The EBP platform, accessible at ebp.ibu.edu.tr and operated by Bolu Abant İzzet Baysal University, places great importance on protecting users’ privacy and personal data.
This Privacy Policy has been drawn up to explain the general principles governing the processing of data relating to individuals who visit the platform, create a user account, apply for events, participate in events, organise events or are involved in evaluation processes.
The processing of personal data is carried out in accordance with the relevant legislation, in particular the Law on the Protection of Personal Data No. 6698 (KVKK).
1 Data Controller
Under the Law on the Protection of Personal Data No. 6698, the data controller is:
EBP is a platform used to support the management of digital processes relating to academic and scientific activities at Bolu Abant İzzet Baysal University.
2 Personal Data That May Be Collected
Depending on the nature of the services provided via EBP, the following personal data may be processed:
Personal Details
- First name and surname
- Academic title
- User or profile information
Contact Details
- Email address
- A telephone number, if required
Institutional and Academic Information
- University or organisation details
- Information on faculties, institutes, colleges, departments or units
- Academic/administrative role or title
- Information provided by the user regarding their area of expertise or field of work
Event and Application Information
- Event applications and participation details
- Application dates and statuses
- Documents and information uploaded by the user to the system
- Assessments and feedback provided as part of the event
- Records relating to events organised or attended
Transaction Security Information
- IP address
- Attendance and entry-exit records
- Transaction dates and times
- System usage activities
- Security and error logs
- Technical information on ensuring the security of a user account
* As a general rule, users should not be asked to provide personal data that is not necessary for the service being provided.
3 Purposes of the Processing of Personal Data
Personal data may be processed solely for the following purposes:
- • Creation and management of user accounts,
- •Verification of the user’s identity,
- •The publication and management of academic and scientific events,
- • Managing the application and participation processes for events,
- •The implementation of the application and assessment processes,
- • Keeping users informed about relevant events and applications,
- •The execution of system-based workflows between event organisers, participants and users involved in the evaluation processes,
- •The creation of records relating to participation, applications and assessment,
- •Authorisation and management of user roles,
- •Ensuring system security, preventing unauthorised access and misuse,
- •Identifying and resolving technical issues,
- •Improving the platform’s performance, usability and user experience,
- •The compilation of statistical data relating to academic and administrative processes,
- •Ensuring that the University fulfils its obligations arising from the relevant legislation,
- • Meeting the lawful requests of authorised public bodies and organisations.
In statistical or scientific analyses, it is preferable to use data that is anonymous or does not directly identify individuals, wherever possible.
4 Legal Grounds for the Processing of Personal Data
Personal data is processed in accordance with the conditions for the processing of personal data set out in Article 5 of the Personal Data Protection Act; in particular,
- Where expressly provided for in the legislation,
- It is essential for the data controller to be able to fulfil its legal obligations,
- Where data processing is necessary for the establishment, exercise or defence of a legal claim,
- Where data processing is necessary for the legitimate interests of the data controller, provided that this does not infringe upon the fundamental rights and freedoms of the data subject
may be processed on the basis of legal grounds.
In cases where a personal data processing activity must be based on explicit consent, separate explicit consent is obtained from the user for the relevant processing. The information notice and the explicit consent process are carried out separately.
5. Method of Collecting Personal Data
Personal data;
- Users entering information directly onto the platform,
- Creation of a user account,
- Filling in event or application forms,
- Uploading documents or content to the system,
- The use of event evaluation processes,
- Electronic transactions between the user and the system,
- Server, security and system logs
may be obtained electronically, in whole or in part, by automated means.
6. Transfer of Personal Data
Personal data shall be processed only where necessary for the performance of the relevant operation and to the extent permitted by law;
- The relevant academic and administrative departments of Bolu Abant İzzet Baysal University,
- The authorised organisers of the event in question,
- Authorised persons in the application and assessment processes,
- Authorised service providers from whom services are procured in the field of information technology and system security,
- Public bodies and organisations with legal authority, courts and other competent authorities
can be shared with.
The principle of data minimisation is applied when transferring personal data, and only the information necessary to carry out the transaction is transferred.
Where, within the scope of EBP, a service is used that requires the transfer of personal data abroad, the transfer shall be carried out in accordance with the provisions of the Personal Data Protection Act (KVKK) relating to data transfers abroad and other applicable regulations, and the data subjects shall be informed separately to the extent necessary.
7. Retention of Personal Data
Personal data is retained for as long as is necessary for the purpose for which it is processed and in accordance with the retention periods set out in the relevant legislation.
Where the purpose of processing no longer applies and there is no other legal obligation requiring the retention of the data, personal data shall be erased, destroyed or anonymised in accordance with the relevant legislation.
8 Information Security
Bolu Abant İzzet Baysal University aims to implement appropriate administrative and technical security measures to prevent the unlawful processing of personal data, as well as unauthorised access to, alteration, disclosure, loss or damage of such data.
Access to the system is restricted on an authorisation basis, and the necessary logging and control mechanisms may be used to ensure information security.
Users are also responsible for safeguarding the confidentiality of their account details and passwords, and for not sharing their accounts with unauthorised persons.
9 Cookies and Technical Logs
In order to ensure that EBP operates correctly, securely and without interruption, essential cookies may be used for functions such as session management, security and user authentication.
Where non-essential analytical, performance or similar cookies are used, users are informed separately and, where required by the relevant legislation, their preferences are obtained.
Technical logs, such as IP addresses, browser information, session times and system activity, may be retained for the purposes of information security, fault detection and the prevention of system misuse.
10 Pieces of Content Shared by Users
Profile information, activities, applications, documents or other content created by users via EBP may be processed for the purpose of providing the relevant service.
Users are advised not to include personal data relating to themselves or third parties in the documents they upload to the system, where such data is not necessary for the provision of the service.
The user is obliged to act in accordance with the relevant legislation when transferring third-party data into the system.
11 Third-Party Websites
The EBP may contain links to the websites of other organisations or institutions.
The privacy practices and content of third-party websites may be beyond the control of Bolu Abant İzzet Baysal University. Users are advised to review the privacy and personal data policies of the websites to which they are redirected.
12 Rights of Data Subjects
Under Article 11 of the Law on the Protection of Personal Data No. 6698, data subjects;
- ✓ The right to find out whether your personal data is being processed,
- ✓ To request information regarding the processing of personal data,
- ✓ The right to be informed of the purpose for which your personal data is processed and whether it is being used in accordance with that purpose,
- ✓ The right to know the third parties to whom personal data has been transferred, whether within the country or abroad,
- ✓ The right to request the rectification of personal data where it has been processed inaccurately or incompletely,
- ✓ The right to request the erasure or destruction of personal data in accordance with the conditions set out in the law,
- ✓ The right to request that third parties to whom personal data has been disclosed be informed of any rectification, erasure or destruction of such data,
- ✓ The right to object to a decision being made solely on the basis of the analysis of processed data by automated systems, where such a decision results in a decision that is detrimental to the individual,
- ✓ The right to claim compensation for any loss suffered as a result of the unlawful processing of personal data
13 Applications and Contact
Requests falling within the scope of the Personal Data Protection Act may be submitted to the University in accordance with the procedures for data subject requests set out on the Bolu Abant İzzet Baysal University website.
Applications:
Applications may be made via the addresses provided or using other application methods announced by the University.
Applications are processed within the timeframes specified in Law No. 6698 and the relevant legislation, depending on the nature of the application.
14. Possible Changes to the Privacy Policy
This Privacy Policy may be updated in line with any changes to the legislation, EBP’s technical infrastructure or the services provided via the platform.
The current text shall take effect from the date of its publication on ebp.ibu.edu.tr.
In the event of significant changes, users may be notified via the platform using appropriate methods.
Bolu Abant İzzet Baysal University
EBP – ebp.ibu.edu.tr