), the protection of the fundamental rights and freedoms of data subjects (visitor, applicant, entrepreneur, business partner, employee, job applicant, former employee, employee of a third-party company, etc.), particularly the privacy of private life, the lawful conduct of data processing activities by the data controller processing personal data, and the protection, processing, retention and, where necessary, destruction of the personal data obtained.

1.2. Scope of the Policy

Considering that any operation performed by the Company, acting in its capacity as data controller, on any information relating to an identified or identifiable natural person, including obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of such data, by fully or partially automated means or by non-automated means provided that such processing forms part of a data recording system, constitutes a data processing activity, the scope of this Policy is to establish the procedures and principles applicable to the data processing activities carried out by the Company.

1.3. Application of the Policy and Relevant Legislation

This Policy has been prepared in accordance with the applicable legislation, particularly Law No. 6098 Turkish Code of Obligations, Law No. 6102 Turkish Commercial Code, Law No. 6698 on the Protection of Personal Data, Law No. 6563 on the Regulation of Electronic Commerce, the Regulation on the Data Controllers Registry No. 30286, the Regulation on the Deletion, Destruction or Anonymization of Personal Data No. 30224, the Regulation on the Processing of Personal Health Data and Protection of Privacy, as well as the rules set forth in the regulations, communiqués, decisions and guidelines published by the Board.

If, following the publication date of the Policy, the Law or any other relevant legislation is amended and the Policy becomes inconsistent with such amendments, the amended provisions and rules shall apply. All communiqués, decisions and guidelines published by the Board are monitored by the Company, and the rules set forth under the Policy are kept up to date.

1.4. Entry into Force of the Policy

The Policy has been published on the Company’s website at www.inovent.com.tr and entered into force on the date of its publication.

II. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

2.1. Ensuring the Security of Personal Data

Pursuant to Article 12 of Law No. 6698, the data controller is obliged to take all necessary administrative and technical measures to ensure an appropriate level of security for the purposes of;

• Preventing the unlawful processing of personal data,
• Preventing unlawful access to personal data,
• Ensuring the safeguarding of personal data.

Accordingly, the Company implements security measures in order to prevent the unlawful processing, transfer and disclosure of personal data to third parties, unauthorized access, and security vulnerabilities arising through other means. Explanations regarding the administrative and technical measures adopted are set out under VI. ADMINISTRATIVE AND TECHNICAL MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA.

2.2. Protection of Special Categories of Personal Data

Data which, due to their nature, are considered sensitive and which, if obtained by third parties, may cause data subjects to suffer harm or discrimination are classified as special categories of personal data under the Law. Special categories of personal data consist of data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. As a rule, the processing of special categories of personal data is prohibited and may only be carried out in the limited circumstances permitted by law.

The Company takes all necessary measures for the protection of special categories of personal data, and as a principle, aims to avoid the collection and processing of such data to the greatest extent possible.

III. MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

3.1. Processing of Personal Data in Accordance with the Principles Prescribed by Legislation

Pursuant to Article 4 of the Law, the principles applicable to the processing of your personal data are as follows:

• Processing lawfully and fairly,
• Being accurate and, where necessary, kept up to date,
• Processing for specified, explicit and legitimate purposes,
• Being relevant, limited and proportionate to the purposes for which they are processed,
• Being retained for the period prescribed by the relevant legislation or required for the purpose for which they are processed.

3.2. Conditions for Processing Personal Data

Personal data obtained by the Company may not be processed without the explicit consent of the data subject, except in the circumstances expressly provided for under the Law.

3.3. Exceptions to the Requirement to Obtain Explicit Consent

a) Expressly provided for by law

One of the conditions for processing personal data is that such processing is expressly provided for by law. Provisions contained in laws permitting the processing of personal data may constitute a legal basis for processing. In such cases, the explicit consent of the data subject is not required.

b) Physical impossibility

Where it is necessary to protect the life or physical integrity of the person who is unable to express consent due to physical impossibility or whose consent is not legally valid, or of another person, the personal data of the relevant data subject may be processed without obtaining explicit consent.

c) Being directly related to the establishment or performance of a contract

Where the processing of personal data is necessary for the establishment or performance of a contract to which the data subject is a party, such personal data may be processed without obtaining explicit consent.

d) Fulfillment of the Company’s legal obligations

Personal data may be processed without obtaining explicit consent where such processing is necessary for the Company, acting in its capacity as data controller, to fulfill its legal obligations.

e) Having been made public by the data subject

Personal data that have been made public by the data subject, in other words, personal data that have in any manner been disclosed to the public, may be processed without obtaining explicit consent. Even in such cases, publicly disclosed personal data may not be used for purposes other than those for which they were made public.

f) Being necessary for the establishment, exercise or protection of a right

Personal data may be processed without the explicit consent of the data subject where such processing is necessary for the establishment, exercise or protection of a right.

g) Being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not prejudiced

Where the processing of personal data is necessary for the data controller and such processing does not prejudice the fundamental rights and freedoms of the data subject, personal data may be processed without obtaining explicit consent.

The legitimate interest of the data controller refers to the interest and benefit to be obtained as a result of the relevant processing activity. The benefit to be obtained by the data controller must relate to a legitimate, sufficiently effective, specific and currently existing interest capable of being balanced against the fundamental rights and freedoms of the data subject. The relevant processing activity must be connected with the data controller’s current activities and be capable of providing a benefit to the data controller in the near future.

3.4. Processing of Special Categories of Personal Data

The processing of special categories of personal data is subject to Article 6 of the Law. Personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data. The categories of data falling within this scope are exhaustive and may not be expanded by interpretation. By their nature, special categories of personal data are data which, if disclosed, may result in the data subject being subjected to discrimination or suffering harm. Therefore, they must be afforded a significantly higher level of protection than other personal data.

Special categories of personal data may be processed where the data subject has provided explicit consent; where processing is expressly provided for by law; where processing is necessary for the protection of the life or physical integrity of the person who is unable to express consent due to physical impossibility or whose consent is not legally valid, or of another person; where processing relates to personal data made public by the data subject and is consistent with the data subject’s intention in making such data public; where processing is necessary for the establishment, exercise or protection of a right; where processing by persons subject to an obligation of confidentiality or by authorized institutions and organizations is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, or the planning, management and financing of healthcare services; where processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance; or where processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, provided that such processing complies with the legislation and purposes to which they are subject, is limited to their fields of activity, does not involve disclosure to third parties, and relates to their current or former members and constituents or to persons who are in regular contact with such organizations and formations. In addition, the processing of special categories of personal data is subject to the implementation of the adequate measures determined by the Personal Data Protection Board.

3.5. Clarification and Information of the Data Subject

At the time personal data are obtained, the Company, acting in its capacity as data controller, or persons authorized by the Company, provide information to data subjects. The procedures and principles regarding such information are set out in the relevant Clarification Texts published by the Company in relation to the processing of personal data, and such information generally includes the following:

• The identity of the data controller and, if any, its representative,
• The purposes for which personal data will be processed,
• The persons to whom personal data may be transferred and the purposes of such transfer,
• The method and legal basis of collecting personal data,
• The rights of the data subject as set out under Article 11 of the Law.

a) Purposes of processing personal data

Personal data are processed for specified, explicit and legitimate purposes, based on the principle of informing data subjects. The purposes pursued by the Company in processing personal data obtained from data subjects are set out, for each relevant data subject category, in the relevant sections of the Clarification Texts available on our website.

b) Persons to whom personal data are transferred and purposes of transfer

Within the scope of the data controller’s obligation to provide clarification, the persons to whom personal data are transferred and the purposes of such transfer must be clearly specified. Personal data may not be transferred to third parties without the explicit consent of the data subject. The recipient groups to whom personal data are transferred by the Company and the purposes of such transfers are set out under IV. TRANSFER OF PERSONAL DATA.

c) Method and legal basis of collecting personal data

In accordance with Articles 5 and 6 of the Law, the data controller must clearly specify the condition for processing personal data on which the relevant processing activity is based. The method and means used to collect personal data are determined by the data controller. The conditions for processing personal data, in other words the circumstances establishing lawfulness, are exhaustively enumerated under the Law (Articles 5-6) and may not be expanded.

The Company, acting as data controller, first assesses whether the purpose of the personal data processing activity can be based on one of the processing conditions other than explicit consent. Where such purpose does not satisfy at least one of the conditions stipulated under the Law other than explicit consent, the explicit consent of the data subject is obtained in order for the relevant data processing activity to continue.

IV. TRANSFER OF PERSONAL DATA

4.1. Domestic Transfer

Personal data may not be transferred without the explicit consent of the data subject. However, where one of the conditions specified in the second paragraph of Article 5 or, provided that adequate measures are taken, in the third paragraph of Article 6 is satisfied, personal data may be transferred without obtaining the explicit consent of the data subject.

Information regarding the recipient groups to whom your personal data processed by the Company are transferred is set out in ANNEX 3 – Third Parties to Whom Personal Data Are Transferred and Purposes of Transfer of this Policy.

4.2. Transfer Abroad

Personal data may be transferred abroad where an adequacy decision as specified under Articles 8 and 9 is in place, where one of the appropriate safeguards is provided, or in other circumstances permitted thereunder.

V. CATEGORIZATION OF PERSONAL DATA PROCESSED BY THE COMPANY AND PURPOSES OF PROCESSING

The categories of data obtained by the Company from data subjects and the purposes pursued in processing such personal data are set out, for each relevant data subject category, in the relevant sections of the Clarification Texts available on our website.

VI. ADMINISTRATIVE AND TECHNICAL MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA

The Company takes administrative and technical measures to ensure the secure retention of personal data and to prevent the unlawful processing of and unauthorized access to personal data.

Pursuant to subparagraphs (b) and (d) of paragraph 2 of Article 4 of the Law, personal data must, where necessary, be accurate and kept up to date and must be retained for the period prescribed by the relevant legislation or required for the purposes for which they are processed. Within this scope, the data processed are processed in accordance with the principles and rules applicable to data processing activities and are retained for the period necessary for the purposes for which they are processed. Information regarding the retention and destruction procedures and retention periods applicable to personal data processed by the Company is set out under VIII. RETENTION AND DESTRUCTION OF PERSONAL DATA and ANNEX–4: Personal Data Retention Periods of this Policy.

For the purposes of ensuring personal data security, the Company identifies all personal data processed by it and assesses the likelihood of risks arising in relation to the protection of such data. In identifying such risks, consideration is given to whether the personal data constitute special categories of personal data (1), the level of confidentiality required due to the nature of the data (2), and the nature and extent of the potential harm that may arise for the data subject in the event of a security breach (3). Following the identification and prioritization of such risks, control and solution alternatives aimed at mitigating or eliminating the relevant risks are evaluated in light of the principles of cost, practicability and effectiveness, and the necessary technical and administrative measures are planned and implemented within the framework of the Law.

Within this scope, the following administrative and technical measures are taken by the Company for the protection of personal data:

An authorization matrix has been established for employees.

• User account management and authorization control systems are implemented and regularly monitored.
• Access logs are regularly maintained.
• Network security and application security are ensured.
• Encryption is applied.
• Penetration tests are conducted.
• Personal data are backed up, and the security of the backed-up personal data is also ensured.
• The security of personal data stored in cloud environments is ensured.
• Firewalls are used.
• Up-to-date anti-virus systems are used.
• Log records are maintained in a manner that prevents user intervention.
• Intrusion detection and prevention systems are used.
• Key management measures are implemented.
• Necessary security measures are taken with respect to entry to and exit from physical environments containing personal data.
• The security of environments containing personal data is ensured.
• Personal data are deleted, destroyed or anonymized in accordance with the applicable legislation.
• Cybersecurity measures have been adopted, and their implementation is continuously monitored.
• Special categories of personal data transferred via e-mail are always sent in encrypted form using a registered electronic mail (KEP) account or a corporate e-mail account.
• Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
• Disciplinary regulations containing data security provisions are in place for employees.
• Executed agreements contain data security provisions.
• Confidentiality undertakings are executed.
• The relevant authorizations of employees whose duties have changed or whose employment has terminated are revoked.
• Personal data security policies and procedures have been established.
• Personal data security incidents and issues are promptly reported.
• Personal data are minimized to the greatest extent possible.
• Periodic and/or random internal audits are conducted and/or commissioned.

VII. PERSONAL DATA PROCESSING ACTIVITIES CONDUCTED AT BUILDING ENTRANCES AND WITHIN THE BUILDING

Camera Surveillance Activities at Building Entrances and Within the Building

Camera surveillance activities are carried out for the purposes of ensuring security at the entrance, surrounding areas and interior of the building, and protecting the interests relating to the security of the Company and other persons. Camera surveillance activities are conducted in compliance with the Law and within the scope of the personal data processing conditions set forth both under the Law and this Policy.

VIII. RETENTION AND DESTRUCTION OF PERSONAL DATA

8.1. Retention and Destruction of Personal Data

Your personal data retained by the Company are stored for the period during which the relevant data processing activity is necessary; where an obligation to delete, destroy or anonymize personal data arises, such personal data are deleted, destroyed or anonymized within the first periodic destruction period following the date on which such obligation arises. The deletion, destruction or anonymization of your personal data is carried out in accordance with the general principles set forth under Article 4 of the Law and the technical and administrative measures specified under Article 12 of the Law.

The interval for periodic destruction is limited to a maximum of 1 year. All operations relating to the deletion, destruction or anonymization of personal data carried out by the Company are recorded and retained for at least 3 years in accordance with the applicable legal obligations. The retention periods applicable to personal data processed by the Company are set out in ANNEX–4.

The personal data specialist appointed by the Company in relation to the retention and destruction of data is responsible for the implementation and supervision of the personal data retention and destruction policy.

8.2. Obligation to Delete, Destroy and Anonymize Personal Data

Personal data processed by the Company are deleted, destroyed or anonymized ex officio or upon the request of the relevant data subject where the reasons requiring their processing cease to exist, in accordance with Article 7 of the Law and the provisions of the “Regulation on the Deletion, Destruction or Anonymization of Personal Data” published by the Personal Data Protection Board in the Official Gazette dated 28 October 2017 and numbered 30224.

• Deletion of personal data

Deletion of personal data means rendering personal data inaccessible and unusable in any manner whatsoever for the relevant employees.

All necessary technical and administrative measures are taken to ensure that deleted personal data remain inaccessible and cannot be reused.

• Destruction of personal data

Destruction of personal data means rendering personal data inaccessible, irretrievable and unusable by anyone in any manner whatsoever.

All necessary technical and administrative measures are taken to ensure that personal data cannot be accessed, recovered or reused by anyone in any manner whatsoever.

• Anonymization of personal data

Anonymization of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person in any manner whatsoever, even when matched with other data.

All necessary technical and administrative measures are taken for the anonymization of your personal data, and such data are anonymized by applying methods in accordance with our personal data retention and destruction policy.

8.3. Personal Data Recording Environments

A personal data recording environment refers to any environment in which personal data processed by fully or partially automated means, or by non-automated means provided that such processing forms part of a data recording system, are stored.

Personal data relating to data subjects are securely stored by the Company, in accordance primarily with the provisions of the Law and other applicable legislation and within the framework of international data security principles, in the following data recording environments:

a) Technical recording environments: Computer environments, central servers, removable storage media (USB drives, memory cards, etc.), information security devices and software.

b) Non-technical data recording environments: Paper documents, manual data recording systems, written, printed and visual media.

8.4. Reasons Requiring the Destruction of Personal Data

Personal data relating to data subjects are destroyed by the Company for purposes and reasons including, but not limited to, the following;

The general principles set forth under Article 4 of the Law,

• Amendment of the relevant legislative provisions forming the basis for the processing,
• Withdrawal of explicit consent by the data subject where the processing of personal data is based solely on explicit consent,
• Submission by the data subject of a request for the destruction of personal data,
• Expiry of legal obligations relating to the retention of personal data,
• Cessation of the purpose requiring the processing or retention of personal data,
• Expiry of the maximum retention period applicable to personal data and the absence of any justified reason requiring continued retention.

8.5. Techniques for the Deletion, Destruction and Anonymization of Personal Data

The techniques applied by the Company for the deletion, destruction or anonymization of processed personal data are set out below, and the technique to be applied may vary depending on the nature of the personal data concerned.

During the deletion, destruction or anonymization of personal data, necessary administrative and technical measures are taken, including informing employees regarding information security and destruction processes, selecting the most appropriate method according to the nature of the data recording environment in which personal data are stored, conducting regular and periodic maintenance and monitoring activities relating to data security, using the most up-to-date destruction systems required from a technological and technical perspective, issuing automatic deletion commands, and revoking authorization to access, reuse or restore deleted data.

For this purpose, the following methods are applied: (1) first identifying the personal data subject to deletion, destruction or anonymization, (2) identifying the relevant employees for each category of personal data by using an access authorization and control matrix or a similar system, (3) identifying the relevant employees’ access, restoration and reuse authorizations and methods, and (4) disabling and eliminating the relevant employees’ access, restoration and reuse authorizations and methods in relation to the relevant personal data.

Within this scope, depending on the requirements of the circumstances;

• For the deletion of personal data: methods such as (i) issuing deletion commands in cloud-based or application-based solutions, (ii) redacting, cutting out or otherwise rendering invisible data contained in paper records, and (iii) deleting data stored on portable media by using appropriate software;
• For the destruction of personal data: methods such as (i) de-magnetizing data by processing the relevant media through specialized devices, (ii) melting, burning or pulverizing optical and magnetic media, (iii) overwriting magnetic media and rewritable optical media by using specialized systems, and (iv) other destruction methods applied to paper-based or electronic media;
• For the anonymization of personal data: methods such as (i) removing variables from data that may be associated with the data subject, (ii) removing data records containing unique characteristics from the data set, and (iii) applying generalization techniques by converting the relevant personal data from a specific value into a more general value.

IX. RIGHTS OF THE PERSONAL DATA SUBJECT AND EXERCISE OF RIGHTS

9.1. Rights of the Personal Data Subject

Pursuant to Law No. 6698, as a data subject, you have the right to;

• Learn whether your personal data are being processed,
• Request information if your personal data have been processed,
• Learn the purpose of the processing of your personal data and whether such data are used in accordance with such purpose,
• Know the third parties to whom your personal data are transferred domestically or abroad,
• Request the correction of your personal data where such data have been processed incompletely or inaccurately,
• Request the deletion or destruction of your personal data within the framework of the conditions set forth under Article 7,
• Request that the correction of incomplete or inaccurate processing and the deletion or destruction of personal data be notified to third parties to whom the personal data have been transferred,
• Object to the occurrence of a result against you arising from the analysis of your processed personal data exclusively through automated systems,
• Claim compensation for damages suffered as a result of the unlawful processing of your personal data.

9.2. Exercise of the Rights of the Personal Data Subject and Our Company’s Response to Applications

If, as personal data subjects, you submit your requests regarding your rights through the Data Subject Application Form published at www.inovent.com.tr or by using the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller, the Company shall conclude your request free of charge, depending on the nature of the request, as soon as possible and in any event within thirty days at the latest. This period may not exceed 30 days from the date on which your application is served upon the Company. Where additional information is requested due to deficiencies or unclear statements in your application, the response period shall be suspended until the relevant additional information and documents are served upon us. If the processing of your application requires any cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

ANNEX – 1: Definitions

Explicit Consent: Consent relating to a specific matter, based on being informed and expressed with free will,

Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person in any manner whatsoever, even by matching such data with other data,

Recipient Group: The category of natural or legal persons to whom personal data are transferred by the data controller,

Data Subject: The natural person whose personal data are processed,

Destruction: The deletion, destruction or anonymization of personal data,

Redaction: Operations such as crossing out, masking, obscuring or blurring all or part of personal data in a manner that prevents such data from being associated with an identified or identifiable natural person,

Recording Environment: Any environment in which personal data processed by fully or partially automated means, or by non-automated means provided that such processing forms part of a data recording system, are stored,

Personal Data: Any information relating to an identified or identifiable natural person,

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partially automated means or by non-automated means provided that such processing forms part of a data recording system,

Law / Law on the Protection of Personal Data (“KVKK”): Law No. 6698 on the Protection of Personal Data, which was published in the Official Gazette and entered into force on 7 April 2016,

Board: The Personal Data Protection Board,

Authority: The Personal Data Protection Authority,

Data Processor: The natural or legal person who processes Personal Data on behalf of the data controller, based on the authority granted by the data controller,

Data Recording System: The recording system in which personal data are processed by being structured according to specific criteria,

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for the establishment and management of the data recording system.

ANNEX – 2: Personal Data Subjects (Data Subjects)

ANNEX – 3: Third Parties to Whom Personal Data Are Transferred and Purposes of Transfer

ANNEX – 4: Personal Data Retention Periods

Below you can find the policies, clarification texts and consent texts prepared by Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş., as data controller, under the Law No. 6698 on the Protection of Personal Data.

• Policy on the Protection, Processing, Retention and Destruction of Personal Data
  General principles on the processing, transfer, retention and destruction of personal data.
• Privacy & Cookie Policy
  Information on the cookies and visitor data used on our website.
• J-Start Program Applicant Clarification Text
  Clarification text for persons applying to the J-Start Program.
• Contact Form Clarification Text
  Clarification text for persons who fill in the contact form on our website.
• Subscriber Clarification Text
  Clarification text for subscribers to our e-newsletter and announcements.
• Consent Text for Sending Commercial Electronic Messages
  Consent text regarding the sending of commercial electronic messages.
• Data Subject Application Form
  How to exercise your rights under Article 11 of the Law, and the application form.

For questions regarding your personal data: info@inovent.com.tr

DATA SUBJECT APPLICATION FORM

As Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”), we would like to inform you that you have the rights granted to relevant persons / data subjects under Article 11 of Law No. 6698 on the Protection of Personal Data (“Law”). Pursuant to the provisions of the Law, the Company, acting as the data controller, has published on its website at www.inovent.com.tr the Clarification Texts and policies regarding the protection of personal data, including the conditions for processing personal data, data security, and the procedures and principles governing the destruction of personal data.

As a data subject/relevant person, you may submit your requests regarding your personal data to us by using this Data Subject Application Form (“Application Form”), within the scope of Article 13 of the Law and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller.

RIGHTS OF THE DATA SUBJECT / RELEVANT PERSON

Your rights as a data subject under the Law are set out below, and you may submit your requests to us in writing, in Turkish / English, by using the application method specified in this Application Form.

You may submit the following requests through the Application Form:

a) To learn whether your personal data are being processed,

b) If your personal data have been processed, to request information regarding such processing,

c) To learn the purpose of the processing of your personal data and whether such personal data are used in accordance with such purpose,

d) To know the third parties to whom your personal data are transferred domestically or abroad,

e) To request the correction of your personal data where such data have been processed incompletely or inaccurately,

f) To request the deletion or destruction of personal data processed in accordance with the Law and applicable legislation where the reasons requiring their processing no longer exist,

g) To request that the actions taken pursuant to paragraphs (e) and (f) be notified to third parties to whom the personal data have been transferred,

h) To object to the occurrence of a result against the data subject arising from the analysis of processed personal data exclusively through automated systems,

i) To claim compensation for damages suffered as a result of the unlawful processing of personal data.

APPLICATION METHOD

Pursuant to Articles 11 and 13 of the Law, applications to the Company acting in its capacity as data controller shall be made by printing out this form and submitting it:

• In writing, by means of a wet-signed petition, to Sabancı Üniversitesi Yerleşkesi, Orta Mahalle, Üniversite Caddesi, Rektörlük Binası No: 27 P/1, 34956 Tuzla / Istanbul, or through a notary public,

or

• By sending it to info@inovent.com.tr using your registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address previously notified by you to the Company and registered in our data recording system.

• Applicant Data Subject Information

Relationship Between the Applicant and the Company

Please specify your relationship with the Company. (Visitor, applicant, entrepreneur, business partner, employee, job applicant, former employee, employee of a third-party company, etc.)

• Request

ANNEXES (If any, please list below the supporting documents relating to your application)

• Response to Application

Please select the method by which you would like to receive the response to your application.

• Written applications shall be deemed to have been made on the date the relevant documents are served upon the Company, acting as data controller, and/or its representative; applications made by other methods shall be deemed to have been made on the date the application reaches the data controller.
• Our response to your application shall be sent to the address you have selected no later than 30 (thirty) days from the date on which your application is served upon us.
• If you request a written response to your application, your application shall be processed free of charge for responses of up to 10 pages. For responses exceeding 10 pages, a fee shall be charged for each additional page in accordance with the tariff determined by the Personal Data Protection Authority.

We hereby inform you that we reserve the right to request additional documents in order to identify the personal data processed by the Company in relation to your application and to provide an accurate and complete response to your request. The Company shall not be liable for any errors or damages arising from information provided by you that is inaccurate, incomplete or not up to date.

Applicant (Data Subject)

Name-Surname :

Turkish Republic Identity / Passport No :

Application Date :

Signature :

CONSENT TEXT FOR SENDING COMMERCIAL ELECTRONIC MESSAGES

By approving this declaration, pursuant to Law No. 6563 on the Regulation of Electronic Commerce and the relevant legislation, I hereby give my explicit consent to Sabancı Üniversitesi Inovent Fikri Mülkiyet Hakları Yönetim Ticaret ve Yatırım A.Ş. (“Company”) contacting me and sending me commercial electronic messages, using the name, surname and contact information I have provided to the Company through the Company’s website at www.inovent.com.tr and through digital / physical channels, via SMS/text message, automated calls, telephone calls, e-mail, social media and online advertising networks, online communication applications and all other communication channels, for the purposes of providing all types of information, promotions, advertisements, satisfaction surveys and announcements, particularly in relation to other program processes.

Acceptance of the Consent Form shall remain valid until the right to withdraw consent is exercised, and failure to provide consent shall not affect the services to be provided to you by the Company. You may withdraw your consent to receive commercial electronic messages at any time by contacting us at info@inovent.com.tr. The sending of commercial electronic messages shall cease within 3 business days following the date on which your opt-out request is received by us.