–

Culture Unleashed Personal Data Protection and Processing Policy

Introduction

The Law on the Protection of Personal Data No. 6698 (“KVKK”), which was developed over many years in line with European Union standards, entered into force following its publication in the Official Gazette dated 7 April 2016.

KVKK closely mirrors the provisions of Directive 95/46/EC of the European Union, and with its enactment, the protection of individuals’ personal data has been formally regulated under a comprehensive legal framework.

As the data of legal entities is already protected under existing legislation, KVKK—similar to the EU’s General Data Protection Regulation (GDPR)—limits the scope of protection to personal data relating to natural persons.

The Law provides a regulatory framework for the protection of personal data and the exercise of the rights listed in Article 11 of KVKK. It sets out provisions on the definition and classification of personal data, processing of personal data, the obligation to inform the data subject, explicit consent and exceptions, the obligations of data controllers and processors, the establishment of the Personal Data Protection Authority, complaint and appeal mechanisms, and applicable sanctions.

Purpose and Scope

This Policy sets forth the main principles, responsibilities, and procedures applicable to Culture Unleashed Danışmanlık Hizmetleri Limited Şirketi (“Culture Unleashed”) regarding the protection and processing of personal data. It applies to all employees, partners, suppliers, members, prospective members, and participants in events or activities organized by Culture Unleashed.

Definitions

Explicit Consent: Refers to consent that is related to a specific matter, based on information, and expressed with free will.

Anonymization: Refers to the process of rendering personal data impossible to associate with an identified or identifiable natural person, even by matching it with other data.

Personal Data: Any information relating to an identified or identifiable natural person.

Personal Data Processing Inventory: Refers to the inventory created by data controllers based on their business processes, which associates the personal data processing activities they carry out with purposes and legal grounds for processing, data categories, recipient groups, and categories of data subjects, and which details the maximum retention periods required for the purposes of processing, any cross-border data transfers, and the technical and organizational measures taken to ensure data security.

Processing of Personal Data: Refers to any operation performed on personal data, wholly or partly by automatic means or by non-automatic means provided that it is part of a data filing system, such as the collection, recording, storage, retention, alteration, rearrangement, disclosure, transfer, acquisition, making available, classification, or prevention of use of personal data.

Personal Data Retention and Disposal Policy: Refers to the policy used by data controllers to determine the maximum retention period required for the purposes for which personal data is processed, and to establish the basis for deletion, destruction, or anonymization operations.

Special Categories of Personal Data (Sensitive Data): Refers to data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Data Subject: The natural person whose personal data is processed.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data; in this context, Culture Unleashed.

Policy Implementation and Responsibilities

  1. Culture Unleashed, as the Data Controller, is responsible for the application of this policy across all internal processes and operations.
  2. A governance model will be established and implemented by Culture Unleashed to ensure the enforcement of regulations, procedures, guidelines, standards, and training activities prepared in line with this policy.
  3. Members and business partners of Culture Unleashed and all related third parties are obliged to cooperate with Culture Unleashed in preventing legal responsibilities, risks, and threats that may arise in accordance with the legal provisions concerning compliance with the policy.
  4. All personnel and members of Culture Unleashed are obliged to act in accordance with this policy and to ensure compliance with its provisions.
  5. This policy will be announced within Culture Unleashed and uploaded to common IT systems to ensure constant accessibility. It will also be published on the Culture Unleashed website. Any changes made to this policy will be updated in the IT systems and on the website to ensure data subjects are informed of the principles set out in the policy.
  6. In case of any conflict between this policy and the provisions of applicable legislation, Culture Unleashed, in its capacity as Data Controller, acknowledges that the provisions of the legislation shall prevail.

Core Principles

Culture Unleashed acts in accordance with the following core principles:

  1. Compliance with law and principles of integrity
  2. Accuracy and up-to-dateness
  3. Processing for specific, explicit and legitimate purposes
  4. Data minimization (processing only to the extent necessary)
  5. Storage limitation in accordance with the durations prescribed in relevant legislation

Purposes of Personal Data Processing

Personal data is processed for the following purposes:

  1. Event planning and participant management,
  2. Evaluation of membership applications,
  3. Execution of service agreements,
  4. Promotional and informational activities,
  5. Fulfillment of administrative, legal, and financial obligations.

Conditions for Processing Personal Data

Article 5 of the KVKK regulates the conditions for the processing of personal data. The personal data processing activities carried out by Culture Unleashed are conducted in accordance with the following legal grounds set forth in the Law:

Presence of Explicit Consent of the Data Subject

The primary rule in the processing of personal data is the presence of explicit consent of the data subject in cases where no other data processing condition exists. Culture Unleashed shall carry out data processing activities based on the explicit consent to be given by the data subject, upon being informed in a manner that leaves no room for doubt and regarding the purpose of the processing, as prescribed by the KVKK.

Processing Required by Law

Even in the absence of explicit consent, personal data may be processed lawfully if required by legislation, provided that other necessary criteria are met.

Processing of the Personal Data of a Person Who Is Unable to Declare Consent Due to Actual Impossibility or Whose Consent Cannot Be Deemed Legally Valid, Where Processing Is Necessary for the Protection of Their Own or Another Person’s Life or Physical Integrity

Pursuant to the KVKK, in cases where the data subject is factually unable to declare their consent or where their consent cannot be deemed legally valid, personal data may be processed if it is necessary for the protection of the life or physical integrity of the data subject or another person. Culture Unleashed shall process personal data in such cases as set forth under this provision.

Processing of Personal Data of the Parties to a Contract, Provided That It Is Directly Related to the Establishment or Performance of the Contract 

Personal data belonging to the parties to a contract may be processed by Culture Unleashed, provided that it is directly related to the establishment or performance of the contract.

Processing of Personal Data Where It Is Necessary for the Data Controller to Fulfil Its Legal Obligation

Pursuant to the KVKK, personal data shall be processed by Culture Unleashed, in its capacity as Data Controller, where such processing is necessary for the fulfilment of its legal obligations, provided that it remains within the limits of the relevant obligation.

Processing of Personal Data Made Public by the Data Subject

In the event that the data subject has made their personal data public, such personal data shall be processed by Culture Unleashed in proportion to the purpose of the disclosure.

Processing of Personal Data Where It Is Necessary for the Establishment, Exercise, or Protection of a Right

Personal data shall be processed by Culture Unleashed to the extent that it is necessary for the establishment, exercise, or protection of a right.

Processing of Personal Data for the Legitimate Interests of the Data Controller

Provided that it does not harm the fundamental rights and freedoms of the data subject, personal data may be processed in line with the legitimate interests of Culture Unleashed in its capacity as Data Controller. However, the notion of legitimate interest shall under no circumstances conflict with the principles set forth in the KVKK, the purpose of the personal data processing, or constitute an infringement on the essence of the rights guaranteed under the Constitution.

Erasure, Destruction, or Anonymization of Personal Data

Even if personal data has been processed in accordance with the KVKK, other applicable legislation, and this Policy, such data shall be erased, destroyed, or anonymized by Culture Unleashed either upon the elimination of the reasons requiring its processing or at the request of the data subject. Culture Unleashed shall establish the necessary administrative and technical infrastructure to comply with all current and future legislative provisions concerning the erasure, destruction, or anonymization of personal data. The retention periods for the personal data subject to destruction are specified in the Personal Data Processing Inventory and the Personal Data Retention and Disposal Policy.

Methods of Collecting Personal Data and Legal Grounds

Personal data is collected through digital forms, email communications, event registration systems, and referrals. The processing activities are based on the legal grounds set forth in Article 5 of the KVKK, including explicit consent, the establishment or performance of a contract, legitimate interest, and legal obligations.

Transfer of Personal Data

Personal data collected by Culture Unleashed may be transferred to the following individuals and entities, provided that the conditions for personal data processing set forth in Articles 8 and 9 of the KVKK are met and that the relevant data subjects are duly informed:

  1. Public institutions and regulatory authorities (for the purpose of fulfilling obligations arising from legislation),
  2. Financial advisors and legal consultants,
  3. Business partners and suppliers (for the purpose of fulfilling contractual obligations),
  4. Indirect shareholders and affiliates (only to the extent necessary for the continuation of operations).

Furthermore, in cases where it becomes necessary to store or process personal data abroad (for example, when using cloud-based systems such as Google Workspace), Culture Unleashed shall carry out the transfer of personal data abroad in accordance with Article 9 of the KVKK, based on the Standard Contractual Clauses (SSCs) published by the Personal Data Protection Authority and by taking the necessary security measures.

Explicit consent shall only be relied upon in exceptional cases, where safeguards such as SSCs cannot be implemented due to unforeseen circumstances. Culture Unleashed is obliged to take all necessary technical and administrative measures to ensure data security throughout the data transfer processes.

Obligations of Culture Unleashed in Its Capacity as Data Controller

  1. Obligation to inform (transparency obligation)
  2. Obligation to ensure the security of personal data, including:
    • Preventing the unlawful processing of personal data,
    • Implementing technical measures to ensure the lawful processing of personal data,
    • Implementing administrative measures to ensure the lawful processing of personal data,
    • Preventing unlawful access to personal data,
    • Implementing technical measures to ensure lawful access to and secure storage of personal data,
    • Implementing administrative measures to ensure lawful access to and secure storage of personal data,
    • Monitoring and auditing the measures taken for the protection of personal data.

Data Security Measures

To ensure the protection of personal data, Culture Unleashed:

  1. Establishes an access authorization matrix,
  2. Implements technical and administrative measures for data security,
  3. Conducts periodic audits,
  4. Implements a response plan for data breaches.

Rights of the Data Subject

Data subjects have the right to:

  1. Learn whether their personal data is being processed,
  2. Request information regarding the purpose of processing and whether the processing is appropriate for that purpose,
  3. Request the rectification, erasure, or destruction of their personal data,
  4. Learn the third parties to whom their personal data has been transferred.

Requests and Contact

Data subjects may submit their requests to exercise their rights by contacting hello@cultureunleashed.io. All requests shall be concluded within 30 days.

Entry into Force and Updates

This policy has been approved by the management of Culture Unleashed. It shall be reviewed at regular intervals and updated when necessary.

Effective Date: 13.10.2025

Approved by: Emre Erbirer and Mustafa Gül