1. Data Controller
TestPrep, operating under its registered legal entity in Istanbul, Turkey, is the data controller responsible for the processing of your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”). This disclosure text has been prepared to inform you, as the data subject, about your rights and how your personal data is handled.
2. Categories of Personal Data Processed
The following categories of personal data may be processed:
| Category | Examples |
|---|---|
| Identity | Full name, date of birth, nationality, T.C. ID number (if applicable) |
| Contact | Email address, phone number, residential address |
| Education | School name, grade level, target exams, score records, academic history |
| Financial | Payment records, billing information, bank account details |
| Visual/Audio | Lesson recordings, profile photographs (if provided) |
| Digital | IP address, browser information, cookies, session logs, device data |
| Communication | Emails, WhatsApp messages, contact form submissions, call records |
3. Purposes of Data Processing
Your personal data is processed for the following purposes under KVKK Article 5 and Article 6:
- Providing and managing educational services, tutoring, and course enrollment.
- Creating personalized study plans and tracking academic progress.
- Processing payments and managing financial transactions.
- Communicating with students and parents regarding lessons, schedules, and updates.
- Responding to inquiries and providing customer support.
- Sending marketing communications (with explicit consent).
- Conducting internal audits, analysis, and service improvement.
- Fulfilling legal and regulatory obligations.
- Ensuring information security and preventing unauthorized access.
4. Legal Basis for Processing (KVKK Art. 5 & 6)
Your data is processed based on the following legal grounds as defined by KVKK:
- Explicit Consent (Art. 5/1): For marketing communications, lesson recordings, and optional data sharing.
- Contractual Necessity (Art. 5/2-c): Processing necessary for the performance of the tutoring service contract.
- Legal Obligation (Art. 5/2-c): Tax, accounting, and regulatory record-keeping requirements.
- Legitimate Interest (Art. 5/2-f): Service improvement, analytics, and fraud prevention, provided it does not override your fundamental rights.
- Establishment of a Right (Art. 5/2-e): Processing necessary for the establishment, exercise, or protection of legal claims.
5. Data Transfer
Your personal data may be transferred to the following recipients in accordance with KVKK Articles 8 and 9:
- Domestic Transfers: Tax authorities, legal advisors, payment processors, IT service providers located in Turkey.
- International Transfers: Cloud service providers (e.g., hosting, analytics, CRM platforms) located abroad. Such transfers comply with KVKK Article 9, with adequate protection measures in place.
- Group Companies: Affiliated entities for operational coordination and service delivery.
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
6. Data Retention Period
Personal data is retained for the duration necessary to fulfill the purposes for which it was collected, plus any additional periods required by applicable laws. General retention guidelines:
- Student records: 5 years from the end of the service relationship.
- Financial records: 10 years as required by Turkish tax legislation.
- Marketing consent records: Until consent is withdrawn.
- Website usage data: 2 years from collection.
Upon expiry of the retention period, data is deleted, destroyed, or anonymized in accordance with KVKK and our Data Retention and Destruction Policy.
7. Your Rights Under KVKK (Article 11)
As a data subject, you have the following rights under KVKK Article 11:
- To learn whether your personal data is being processed.
- To request information about the processing if your data has been processed.
- To learn the purpose of processing and whether your data is used in accordance with that purpose.
- To know the domestic or international third parties to whom your data is transferred.
- To request correction of your data if it is incomplete or inaccurate.
- To request deletion or destruction of your data under conditions set forth in KVKK Article 7.
- To request that corrections, deletions, or destruction be notified to third parties to whom your data has been transferred.
- To object to any result that arises against you through the analysis of processed data exclusively by automated systems.
- To claim compensation for damages resulting from unlawful processing of your data.
8. How to Exercise Your Rights
You may submit your requests regarding your KVKK rights through the following methods:
- Email: Send a signed request to info@testprepturkey.com with the subject line “KVKK Request”.
- Registered Mail: Send a written and signed request to our registered address.
- In Person: Submit a written request with valid identification at our Istanbul office.
We will respond to your request free of charge within 30 days at the latest. If your request requires additional investigation, the response period may be extended by an additional 30 days, and you will be informed accordingly. If your request is rejected, the reasons will be communicated to you in writing.
9. Technical and Administrative Measures
TestPrep implements the following measures to protect your personal data:
- SSL/TLS encryption for all data transmission.
- Access controls with role-based permissions for staff.
- Regular security audits and vulnerability assessments.
- Staff training on data protection and KVKK compliance.
- Data Retention and Destruction Policy in accordance with KVKK regulations.
- Incident response procedures for data breaches.
10. Contact Information
For all inquiries regarding the processing of your personal data and to exercise your KVKK rights:
- Data Controller: TestPrep
- Email: info@testprepturkey.com
- Phone: +90 (212) 417 11 70
- Address: Buyukdere Cad. Kanyon Ofis, Levent, Istanbul, Turkey