Privacy Policy

Privacy Policy

Last updated: [DD Month 2026]

Introduction

Hasan Kalyoncu University (“HKU”, “the University”, “we”, “us”) is committed to protecting the personal data of our students, applicants, staff, alumni, and website visitors. This Privacy Policy explains what information we collect, how we use it, the legal grounds on which we process it, and the rights you have over your data.

We process personal data in accordance with the Turkish Personal Data Protection Law no. 6698 (“KVKK”), the European Union General Data Protection Regulation (“GDPR”) for visitors based in the EU/EEA, and other applicable Turkish higher-education and electronic communications legislation. As a data controller within the meaning of KVKK Article 3, the University takes responsibility for the lawful, fair and transparent handling of your information.

By using our websites, applying for a programme, enrolling as a student, or otherwise interacting with the University, you acknowledge the practices described in this policy.

Data We Collect

Depending on your relationship with the University, we may collect the following categories of data:

  • Identity and contact information: full name, national ID or passport number, date of birth, nationality, postal address, email address, and telephone number.
  • Academic information: high-school and university transcripts, language test results, application essays, programme of study, course enrolments, grades, attendance, thesis records, and graduation status.
  • Financial information: tuition payments, scholarship records, invoicing data, and billing addresses.
  • Browsing and technical data: IP address, device type, browser, operating system, referring URLs, and pages visited, collected through cookies and analytics tools.
  • Communications: emails, support tickets, contact-form submissions, recorded calls to our switchboard where notified, and correspondence with academic and administrative units.
  • Visual and audio recordings: CCTV footage on campus, photographs and videos taken at university events.

How We Use Your Data

We use your personal data for the following purposes:

  • Processing applications, admissions decisions, and registration.
  • Delivering academic services, including the Learning Management System, library services, and university email.
  • Communicating with you about your studies, events, scholarships, and university announcements.
  • Issuing diplomas, transcripts, and official documents.
  • Fulfilling our legal obligations under Turkish higher-education, tax, social-security, and accounting law.
  • Conducting research, statistics, and service improvement using anonymised or aggregated data.
  • Ensuring campus security and the safety of our community.

Legal Basis for Processing

We rely on the lawful bases set out in KVKK Article 5 (and Article 6 for special categories of personal data) and on the corresponding bases of GDPR Article 6:

  • Consent, where you have explicitly agreed to processing.
  • Performance of a contract, including your enrolment agreement and accommodation contracts.
  • Compliance with a legal obligation, such as student-record reporting to the Council of Higher Education (YÖK).
  • Legitimate interests of the University, such as managing alumni relations and protecting our IT infrastructure.
  • Public interest, where processing is necessary for the provision of higher education.

Data Sharing

We share personal data only where it is necessary and lawful:

  • Within HKU: with academic and administrative units that need the information to perform their duties.
  • With service providers: cloud hosting, email, payment processing, plagiarism detection, and analytics partners, all of whom act under written data-processing agreements.
  • With public authorities: YÖK, ÖSYM, the Ministry of National Education, the Social Security Institution, tax authorities, and law-enforcement bodies when legally required.
  • International transfers: where data is transferred outside Türkiye, we apply appropriate safeguards in line with KVKK Article 9 and, where relevant, GDPR Chapter V (such as standard contractual clauses).

Your Rights

Under KVKK Article 11 and the GDPR, you have the right to:

  • Request access to your personal data.
  • Request rectification of inaccurate or incomplete data.
  • Request erasure or destruction of your data where the legal grounds no longer apply.
  • Object to processing or request its restriction.
  • Request data portability in a structured, commonly used format.
  • Withdraw any previously given consent.
  • Lodge a complaint with the supervisory authority.

To exercise these rights, please contact our Data Protection Officer at kvkk@hku.edu.tr using a written, signed request. We will respond within thirty (30) days.

Cookies

Our websites use cookies and similar technologies to operate properly, remember your preferences, analyse traffic, and improve your experience. You can manage cookie preferences through your browser settings. For full details, please see our Cookie Policy.

Data Security

We apply technical and organisational security measures appropriate to the risk, including encryption in transit, access controls, role-based permissions, network segmentation, regular vulnerability assessments, staff awareness training, and incident-response procedures. Despite our best efforts, no system is entirely risk-free; we will notify you and the competent authorities of any qualifying personal-data breach without undue delay.

Retention Periods

We retain personal data only as long as necessary for the purposes described above and to meet legal obligations:

  • Application records of unsuccessful candidates: 2 years.
  • Active student records and academic files: for the duration of study.
  • Diplomas, transcripts and graduation files: permanently, as required by Turkish higher-education law.
  • Financial records: 10 years, in line with the Turkish Commercial Code.
  • CCTV recordings: typically 30 days, unless required for an investigation.

Contact for Privacy Matters

Data Protection Officer (KVKK Sorumlusu) Hasan Kalyoncu University Havaalanı Yolu 8.km, Şahinbey / Gaziantep, Türkiye Email: kvkk@hku.edu.tr General enquiries: info@hku.edu.tr Phone: 444 6 458

Changes to This Policy

We may update this Privacy Policy to reflect changes in law, technology, or our services. The “Last updated” date at the top of this page indicates when the policy was most recently revised. Material changes will be communicated through our website and, where appropriate, by direct notification.

Supervisory Authority

If you believe your rights have not been respected, you may submit a complaint to the Personal Data Protection Authority of Türkiye (Kişisel Verileri Koruma Kurumu — KVKK) at www.kvkk.gov.tr. Visitors based in the EU/EEA may also contact the supervisory authority of their country of residence.