Processing of Your Personal Data in Compliance with the Law

Purpose of Processing Personal Data

Types of Personal Data We Collect

Personal Data Sources

To whom is your personal data being transferred?

How Long Do We Retain Personal Data

Ensuring the Security of Personal Data

Individuals' Data Protection Rights

Contact

Last update: July 1, 2025

Partner Data Privacy Notice

1) Introduction

Üstad Teknoloji Anonim Şirketi (“USTAD.CO”) is an organization committed to all legal regulations, corporate codes, business ethics, and ethical rules to which it is subject. The terms “USTAD.CO” or “we” used in this text are used to refer to USTAD.CO, its business partners, and all of its affiliates.

USTAD.CO processes your personal data while you provide services to users who purchase USTAD.CO products and services through its digital platform offered at www.ustad.co. Data belonging to identifiable natural persons is qualified as personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”), the secondary legislation derived from it, and the decisions of the Personal Data Protection Board (“Board”) (hereinafter collectively referred to as “Turkish Data Protection Legislation”). Therefore, data belonging to natural persons using the USTAD.CO platform as a business partner and natural person representatives accessing the platform on behalf of legal entities (“Individuals” or “you”) are protected as personal data in accordance with Turkish Data Protection Legislation.

As USTAD.CO, we commit to processing all personal data of our business partners and their employees, authorized personnel, subcontractors' employees—namely Individuals—who have an employment, service, or work contract with our business partners in compliance with Turkish Data Protection Legislation, ensuring the security of this data, and respecting it. To ensure that Individuals can understand how we will process their personal data for the purposes of contract execution and vendor management, we request that you also present this privacy notice to the Individuals acting on your behalf during the performance of the contract between USTAD.CO and the business partner.

2) Legal processing of your personal data

Individuals' personal data is processed due to the direct relevance to the establishment or performance of a contract[1] between you and USTAD.CO or in line with USTAD.CO's legitimate interests[2]. Your personal data will be processed for the purposes of recording identity information, contact details, and other information to identify the action owner and the counterparty in any work and transaction related to the services we will offer to platform users, preparing the information and documents that will serve as the basis for work and transactions carried out on paper or electronically, complying with information retention, reporting, and informing obligations prescribed by all judicial and administrative authorities under relevant legislation, and fulfilling the requirements of the contracts between us and the service we will provide you.

3) Purpose of processing personal data

We process personal data for purposes defined under the following headers: storage, updating, sending notifications to you for informational purposes with third parties in a cloud environment, sharing your information within the platform with users in the scope of partnership made for offering services, tracking and resolving your requests and complaints:

  • Execution of Finance and Accounting Activities,

  • Execution of Contract Processes,

  • Execution of Internal Audit/Investigation/Intelligence Activities,

  • Execution/Supervision of Business Activities,

  • Management of Our Suppliers,

  • Execution of Goods/Service Sales Processes,

  • Fulfillment of Legal Notification Obligations.

4) Types of Personal Data We Collect

USTAD.CO; processes Individuals' general personal data, in connection with transactions made on the website or applications under the domain name www.ustad.co: i) Identity information (Name-Surname, TC Identity No), ii) Contact information (Mobile Phone Number, Email Address), iii) Financial Information (Bank Account IBAN, Tax Identification No, Payment Information, Bank Information), iv) Partner transaction information from website visit data (IP address, cookie records, permission/consent records, browsing records, log information), for the aforementioned purposes.

5) Sources of personal data

Your personal data is collected directly from you through various channels, such as our website, mobile applications, representatives that contact you, or the information you provide to us via email, phone, text message, or other means. This may occur verbally, in writing, or electronically, and can also involve systems that partially or fully automate data recording, such as the identification system known as "cookies," which recognizes you automatically when you visit our website.

6) To whom is your personal data being transferred?

Your personal data may be transferred to our consultants and lawyers from whom we receive services to carry out our activities, partner institutions, organizations, individuals, to persons and organizations from whom we receive services for storing data in the cloud, platform users, domestic and foreign banks with whom we cooperate or receive services (including correspondent banks), financial institutions, payment organizations, and other third parties within the framework of our relevant collaborations. In cases where there is a legal obligation to provide information upon the request of official authorities or due to regulations, your information may be transferred to legal authorities and institutions, and they may also share your information further.

We obtain explicit consent from all individuals whose personal data is processed, in accordance with Turkish Data Protection Legislation, if necessary, for the processing of their data by USTAD.CO, and in every case, we ensure that individuals are informed in accordance with the procedures and principles determined by the Communiqué on the Principles and Procedures in Fulfilling the Obligation to Inform for any data processing activity conducted using USTAD.CO systems.

7) How long do we retain personal data?

We process and retain individuals' personal data while the contract between you and USTAD.CO is in effect. Additionally, after the termination of the contract with USTAD.CO, we continue to retain the personal data of individuals for 10 (ten) years, in accordance with the prescription periods set forth in Turkish Code of Obligations No. 6098, based on our legitimate interests[3]. However, during the 10 (ten) year retention period following the contract termination, we store personal data with access restrictions, ensuring that only specific individuals can access it.   

8) Keeping personal data secure

Safeguarding individuals' personal data is our priority. Personal data is securely stored either by us or by our carefully selected service providers, who process data for us under a service and privacy agreement. We ensure that stringent security measures are implemented to keep personal data safe from loss, misuse, unauthorized access, or disclosure. We make sure that the technical and administrative measures we take meet the requirements specified by the Turkish Data Protection Legislation in terms of security.

9) Individuals' data protection rights

Under Turkish Data Protection Legislation, individuals may at any time apply to USTAD.CO to:

  1. a) Find out whether their personal data is being processed,

  2. b) Request information regarding processed personal data,

  3. c) Learn the purpose of processing personal data and whether they are being used in accordance with their purpose,

d) Know the third parties in the country or abroad to whom personal data is transferred,

  1. e) Request the correction of personal data if they are incomplete or inaccurately processed,

  2. f) Request the deletion or destruction of personal data,

  3. g) Request that the actions taken pursuant to subparagraphs (d) and (e) be notified to third parties to whom personal data has been transferred,

  4. h) Object to the occurrence of an outcome that is against the person by analyzing the processed data exclusively through automated systems,

i) Request compensation for damages in case of processing of personal data in violation of the law, they have these rights.

10) Contact

If you are not satisfied with the way we process data, or if you want to obtain information or ask questions about something you do not understand, you can contact us at any time.

Address: BARBAROS MH.ŞEBBOY SOK..NO.4/1 İÇ KAPI N.2 ATAŞEHİR / İSTANBUL

Email:

Website: www.ustad.co

Registered electronic mail (KEP) address: ustadteknoloji@hs01.kep.tr

MERSIS NO: 0478-1033-9380-0001

[1] In accordance with paragraph c) of article 5, subparagraph 2 of the Personal Data Protection Law no. 6698, it is regulated as one of the conditions that allow the processing of personal data without the explicit consent of the concerned person.

[2] In accordance with paragraph f) of article 5, subparagraph 2 of the Personal Data Protection Law no. 6698, it is regulated as one of the conditions that allow the processing of personal data without the explicit consent of the concerned person.

[3] In accordance with paragraph f) of article 5, subparagraph 2 of the Personal Data Protection Law no. 6698, it is regulated as one of the conditions that allow the processing of personal data without the explicit consent of the concerned person.