PDPL

ORPHAN FOUNDATION, which carries out humanitarian aid activities for orphans, vulnerable children, and orphaned mothers both domestically and internationally, also demonstrates its commitment to the security of personal data in its activities. With this awareness, we place great importance on the processing, storage, and deletion of both private and general personal data of visitors from all media channels in accordance with the Law No. 6698 on the Protection of Personal Data, and any secondary regulations (such as regulations, communiqués, circulars) issued under the Law, as well as decisions taken or to be taken by the Personal Data Protection Board. As the Data Controller, as defined in the Law, we process your personal data within the limits stipulated by the legislation and as explained below.

INFORMATION ABOUT THE DATA CONTROLLER
In accordance with the Law, ORPHAN FOUNDATION, registered with the Turkish Directorate General of Foundations - Istanbul 1st Regional Directorate with the registration number 3772, located at "Dervişali, Kariye Cami Sk. No:6 34200 Fatih / İstanbul," is the "Data Controller."

PURPOSES OF PERSONAL DATA PROCESSING
ORPHAN FOUNDATION, which serves orphaned, vulnerable children and orphaned mothers with humanitarian aid activities both in Turkey and abroad, requires the processing of personal data both to fulfill its legal obligations directly and in situations where these obligations and the services provided indirectly necessitate it. In this context, your personal data is processed for the following purposes:

By ORPHAN FOUNDATİON;

Public Procurement Law No. 4734
Public Procurement Contracts Law No. 4735
Labor Law No. 4857
Stamp Tax Law No. 488
Law on Fees No. 492
Press Law No. 5187
Regulation on the Implementation of the Private Security Services Law No. 5188
Turkish Penal Code No. 5232
Code of Criminal Procedure No. 5271
Social Insurance and General Health Insurance Law No. 5510 and the secondary regulations issued under this Law
Corporate Tax Law No. 5520
Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through These Publications
Electronic Communications Law No. 5809
Turkish Code of Obligations No. 6098
Commercial Code No. 6102
Occupational Health and Safety Law No. 6331 and the secondary regulations issued under this Law
Tax Exemption Status Compliance Letter No. 48107

To comply with the provisions of the above laws and regulations and fulfill our obligations stipulated in:

Labor Law No. 4857 and its secondary regulations
Social Insurance and General Health Insurance Law No. 5510 and its secondary regulations
Occupational Health and Safety Law No. 6331 and its secondary regulations
Personal Data Protection Law No. 6698 and its secondary regulations
To manage information security processes
To carry out audit/ethics activities
To ensure that activities are conducted in compliance with the legislation
To conduct finance and accounting operations
To monitor and execute legal affairs
To carry out communication activities
To execute storage and archiving activities
To carry out social responsibility and civil society activities
To carry out sponsorship activities
To monitor requests/complaints
To ensure the security of data controller operations
To provide information to authorized persons, institutions, and organizations

All personal data is processed within the limits set by the Law, in accordance with the principles of legality, integrity, and fairness, and always connected, limited, and proportionate to the purposes stated herein.

TRANSFER OF PERSONAL DATA
Your personal data may be transferred to real and legal persons authorized by the legislation, to other competent public institutions and organizations, judicial and administrative authorities, law enforcement agencies, institutions and organizations with which we have a business relationship, authorities related to humanitarian aid activities, relevant ministries, and humanitarian aid associations carrying out joint activities with the same objectives, as well as external service providers such as consultancy, technology, and training companies, in accordance with the provisions of the Law No. 6698, specifically Articles 8 and 9, and the principles of legality, integrity, and fairness. Transfers will be made in a manner that is connected, limited, and proportionate to the purposes stated above, within the boundaries defined by the law.

METHOD OF PERSONAL DATA COLLECTION, LEGAL BASES, AND TYPES OF PERSONAL DATA PROCESSED
Your personal data is collected by authorized data processors (real or legal persons) appointed by ORPHAN FOUNDATION using various means such as email, telephone, website, various contracts, paper-based forms, and reports. The collection is carried out through both automated and non-automated methods, in spoken, written, or electronic form.

In this context;

Contact Group	Received Personal Data
Donor	Full Name, Turkish ID Number, Gender, Year of Birth, Phone Number, Email, Address Information, Bank Account Information, Log Records
Volunteer	Full Name, Identity, Driver's License, Passport Information, Gender, Nationality, Place of Birth, Date of Birth, Phone Number, Email Address, Address Information, Blood Type, Bank Account Information, Marital Status, Military Service Information, Education Information, Log Records, Passport Photo, Criminal Record, Emergency Contact Person Information, Health Information, Certificates, Work Experience
Needer	Full Name, Identity, Passport Information, Gender, Nationality, Parents' Names, Year of Birth, Place of Birth, Marital Status, Education Information, Signature, Criminal Record, Phone Number, Email Address, Passport Photo, Address Information, Blood Type, Educational Background, Bank Account Information, Emergency Contact Person Information, Family's Civil Registry Information, Family Status, Health Information, Real Estate Information, Fingerprint (if unable to sign due to illiteracy), Religion Information (if included in the ID), Documents from Judicial or Administrative Authorities
Supplier Institution Representative	Full Name, Phone Number, Email Address, Address Information, Tax Number, Signature, Bank Account Information
Visitor	Full Name, Phone Number, Email Address, Address Information, Entrance/Exit Information

Your General Personal Data
Your personal data of a general nature, as per Article 5 of the Law, is processed based on the following legal grounds:

If explicitly foreseen in laws,
If directly related to the establishment or execution of a contract,
If it is necessary for the data controller to fulfill its legal obligations,
If it has been made public by the data subject,
If necessary for the establishment, use, or protection of a right,
If necessary for the legitimate interests of the data controller, provided that it does not infringe upon the fundamental rights and freedoms of the data subject.

Your sensitive personal data and information in your population registration extract are processed based on your explicit consent, unless the conditions explicitly foreseen in laws are met. The data processed based on your explicit consent is also stated in the "Explicit Consent" document provided to you.

RIGHTS OF DATA SUBJECTS UNDER THE LAW
You can apply to the ORPHAN FOUNDATION at any time to:

Learn whether your personal data is being processed, the purpose of processing, and whether it is being used in accordance with its purpose. If processed, you can request information on this matter.
Learn about third parties to whom your information has been shared, both domestically and internationally, in accordance with the Law.
If you believe your information has been processed incompletely or inaccurately, request its correction.
Under the conditions set forth in Article 7 of the Law, you may request the deletion or destruction of your data.
You may request that third parties to whom your data has been transferred (as mentioned in sections (c) and (d)) be informed of your requests, and that they carry out the same actions.
You can object if your data is being analyzed by automated systems and results in a decision that negatively affects you, or if you believe that your data has been recorded or used unlawfully, and if you have suffered damage as a result, you may request compensation for the damage.

Your requests, as part of your application, will be processed and concluded as promptly as possible, and no later than within 30 (thirty) days, depending on the nature of the request. In order to exercise your rights under the Law, you may submit your applications in Turkish, either directly in person or via notary to the address of the ORPHAN FOUNDATION mentioned above, or send them through the methods prescribed by the "Regulation on the Procedures and Principles of Application to the Data Controller."

In your application to exercise the aforementioned rights, the subject of the request must be clear and understandable, and the request must relate to you personally. If you are acting on behalf of someone else, you must present a notarized special power of attorney.

Applications must include the following details in accordance with the "Regulation on Procedures and Principles of Application to the Data Controller": full name, signature, Turkish Identification Number, residence or workplace address, e-mail address, phone and fax numbers, and the subject matter of the request. Applications that do not contain the required elements outlined in the Regulation will be rejected by ORPHAN FOUNDATION.

ORPHAN FOUNDATION reserves the right to make changes to this clarification text based on reasons arising from the Law, secondary regulations, and decisions by the Personal Data Protection Board at any time. Any changes or updates to this clarification text will be effective immediately upon delivery of the updated text to you.