Personal Data Protection Notice (KVKK) and Data Policy

1. IDENTITY OF THE DATA CONTROLLER AND INTRODUCTION

1.1. Data Controller Information

Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), Dog Craft Academy (the “Academy”) is responsible, in its capacity as data controller, for your personal data collected through the website with the domain name www.dogcraftacademy.com, the DCA Family Management Panel, digital analysis forms and social responsibility projects (Skoru Eşitle, etc.).

• Data Controller: Dog Craft Academy
• Contact Email: info@dogcraftacademy.com
• Website: www.dogcraftacademy.com

1.2. Purpose and Scope of the Policy

This Notice has been prepared to transparently explain, in relation to the dog training, behavioral rehabilitation, professional triage and media/casting processes carried out by our Academy, the purposes for which the personal data of our clients, participants and panel users is processed, to whom and for what purposes it may be transferred, our data collection methods, and your legal rights as a data subject.

1.3. Our Commitment

At Dog Craft Academy, we apply the same scientific rigor to ensuring the security of your and your family’s data that we apply to protecting your dog’s psychological well-being. Your data is processed solely for the purpose of providing you and your companion with the most accurate guidance, in compliance with the law and the rules of good faith.

2. CONCEPTS AND DEFINITIONS

The key concepts used in this policy that describe the operational processes of Dog Craft Academy (the “Academy”) are defined below:

• Personal Data: Any information relating to an identified or identifiable natural person (name, telephone number, IP address, etc.).
• Special Categories of Personal Data: Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, as well as biometric and genetic data. (Household health and safety information in DCA analysis forms is assessed within this scope.)
• Data Subject: A client, a family member receiving training, a participant in the "Skoru Eşitle" project or a user of the DCA panel whose personal data is processed.
• Data Controller: Dog Craft Academy, which determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
• DCA Family Management Panel: A digital platform, accessed with a username and password, exclusively for individuals receiving training at the Academy or included in a project.
• Professional Triage: An expert-opinion-based prioritization and selection system used in the "Skoru Eşitle" project and other rehabilitation processes, taking into account the urgency of cases, safety risks and the Academy’s resources.
• LIMA Protocol: (Least Intrusive, Minimally Aversive) The discipline on which the Academy bases its dog training processes, representing the least intrusive and least aversive approach and the highest standards of scientific ethics.
• Log Records: The digital recording of user activity on the DCA panel and the website (login/logout times, content accessed, etc.) for the purpose of system security.
• Case Analysis Materials: Photographs, videos and audio recordings collected throughout the training process that capture the dog’s behavior and the family’s implementation methods.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Within the scope of the training, consultancy and social responsibility projects offered by the Academy, personal data whose processing is necessary by the nature of the service is classified under the following categories in accordance with the fundamental principles of the KVKK:

3.1. Identity and Contact Information

For the purposes of identifying the user and ensuring uninterrupted communication: name and surname, telephone number, email address and the full address at which the service will be provided.

3.2. Professional and Socio-Economic Data

In order to analyze daily discipline, work pace and the time that can be devoted to training protocols: occupation and working arrangement (from home, from the office, hybrid, etc.).

3.3. Living Space and Family Dynamics Data

In order to understand the energy and social environment of the home in which the dog lives: household structure (living alone, adult members, presence of children/babies, presence of elderly persons or persons in need of care) and information on other pets in the home.

3.4. Dog and Behavioral Science Data

Data of vital importance for the "Rehabilitation Protocol" and "Professional Triage" processes: the dog’s breed, age, sex, origin (shelter, street, etc.), health history, trauma records, reactions to other living beings and the specific behavioral disorders it displays.

3.5. Visual and Audio Data

For the purposes of case analysis, remote progress tracking and the provision of feedback: photographs, videos and audio recordings shared by you or recorded during training sessions.

3.6. Transaction Security and Digital Data

For the purpose of ensuring access security for the DCA Family Management Panel: username, encrypted password data, system login/logout times (log records) and IP address information.

3.7. Casting and Media Data (Only Upon Consent)

For candidates wishing to take part in "Talent & Media" processes: the dog’s degree of suitability for on-set performance, physical characteristics and special skill records.

4. METHODS AND CHANNELS OF PERSONAL DATA COLLECTION

Depending on the nature of your contact with Dog Craft Academy (the “Academy”), your personal data is collected verbally, in writing or electronically, by fully or partially automated means, or by non-automated means provided that it forms part of a data filing system, through the following channels:

4.1. Digital Forms and Google Infrastructure

Data is collected through the "Skoru Eşitle Pre-Application and Analysis Form", the "Pre-Adoption Consulting Form" and other branch-specific questionnaires accessed via our website (www.dogcraftacademy.com). Form information is stored on the Academy’s own server, and application videos are stored in the Academy’s Google Drive account.

4.2. DCA Family Management Panel

Data is collected when families who begin training at the Academy log in to the system with the username and password assigned to them, access content and interact with the system (log records).

4.3. Remote Analysis and Visual Sharing

Data is collected through the videos, photographs and audio recordings you send to us via WhatsApp, email or cloud-based file sharing systems so that we can analyze your dog’s behavior.

4.4. In-Person Sessions and Field Work

Data is collected through observation notes and operational records kept by our expert trainers during home visits, outdoor training sessions or casting/on-set performance assessments.

4.5. Corporate Communication Channels

Data is collected through written or verbal communications established via the Academy’s official telephone lines, social media accounts (DM) and the address info@dogcraftacademy.com.

4.6. Cookies and Analytics Tools

Data is collected through cookies and similar tracking technologies used during your visit to our website in order to improve your user experience and analyze site traffic.

5. PURPOSES OF DATA PROCESSING AND OPERATIONAL REQUIREMENTS

Dog Craft Academy (the “Academy”) processes your personal data in accordance with Articles 4, 5 and 6 of the KVKK for the purposes of carrying out the operational processes set out below and improving service quality:

5.1. Performance of the Service and Personalized Training Protocols

The identity, living space and dog behavior data collected is processed for the purpose of creating the "Rehabilitation Protocol" and "Conscious Guidance" strategies best suited to each dog’s biological reality and the family’s daily routines.

5.2. Professional Triage and Project Acceptance Processes

Within the scope of the "Skoru Eşitle" project and other intensive training programs, data is processed for the purpose of prioritizing applications, based on expert opinion, according to urgency, safety risk, case type and the Academy’s capacity (Triage).

5.3. Management of the DCA Family Management Panel

Data is processed for the purposes of ensuring users’ secure access to the system and assigning and tracking personalized content in parallel with the training process.

5.4. Case Analysis and Progress Reporting

Visual and audio materials shared by you are processed for the purposes of analyzing the dog’s behavioral development moment by moment, preparing feedback by the assigned trainer and measuring the success of the process.

5.5. Lifelong Guidance and Communication Support

Even after in-person sessions have been completed, data is processed within the scope of our "Lifelong Guidance" promise to clients who are part of the DCA family, for the purposes of providing emergency support, preventing new crises and ensuring continuity of communication.

5.6. Talent & Media (Casting) Portfolio Management

For consenting users only, data is processed for the purposes of assessing the dog’s suitability for on-set performance, matching it with suitable projects and managing its career planning in the media world.

5.7. Ensuring Legal and Commercial Security

Data is processed for the purposes of concluding service contracts, managing invoicing processes, auditing system security by means of log records and responding to information requests from competent authorities.

6. INFORMATION ON THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

As a rule, Dog Craft Academy (the “Academy”) does not request from its clients the special categories of data listed in Article 6 of the KVKK (religion, race, political opinion, biometric data, etc.). However, owing to the nature of the dog training and rehabilitation service provided, sensitive data is processed in the following respects within the scope of "Professional Necessity" and "Safety":

6.1. Household Health and Safety Dynamics

To ensure that our training protocols (particularly in cases of aggression and reactivity) do not cause harm to the residents of the home, information is processed as to whether there is a baby, a child or an individual in need of special care/a vulnerable individual in the home. This data is used solely in operational risk analysis and "Professional Triage" processes.

6.2. Dog Health and Genetic History

Your dog’s pharmacological history, past surgeries or genetic predispositions that may hinder the rehabilitation process are processed for the purpose of determining the dosage of physical and mental stimulation to be used in training. Where necessary, and only with your consent, this data may be shared for "Consultation" purposes with the expert veterinarians who are our solution partners.

6.3. Visual Recordings Qualifying as Biometric Data

Facial or voice recordings contained in videos shared during analysis processes are processed by us not for the purpose of processing "Biometric Data", but exclusively for the purposes of behavior analysis and measuring training performance.

6.4. Processing Condition and Explicit Consent

Such sensitive data is processed with the "Explicit Consent" of the data subject pursuant to Article 6(2) of the KVKK, or, pursuant to Article 6(3), for the performance of operational processes (dog rehabilitation and public safety) that support "the protection of public health, preventive medicine and medical diagnosis" processes.

7. PRINCIPLES FOR THE USE OF VISUAL AND AUDIO DATA (VIDEOS/PHOTOGRAPHS)

Owing to the observation-, recording- and analysis-oriented nature of canine behavioral science, Dog Craft Academy (the “Academy”) processes visual and audio materials (photographs, videos, audio recordings) within the framework of the following disciplines:

7.1. Use for Analysis and Progress Tracking

Footage sent by you via WhatsApp, Google Drive or email, or recorded by our experts during sessions, is processed exclusively for the purposes of analyzing the dog’s behavioral development, creating a case history and preparing personalized feedback reports for you via the DCA Family Management Panel. These recordings are a technical part of the training process.

7.2. "DCA Family Management Panel" Content Assignments

Progress videos recorded during the process may be stored in your user panel, accessible only to you, as visual materials supporting your training. In accordance with system security protocols, this footage is kept closed to access by third parties.

7.3. Promotional and Social Media Sharing (Explicit Consent Requirement)

"Before / After" videos or success stories relating to training processes may be shared for promotional purposes on the Academy’s social media accounts or website if and only if the written or digital explicit consent of the data subject has been obtained. In such posts, the privacy of the family’s private living space (personal belongings in the home, faces of family members, etc.) is protected or anonymized to the greatest extent possible.

7.4. Talent & Media (Casting) Processes

Recordings made for catalog or on-set performance purposes are used solely for matching with relevant projects and for presentations to producers/directors. These recordings are assessed within the discipline of a casting agency and are not made available for general use without the person’s consent.

7.5. Academic Archive and Scientific Research

Rare behavioral data obtained during training processes may, after being completely stripped of personal information (anonymized), be used as reference cases in the Academy’s internal training processes or in scientific studies on canine behavioral science.

7.6. Deletion and Return of Recordings

The client has the right to withdraw, at the end of the training process or at any stage, the consent given for use for promotional purposes. In this case, the relevant visual materials are removed from the Academy’s promotional channels within a reasonable period of time.

8. LEGAL GROUNDS FOR DATA PROCESSING

Dog Craft Academy (the “Academy”) processes your personal data on the basis of one or more of the following legal grounds set out in Articles 5 and 6 of the KVKK:

8.1. Establishment or Performance of a Contract (Article 5(2)(c))

The processing of your data in order to launch our training programs (Puppy Training, Rehabilitation, Pre-Adoption Consulting, etc.), prepare training protocols and provide the service to you in full is directly related to the performance of the contract.

8.2. Legal Obligation of the Data Controller (Article 5(2)(ç))

Data is processed for the purposes of issuing invoices and keeping financial records in accordance with the Tax Procedure Law and related legislation, and responding to legal information requests from competent public authorities (judicial authorities, law enforcement units, etc.).

8.3. Legitimate Interests of the Data Controller, Provided That the Fundamental Rights and Freedoms of the Data Subject Are Not Harmed (Article 5(2)(f))

Ensuring our Academy’s operational efficiency, improving service quality, auditing the security of content provided via the DCA Family Management Panel and tracking your dog’s progress through its case history are considered within the scope of the Academy’s legitimate interest.

8.4. Professional Triage and Public Safety

Risk analyses and prioritization work (Triage) carried out to protect public health and safety, particularly in the rehabilitation process of dogs displaying aggression and reactivity, are conducted within the framework of the data controller’s responsibility and legitimate interests.

8.5. Existence of Explicit Consent (Article 5(1))

For processes falling outside the legal grounds above, such as the use of your dog’s photographs or videos for promotional/social media purposes, inclusion in the "Talent & Media" portfolio, or the sending of newsletters/advertising content to you, your previously obtained "Explicit Consent" declaration is relied upon.

9. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

Dog Craft Academy (the “Academy”) shares the personal data it collects within the framework of the "need-to-know" and "performance of the service" principles, in accordance with Articles 8 and 9 of the KVKK, and only to the extent limited to the following purposes and parties:

9.1. Expert Veterinarians and Health Solution Partners

Where, during the rehabilitation process, it is suspected that your dog’s behavioral disorders have a medical/biological basis, the dog’s historical data and behavioral records may be referred to the relevant expert veterinarians in order to obtain an opinion on diagnosis and pharmacological support.

9.2. Production Companies, Agencies and Directors

Only the data of users who have declared in writing that they wish to be included in the "Talent & Media" portfolio, and of their dogs, may be shared with the relevant production officials for the purposes of casting selection, project matching and on-set performance planning.

9.3. Technical Service Providers and Infrastructure Partners

Limited data sharing takes place with our professional solution partners providing website hosting, DCA Family Management Panel software support, email delivery and cloud storage services, solely for the purpose of ensuring the operability of the system.

9.4. Legal Authorities and Administrative Bodies

In the event that a legal obligation arises, that the Academy’s legal rights need to be protected, or that a duly made information request is received from competent public institutions and organizations (courts, law enforcement units, the Ministry of Agriculture and Forestry, etc.), data may be shared within the framework of legal obligations.

9.5. Operational Business Partners

In cases such as the dispatch of training materials or certificates, name and surname, address and telephone information may be transferred, to a limited extent, to cargo/courier companies.

10. CROSS-BORDER DATA TRANSFER AND USE OF CLOUD INFRASTRUCTURE

Dog Craft Academy (the “Academy”) uses international cloud computing infrastructures with high security standards for the purposes of digitally tracking training processes, storing case analyses and providing uninterrupted service to our clients.

In this context:

10.1. Platforms Used and Server Locations

Our Academy uses the infrastructure of Google Ireland Limited (Google Workspace) and secure cloud storage services for collecting analysis forms, storing training videos and operating the DCA Family Management Panel. Because the data centers (servers) of these service providers are located abroad, the data you enter into the system is, out of technical necessity, transferred abroad. In addition, the Cloudflare, Inc. network is used for the security and fast delivery of our websites; during a visit, technical connection data such as the IP address and browser information pass through this provider’s servers abroad.

10.2. Purpose and Scope of the Transfer

Such cross-border transfer is limited to the purposes of securely backing up your data, enabling you to access your training content from anywhere in the world, processing video analyses in high resolution and ensuring the digital continuity of the Academy’s operations.

10.3. Data Security Measures

The service providers to which data is transferred hold international data security standards (ISO/IEC 27001, SOC 2/3, etc.), and your data is protected by high-level encryption methods during transfer and storage. In its contracts with these providers, the Academy secures a commitment to maintaining data privacy standards.

10.4. Legal Basis and Consent

Pursuant to Article 9 of the KVKK, your filling in a form and uploading a video via our website, registering with the DCA Family Management Panel or sharing your analysis videos via cloud systems is construed as your giving "Explicit Consent" to your data being hosted on the servers of these services and consequently transferred abroad, and as your acceptance of this technical necessity.

10.5. Alternative Channels

Users who do not consent to cross-border data transfer may request to deliver their data by physical means; however, it should be borne in mind that in this case it may not be possible to benefit from the digital panel services and remote analysis support.

11. DCA FAMILY MANAGEMENT PANEL AND TRANSACTION SECURITY

In data processing activities carried out through the DCA Family Management Panel, which it provides exclusively to its clients, Dog Craft Academy (the “Academy”) bases its approach on international cybersecurity standards in order to protect the confidentiality, integrity and availability of data.

11.1. Access and Authentication

Access to the panel is provided by means of a personal username and encrypted password combination assigned to the email address declared by the client in the application form. The user is personally responsible for the confidentiality and security of the access credentials assigned to them.

11.2. Transaction Security and Log Records

In accordance with Law No. 5651 and the KVKK regulations, user activity on the panel (system login/logout times, IP address, training videos and documents accessed) is kept in digital form as "Log Records". These records are processed for the purposes of:

• Detecting and preventing unauthorized access,
• Optimizing system performance,
• Enabling the assigned trainer to manage the process (content assignment) by analyzing the client’s interaction with the content.

11.3. Data Minimization and Encryption

All data traffic on the panel is encrypted with an SSL (Secure Sockets Layer) certificate. Your passwords are stored using cryptographic methods in such a way that they cannot be viewed as plain text by anyone, including Academy officials.

11.4. Content Security and Intellectual Property

The personalized case analyses and training videos shared on the panel are the intellectual property of the Academy. In the event that this content is shared with third parties or removed from the system, transaction security records (logs) may be used as legal evidence.

11.5. Technical Malfunctions and Notification

If the user suspects unauthorized access to their account, they are obliged to inform the Academy immediately. In the event of a possible data breach, the Academy is obliged to make the necessary notifications (to the Personal Data Protection Board (KVK Kurulu) and to the Data Subject) within 72 hours in accordance with KVKK legislation.

12. USE OF DATA IN PROFESSIONAL TRIAGE AND ASSESSMENT PROCESSES

Owing to its limited resources and a case structure that requires expertise, Dog Craft Academy (the “Academy”) uses the "Professional Triage" method, a scientific prioritization system, when evaluating applications. In this context, data processing is based on the following principles:

12.1. Scope of the Triage Analysis

Data on household structure, the dog’s history of aggression, bite history and the family’s capacity to implement, collected in the "Skoru Eşitle" project and other rehabilitation applications, is processed for the purpose of determining the urgency and risk level of cases.

12.2. Basis for Acceptance and Rejection Decisions

In light of the data it collects, the Academy has full and independent authority to decide which case will be admitted to the program as a priority. Filling in a form, sharing personal data or being included in the preliminary analysis process does not constitute an undertaking or guarantee that the Academy will provide a service.

12.3. Data-Driven Risk Management

The data processed in the triage process is used to protect both public health and the dog’s welfare. As a result of the analysis of the data, high-risk cases (involving a threat to life and safety) may be prioritized, or cases outside the Academy’s area of expertise may be referred to the relevant units (veterinarian, faculty, etc.).

12.4. Transparency and Professional Independence

By providing data for the Triage process, the data subject accepts in advance that the selection criteria depend on the Academy’s professional experience, current case load and compatibility with the LIMA protocol. The algorithmic or manual assessment notes used in decision-making processes are the Academy’s trade secret and the output of its professional expertise.

12.5. Status of Rejected Applications

The data of candidates who cannot be admitted to the program as a result of triage is retained, for potential future openings or new projects (unless the data subject requests otherwise), within the periods specified in our data retention policy.

13. DATA RETENTION PERIODS AND DESTRUCTION (DELETION) POLICY

Dog Craft Academy (the “Academy”) retains the personal data it processes for the periods stipulated in the relevant legislation or required by the purpose of processing. In determining these periods, the "Lifelong Guidance" discipline and statutory limitation periods are taken as the basis.

13.1. Determination of Retention Periods

• Training and Analysis Data: Taking into account the dog’s lifespan and the sustainable guidance service provided by the Academy, this data is retained for 10 years from the completion of the active training process, for the purposes of tracking potential new behavior problems and preserving the case history.
• Financial and Commercial Records: Documents such as invoices, receipts and contracts are retained for 10 years in accordance with the Turkish Commercial Code and the Tax Procedure Law.
• Transaction Security (Log) Records: Traffic/log records on the DCA Family Management Panel and the website are retained for at least 2 years in accordance with the relevant legislation.
• Candidate and Application Data: The data of candidates who filled in a form for "Skoru Eşitle" or other projects but could not be included in the process is kept for 2 years.

13.2. Data Destruction Methods

Data whose retention period has expired or whose purpose of processing has ceased to exist is removed from the system by one of the following methods during the Academy’s periodic destruction processes or upon the request of the data subject:

• Deletion: Rendering data in digital media inaccessible and non-reusable for the relevant users.
• Destruction: Irreversibly destroying data on physical or magnetic recording media.
• Anonymization: Rendering data such that it can in no way be associated with an identified or identifiable natural person, even when matched with other data (the use of case analyses in academic studies is carried out using this method).

13.3. Destruction Request and Process

The data subject may at any time request the deletion of their data under Article 11 of the KVKK. Unless there is a legal retention obligation (e.g. tax legislation or ongoing judicial proceedings), the data is destroyed within 30 days at the latest from the date of the request.

14. YOUR RIGHTS AS A DATA SUBJECT AND APPLICATION MECHANISM

Pursuant to Article 11 of the KVKK (Law No. 6698), you have the following rights with respect to your data processed by Dog Craft Academy (the “Academy”):

14.1. Your Rights

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred, in Türkiye or abroad,
• To request the rectification of your personal data if it is incomplete or inaccurately processed,
• To request the deletion or destruction of your personal data (Right to Be Forgotten) within the framework of the conditions set out in Article 7 of the KVKK,
• To request that the rectification, deletion and destruction operations be notified to third parties to whom your data has been transferred,
• To object to a result arising against you through the analysis of the processed data exclusively by automated systems,
• To claim compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

14.2. Application Method

To exercise the rights listed above, you may submit your request, containing the information necessary to establish your identity and an explanation of which of the rights set out in Article 11 of the KVKK you wish to exercise,

to our Academy’s address info@dogcraftacademy.com using a secure electronic signature, a mobile signature, or the email address you previously notified to the Academy and that is registered in our system.

14.3. Application Requirements

It is a legal requirement that your application include your name, surname, Turkish ID number (passport number for foreign nationals), residential or business address for notification purposes and contact number. Attaching information and documents relating to your request to your application will help the process be concluded quickly.

14.4. Response Time

Depending on the nature of the request, the Academy will conclude your application free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the procedure requires an additional cost, a fee may be charged in accordance with the tariff determined by the KVK Board.