1. Controller and contact
The controller is TestPrep Istanbul. KVKK requests may be sent to info@testprepeurope.com.
2. Categories of data
- Identity and contact data
- Program, lesson, target-exam and education-progress data
- Order, invoice and payment references
- WhatsApp, phone and email communication records
- IP, device, session, security and error logs
- Necessary cookie and browser storage records; analytics cookie data after permission in the EU/EEA, the United Kingdom, Switzerland and Turkey, and by default elsewhere until turned off (list: Privacy and Cookie Policy, section 5)
3. Purposes
- Plan and deliver education, tutoring and course services
- Operate accounts, orders, payments, invoices and support
- Manage lesson plans and individual progress
- Protect information security and investigate errors or abuse
- Meet legal and financial obligations
- Run marketing or analytics only where separate permission is required
4. Method and legal grounds
Data is collected through WhatsApp/phone/email communications, account and purchase activity, lesson use and necessary technical logs. KVKK Article 5 grounds may include contract performance, legal obligation, establishment or exercise of rights, balanced legitimate interests and, when required, explicit consent.
Account security: to keep each account to one session at a time and to prevent account sharing and bulk copying of our content, when you sign in we record one-way hashed digests of your browser's user agent and of your network block (the first three parts of your IP address), your session identifier, the site you signed in on, and when a session was closed because of a sign-in on another of our sites or another device. A new sign-in to your account closes all your other sessions. We do not store your IP address or browser string themselves for this purpose and we do not use device fingerprinting. These records are deleted 90 days after last use. Legal basis: KVKK Article 5/2(c) (performance of a contract) and Article 5/2(f) (legitimate interest).
Exam security: So that one account cannot quietly serve several students, we note an irreversible digest of your IP address and browser when you start a practice test or open the question bank (never the address in readable form) and erase it 90 days later (KVKK Article 5/2(f), legitimate interest).
5. Transfers
To the extent necessary, data may be shared with hosting (Vercel), database and sign-in (Supabase) providers, Stripe, WhatsApp/Meta, the AI model providers we route TestPrep AI Tutor requests through (OpenAI; no payment or government-ID data is sent), Google Analytics (after consent in the EU/EEA, the United Kingdom, Switzerland and Turkey, and by default elsewhere until turned off), Microsoft Clarity (after consent), and competent authorities when legally required. International transfers are subject to valid conditions and safeguards under KVKK Article 9.
For a group course, a private group of 3–6 students or private lessons, your answer to “Do you have a parent or guardian?” and, with a Yes, your parent's email address are transferred, limited to those two items and only so that the lesson reports can be sent to your parent, to TestPrep's main site (testprep.com.tr) through the payment provider Stripe. They are not stored on this site, and this site sends your parent no email. When a parent registers, the parent's identity and contact details are processed as the payer's on the receipt and the sale documents.
MiniMax (AI study plan): when you finish a practice test, we send your answers (right or wrong), your topic and section results, your timing and your scores from that test to this AI model provider, to write your personal study plan. Your name, email address and payment details are not sent.
6. Article 11 rights
You may ask whether data is processed, request information, learn the purpose and recipients, seek correction or deletion/destruction, object to an automated result and claim compensation where legal conditions are met.
7. Application process
Include information sufficient to verify your identity, the right invoked and a response address. Applications are answered according to their nature and no later than 30 days. A fee may apply only where permitted by the Board’s tariff.
8. Retention and updates
Data is retained only for the purpose and legal-duty period, then deleted, destroyed or anonymized. The current notice is published on this page.
The reports your tutor writes after private lessons, the lesson and weekly summaries sent to your parent, and your part of a group course's weekly report are kept until your account is deleted, and are deleted with it. Summaries already sent by email stay in the recipient's inbox.
An account that has not been used for 90 days is deleted, together with its learning data. We send an email to your confirmed email address 14 days before that happens, giving the date. Signing in, or simply using your dashboard, before that date keeps your account. Staff accounts and any account with a purchase are never deleted this way, and nothing you have paid for is ever deleted.
For an account deleted this way, we keep a record of the deletion (the email address; the dates the account was opened, last used and deleted; the number of practice tests deleted with it) for 2 years, then erase it.
We also use this record to stop a new account opened with the same email address from getting the free trial again. Anything you buy is not affected. Our legal basis is our legitimate interest in offering the free trial once per person.