Privacy Policy

1. Data Controller

This Privacy Policy explains how your personal data is processed by us, in our capacity as data controller, in connection with the services offered through the Tercih Tanıtım platform (the "Platform"), in accordance with applicable data protection legislation, including Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").

2. Personal Data We Collect

Through the Platform we may process:

• Identity and contact information such as your name and email address
• Institution/school details submitted with institution applications
• Your email address if you subscribe to our newsletter
• The content of support tickets you open and any files you attach to them
• Testimonials and comments you choose to share
• Authentication data associated with your user account, and technical logs such as your IP address, browser, and device information

3. Purposes of Processing

Your data is processed to create and authenticate your account, to evaluate and process institution applications, to send newsletters and informational emails, to respond to your support requests, to maintain the security of the Platform, to comply with legal obligations, and to improve the quality of our services.

4. Legal Basis

We process your personal data where processing is necessary for the performance of a contract to which you are a party, for compliance with a legal obligation, where the data has been made public by you, where processing is necessary for the establishment or defense of a legal claim, or where processing is necessary for our legitimate interests, provided such interests do not override your fundamental rights and freedoms. Where consent is legally required (for example, newsletter subscriptions), we obtain it separately.

5. Data Security

Certain sensitive fields, such as email addresses, are stored encrypted at rest using AES-256-GCM; lookups are performed using a one-way (hashed) matching value rather than the plaintext value. Authentication is handled by an independent identity provider (Keycloak), and your password is never stored by the Platform in plain text.

6. Sharing With Third Parties

Your personal data is not shared with third parties without your explicit consent, except with authorized service providers used to deliver our services — such as email delivery providers (SMTP, SendGrid, Amazon SES) and file/image storage providers — and with public authorities where legally required. These service providers only access the data strictly necessary to perform their function and are bound by data processing agreements.

7. Cookies

The Platform may use strictly necessary cookies for session management and security purposes. Should analytics or marketing cookies be introduced in the future, this Policy will be updated and users will be notified accordingly.

8. Data Retention

Your personal data is retained for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law, after which it is deleted, destroyed, or anonymized.

9. Your Rights

Subject to applicable law, you have the right to:

• Learn whether your personal data is being processed
• Request information about such processing
• Learn the purpose of processing and whether your data is used accordingly
• Know the third parties to whom your data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of your data within the framework set out by applicable law
• Request that any correction or deletion be notified to third parties to whom your data has been transferred
• Object to a result that is to your detriment arising from analysis of your data exclusively through automated systems
• Claim compensation for damages arising from unlawful processing of your data

10. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in applicable law or in the Platform's services. The most current version will always be available on the Platform.

11. Contact

You may submit any requests regarding your personal data through the support/contact channels available on the Platform.