Under the Personal Data Protection Law No. 6698 ("KVKK"), the data controller is Good Plan Eğitim Danışmanlığı ve Dış Ticaret Limited Şirketi ("the Company").
Address: Fetih Mah. Kemaliye Sok. Köşk Apt. No:6 D:6, 34704 Ataşehir/İstanbul
E-mail: iletisim@goodplan.com.tr
To the extent required by the selected service, or where the data subject has separately given explicit consent, the following personal data may be processed:
Identity data: Name, surname, date and place of birth, nationality, Turkish ID number, passport and identity document details, signature and photograph;
Contact data: Address, phone number, e-mail address and other contact details;
Education and professional data: Education history, diploma, transcript, foreign language skills, exam results, certificates, occupation, employment and CV information;
Travel, visa and application data: Previous travels, visa and refusal information, application forms, appointment, admission, enrolment, accommodation, insurance and documents requested by the relevant institutions;
Financial data: Payment, invoice, bank account, financial capacity, sponsor, income and asset information;
Transaction and security data: Contract and electronic approval records, IP address, location, date and time, document hash, time stamp, signing and audit trail records, correspondence, CRM, application, payment, complaint and request records, and video recordings taken for the physical security of our offices;
Biometric signature data: Behavioural biometric data consisting of the movement, speed, direction, rhythm, acceleration and, where available, pressure of the signature; this may be processed to sign the contract and its annexes, verify the signature, ensure document integrity and transaction security, and provide evidence in disputes.
Special categories of personal data: Health and disability data and data on criminal convictions and security measures, only where the selected application requires it.
Voice, image and promotional data: Voice and video recordings of phone, online or in-person meetings; satisfaction comments and reviews, admission or visa results, and the name, initial of the surname, destination country and, where applicable, institution details that the data subject has agreed may be shared. Separate explicit consent is obtained where required for the use of photographs, videos or voice recordings for advertising or promotional purposes.
Third-party data: Identity, contact, kinship, occupation, income, assets, bank account, financial capacity and other information required by the application belonging to family members, relatives and other persons connected with the application.
This data is processed for the purposes of preparing service offers, establishing and performing the contract, carrying out selected application processes such as education institution, visa, admission, enrolment, accommodation and insurance, communicating with you, receiving payments, keeping accounting and legal records, examining requests and complaints, protecting legal rights and ensuring the security of physical premises. Personal data and special categories of personal data that are not necessary for the application are not requested. If the "Meeting Records" preference in the Explicit Consent Text is approved, meeting records may be processed for the purposes stated in that preference. If the "Satisfaction Comments and Success Sharing" preference is approved, comments, reviews and application results may be shared only within the information and channels stated in that preference. For data storage, cloud, appointment, communication, software and technical infrastructure activities related to the application, where no other processing condition under the Law applies, the explicit consent given under the "Carrying Out Application Processes" preference is relied upon.
Personal data may be transferred, to the extent necessary to carry out the selected service or the meeting recording, satisfaction comment and success sharing, advertising or promotional and technical infrastructure activities approved through the relevant preference in the Explicit Consent Text or through separate explicit consent where required, to education institutions, consulates, embassies, visa application centres, authorised public institutions, insurance and accommodation providers, banks, payment institutions, legal and financial advisers, information technology, communication, data storage, cloud, software, platform and technical infrastructure providers, advertising, promotion, content production and social media service providers, business partners, solution partners and other authorised service providers. Only the Company's assigned and authorised units can access voice, image and meeting recordings.
The official title and country of a foreign education institution or application recipient are shown in the Pricing and Service Approval Form or in the written or electronic application, request, approval or payment records of the Client or the Applicant.
Transfers abroad are carried out on the basis of an adequacy decision, appropriate safeguards, standard contracts or another legally applicable transfer mechanism under Article 9 of the KVKK. Where there is no adequacy decision or appropriate safeguard, only the occasional transfer cases regulated in the KVKK whose conditions are met in the specific case may be relied upon.
Personal data is obtained, wholly or partly by automated means or by non-automated means as part of a data recording system, from contracts, forms and documents submitted by the Client, the Applicant, a legal representative or a Sponsor; from e-mail, phone, the website, durable data media, and online or in-person meetings; and, during the application process, from the Education Institution, the Authorities or the relevant service provider.
The Client's identity, contact, education, professional, travel, application, financial and transaction data are processed under KVKK Art. 5/2-c where directly related to and necessary for the establishment or performance of the contract. Accounting, invoice, tax and other legal records are processed under KVKK Art. 5/2-ç; dispute, request, complaint and evidence records under KVKK Art. 5/2-e; and records necessary and proportionate for information security and physical security under KVKK Art. 5/2-f, provided that they do not harm the fundamental rights and freedoms of the data subject.
Biometric signature data is obtained automatically through the biometric signature platform when the data subject signs on screen, and is processed under KVKK Art. 6/3-a on the basis of the data subject's separate and optional explicit consent. If explicit consent is not given, the contract may be signed by another method that does not process biometric data.
The general personal data of an adult Applicant who is different from the Client is processed, where no other processing condition applies, on the basis of the explicit consent separately given by the Applicant. If the Applicant is a minor, the necessary declaration is made by their legal representative.
Health and disability data and data on criminal convictions and security measures are processed on the basis of explicit consent separately given by the data subject, unless another processing condition under KVKK Art. 6/3 applies.
Video recording for security purposes in our physical offices may be carried out under KVKK Art. 5/2-f to the extent necessary and proportionate. Office security cameras do not continuously record audio. Meetings held in the office may be recorded within the scope stated in the "Meeting Records" preference in the Explicit Consent Text.
The voice and/or video recording of phone, online or in-person meetings, and the processing of these recordings to improve service quality, ensure client safety, evaluate employee performance, examine incidents and complaints and, where necessary, use them as evidence in legal disputes, are based on the separate and optional explicit consent given by the data subject in the "Meeting Records" preference in the Explicit Consent Text, unless another processing condition under the Law applies.
Sharing comments and reviews about the service, and admission or visa results, on the Company's website and social media accounts, limited to the name, initial of the surname, destination country and, where applicable, institution, is based on the "Satisfaction Comments and Success Sharing" preference in the Explicit Consent Text. The use of photographs, videos or voice recordings for advertising or promotional purposes is not covered by this preference, and separate explicit consent is obtained where required.
The processing of personal data within data storage, cloud, appointment, communication, software, platform and technical infrastructure services necessary to carry out the selected application, or its transfer to service providers, is based on the "Carrying Out Application Processes" preference in the Explicit Consent Text where no other processing condition under the KVKK applies. Transfers abroad are in all cases carried out in accordance with the conditions in KVKK Art. 9.
General personal data needed for application processes, and data on health, disability, criminal convictions and security measures, may be transferred to education institutions, consulates, visa application centres, universities, banks, insurance and accommodation providers and authorised public institutions to the extent the data subject has separately approved in the Explicit Consent Text. For transfers abroad, explicit consent is used as a transfer condition only in cases where KVKK Art. 9 allows reliance on explicit consent.
Where the Client shares data belonging to a family member, relative or other third party, the Client declares that they are authorised to share this data with the Company. The declaration regarding family members and relatives under the "Carrying Out Application Processes" heading of the Explicit Consent Text is a declaration that the Client has requested the relevant application process and is authorised to share the data; it does not replace the explicit consent of the third party whose data is processed, or of their legal representative, where such consent is required. Where the Company has not obtained personal data directly from the data subject, it informs the data subject separately, except for the exceptions set out in the legislation. For Sponsor data, the Sponsor Personal Data Disclosure and Explicit Consent Form applies.
When the storage periods required by law expire, judicial processes are completed or other requirements no longer apply, personal data is deleted, destroyed or anonymised by our Company, either automatically or at the request of the data subject (under Article 11 of the KVKK).
Accordingly, data subjects have the right to: learn whether their personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties in Türkiye or abroad to whom their personal data is transferred; request correction of incomplete or inaccurate data and notification of this to the third parties to whom the data was transferred; request deletion or destruction of their personal data where the reasons for processing no longer exist, despite having been processed in accordance with the KVKK and other relevant laws, and notification of this to the third parties to whom the data was transferred; object to a result against them arising from analysis exclusively through automated systems; and claim compensation for damage caused by unlawful processing of their personal data.
Requests under Article 11 of the KVKK may be submitted, including information identifying the data subject and the subject of the request, in writing to the Company's address above; by registered electronic mail (KEP), secure electronic signature or mobile signature; from the e-mail address previously notified to the Company and registered in the Company's system to iletisim@goodplan.com.tr; or by other methods accepted by the legislation. Use of the application form prepared by the Company is optional and is not a condition of validity. Duly submitted requests are concluded as soon as possible depending on their nature and within thirty days at the latest. If the process requires an additional cost, the tariff set by the Personal Data Protection Board applies.
