Privacy Policy and KVKK Information Notice

This notice explains how your personal data is processed when you visit www.turkishcouncil.org, contact us, or use the education and immigration consulting services offered under the Turkish Council brand. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform, and, for visitors in the European Economic Area, our notice under Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").

1. Data controller

Gordion Partners Organizasyon Danışmanlık Limited Şirketi, operating under the brand Turkish Council. Registered address: Merkez Mahallesi Hasat Sokak No:12A, Şişli, 34384 İstanbul, Türkiye. MERSİS no. 0396136152300001; İstanbul Ticaret Sicili Müdürlüğü (Istanbul Trade Registry) no. 308755-5; Şişli Vergi Dairesi (Şişli Tax Office) 3961361523. Contact: contact@turkishcouncil.org, +90 532 431 80 50.

Turkish Council is a private education and immigration consultancy. We do not operate a school and we are not a government body: language courses are delivered by licensed partner schools, and visa and residence permit decisions are made by the Turkish authorities.

2. Personal data we process

• Identity: name and surname, nationality, date of birth, passport details.
• Contact: email address, telephone and WhatsApp number, country of residence, postal address.
• Enquiry and customer transaction data: the programme you are interested in, your messages, offers, contracts, payments and invoices.
• Education: diplomas, transcripts, language level, course enrolment and attendance.
• Visa and immigration: visa and travel history, residence permit applications and their status, appointment details.
• Financial: payment records and, where the authorities require proof of financial means, bank statements or sponsor documents.
• Visual records: passport photographs for applications; photographs, videos or testimonials for publication only with your explicit consent.
• Special categories of personal data, only when an application requires them: health insurance information and, if a consulate or authority asks for it, a criminal record certificate.
• Transaction security and technical data: IP address, browser and device information, request logs, and, only with your consent, analytics cookie data (see the Cookie Policy).
• Records of your choices: the date, time and version of the notice you acknowledged on our forms, and your cookie choice.

3. How we collect it

Partly by automated means (the website contact form, cookies and server logs) and partly by non-automated means: email, telephone, WhatsApp, documents you hand over or send us, meetings at our office, and information received from partner schools, universities and the authorities while we work on your file.

4. Purposes and legal bases

• Answering your enquiry and preparing an offer: necessary to take steps before a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
• Providing our services (arranging the invitation letter with a partner school, preparing and following your visa, residence permit or university application, enrolment, insurance and courier arrangements): performance of a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
• Legal obligations such as commercial, tax and accounting record keeping and requests from authorities (KVKK Art. 5/2(ç); GDPR Art. 6(1)(c)).
• Establishing, exercising or defending legal claims (KVKK Art. 5/2(e); GDPR Art. 6(1)(f)).
• Website security, keeping records of notices and choices, and improving our services: our legitimate interests, which do not override your rights (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
• Showing public Google reviews of Turkish Council with the reviewer's public name, as published on Google: data made public by the data subject (KVKK Art. 5/2(d)) and our legitimate interest.
• Analytics cookies, and publishing your photograph, video or testimonial: only with your explicit consent, which you can withdraw at any time without affecting earlier processing (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Special categories (health insurance, criminal record): only where an application requires them, under KVKK Art. 6 (your explicit consent, given on a separate consent form, or where necessary for the establishment, exercise or protection of a right) and GDPR Art. 9.

We do not use automated decision-making that produces legal effects for you, and we do not sell personal data.

5. Recipients

Only the data each recipient needs, for the purposes above:

• licensed partner language schools and the universities you apply to, for enrolment and invitation letters;
• Turkish public authorities, such as Turkish consulates and the Presidency of Migration Management, when we support your visa or residence permit application;
• health insurance companies, courier companies, certified translators and notaries, banks and payment providers, when your file requires them;
• our IT service providers: website hosting and delivery of form emails (Amazon Web Services, servers in Frankfurt, Germany) and, only with your consent, Google (Google Tag Manager and Google Analytics);
• Meta (WhatsApp), if you choose to contact us on WhatsApp;
• our legal and financial advisers, and courts or authorities where the law requires.

6. Transfers abroad

Some recipients are located outside Türkiye (for example our hosting provider in Germany, Google and Meta), and you may yourself be abroad when you contact us. Personal data is transferred abroad only in line with KVKK Article 9 (as amended by Law No. 7499): on the basis of an adequacy decision, appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority within five business days of signature, or, for incidental transfers, one of the exceptions in Article 9/6, including your explicit consent. Transfers out of the EEA follow Chapter V of the GDPR.

7. Retention

• Enquiries that do not lead to a service: 2 years after our last contact.
• Client files and contracts: the duration of the service and then the statutory limitation and record-keeping periods (generally 10 years under the Turkish Commercial Code and the Turkish Code of Obligations).
• Accounting and tax records: the periods set by commercial and tax law.
• Website server logs: 14 days, unless needed to investigate a security incident.
• Records of notices acknowledged and consents given: as long as the related processing continues, then for the limitation period.
• Published photographs, videos and testimonials: until you withdraw your consent.

When a period ends, or the reason for processing no longer exists, we delete, destroy or anonymise the data under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, at the latest in the next periodic destruction cycle.

8. Security

Encrypted connections (HTTPS), access limited to staff who need it, confidentiality obligations for staff and service providers, reputable providers bound by data protection terms, and secure storage. If personal data is obtained by others unlawfully, we notify the Personal Data Protection Board within 72 hours and the persons concerned as soon as possible.

9. Your rights

Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that third parties to whom data was transferred are notified of a correction or deletion; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your supervisory authority.

10. How to apply

Use our data subject application form and send it in writing to the address in section 1, or by email to contact@turkishcouncil.org from the email address registered with us, or with a secure electronic or mobile signature, or by registered electronic mail (KEP). We reply free of charge within 30 days at the latest (a fee under the Board's tariff may apply only if the reply involves an extra cost). If you are not satisfied with the reply, or receive none in time, you may complain to the Personal Data Protection Board (www.kvkk.gov.tr) within the periods in KVKK Article 14.

11. Children

Our programmes are for people aged 18 and over, and we do not knowingly collect personal data from children through this website.

12. Versions and changes

We may update this notice; the date of the current version is shown at the top. Translations are provided for convenience; if they differ, the Turkish version prevails: KVKK Aydınlatma Metni.