Privacy Notice under the Law on the Protection of Personal Data (KVKK) No. 6698

1) Data Controller

2) Scope

This Privacy Notice explains how we process personal data of users, customers, prospects and website visitors in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and secondary legislation.

3) Categories of Personal Data

• Identification: name–surname, username, student ID.
• Contact: email, phone, city/country.
• Transaction & Billing: order details, invoice info, payment status (tokenized by payment provider), IBAN (if refunds).
• Usage & Technical: log records, device/browser info, IP, cookie identifiers, interactions, course progress.
• Support Content: messages, tickets, call notes.
• Marketing Preferences: consent choices, subscription status.
• Special Category Data: not intentionally collected. If you share such data (e.g., health information) with support, we will avoid processing unless legally required and based on a clear legal ground.

4) Purposes and Legal Grounds (KVKK Art. 5–6)

We process your personal data for the purposes below on the following legal grounds:

• Account creation, service provisioning, performance tracking — necessary for the performance of a contract (Art. 5/2-c).
• Payment processing, invoicing, fraud prevention — legal obligation (Art. 5/2-ç) and contract (Art. 5/2-c).
• Customer support and communications — legitimate interests (Art. 5/2-f) provided your fundamental rights are not harmed; and/or contract (Art. 5/2-c).
• Security, auditing, dispute management, exercise/defense of rights — establishment/defense of a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç).
• Service improvement, analytics, personalization — legitimate interests (Art. 5/2-f).
• Marketing communications (email/SMS/push) — explicit consent (Art. 5/1) where required; you may withdraw any time.
• Special categories (if any) — processed only under KVKK Art. 6 conditions (e.g., explicit consent or cases expressly permitted by law).

5) Methods of Collection

Data is collected via website/app forms, account setup, learning activities, cookies/SDKs, support channels, payment and logistics providers, and lawful third-party sources.

6) Transfers of Personal Data

Domestic transfers (Art. 8): We may transfer data to our service providers acting as data processors (IT hosting, payment, analytics, customer support, logistics, legal/financial advisors) strictly for the stated purposes and based on data processing agreements.

International transfers (Art. 9): Where data is transferred abroad (e.g., cloud hosting, email, analytics), we rely on KVKK-compliant mechanisms (such as adequacy decisions, undertakings/standard commitments, binding corporate rules, or your explicit consent where appropriate). Information on current transfer mechanisms can be provided upon request.

7) Retention

We retain personal data for the period necessary for the purposes above and in line with statutory limitation periods. For example, accounting/financial records are kept for the minimum periods required by law. When the retention period ends, data is deleted, destroyed or anonymized according to our retention policy.

8) Your Rights under KVKK (Art. 11)

You may apply to us to:

• learn whether your personal data is processed;
• request information about processing;
• learn the purpose of processing and whether it is used in line with that purpose;
• know the third parties to whom data is transferred domestically/abroad;
• request correction if data is incomplete or inaccurate;
• request deletion or destruction under the conditions of Art. 7;
• request notification of correction/deletion to third parties to whom data was transferred;
• object to outcomes against you arising from exclusively automated processing;
• request compensation for damages arising from unlawful processing.

9) Exercising Your Rights (Application Methods)

You may submit your requests under Art. 11 by:

• Sending a signed application to our address above;
• Emailing from your registered (KEP) address or with secure electronic signature;
• Or via other methods determined by the Personal Data Protection Authority (KVKK Board).

We will respond within 30 days at the latest. If responding incurs a cost, fees may be charged within limits set by the Board.

10) Cookies & Similar Technologies

We use cookies/SDKs to operate the Service, measure performance and, with consent where required, for advertising/personalization.

Type	Purpose	Examples	Retention
Strictly Necessary	Login, session continuity, load balancing, security.	session_id, csrf_token	Session / up to 12 months
Analytics	Measure usage, improve content and UX.	_ga, _gid (analytics)	Up to 24 months
Functional	Remember preferences (language, region).	lang, locale	Up to 12 months
Advertising consent	Personalized ads, frequency capping.	ad_id, _fbp	Up to 24 months

You can manage cookies through your browser settings or our consent tools where available. Disabling some cookies may affect site functionality.

11) Data Security

We implement appropriate technical and organizational measures (encryption in transit, access controls, role-based authorization, logging, vulnerability management). Payments are processed by PCI-DSS compliant providers; we do not store full card numbers.

12) Children’s Data

Our Service is primarily designed for general audiences. Where required by law or product context (e.g., young learners), we obtain necessary consents from parents/guardians and minimize data processing in line with KVKK principles.

13) Third-Party Links & Services

Our Service may link to third-party sites/services. Their privacy practices are governed by their own notices. We encourage you to review them.

14) Updates to This Notice

We may update this Notice to reflect legal or operational changes. The “Last updated” date indicates the latest revision. Material changes will be communicated via the Service or by email where appropriate.

15) Contact

For questions or requests regarding your personal data:
Email: support@ellc.com.tr — Phone: +90 552 524 52 18
Address: Mir Eğitim ve Yazılım, Etiler Mah. 1265 Sokak Eti İş Merkezi No:10/31, Konak, İzmir, Türkiye

Disclaimer: This English template aims to reflect general concepts of Turkish data protection law (KVKK). It must be tailored to your actual processing activities and reviewed by legal counsel.