Disclosure Notice under the Turkish Personal Data Protection Law (KVKK)
Last updated: 19 September 2026
This notice is prepared by Kodpit Teknoloji A.Ş. as data controller pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1. Data Controller
Kodpit Teknoloji A.Ş. Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No: 62A Ümraniye / İstanbul, Türkiye E-mail: [email protected] · Phone: +90 (216) 606 44 47
2. Personal Data Processed
| Category | Examples |
|---|---|
| Identity | First name, last name |
| Contact | E-mail address, phone number |
| Customer transaction | Subscription plan, transaction ID, billing country, licence period |
| Transaction security | IP address, device and browser information, session logs, password (hashed) |
| Education | Grade level, target exam, mock-exam results, study plans, question and chat content |
| Usage | Session count and duration, features used, AI token consumption |
| Visual and audio | Profile photo, uploaded question photos, voice recordings in the coaching feature |
| Marketing | Marketing consent, newsletter preferences |
3. Purposes of Processing
- Performing membership procedures and managing your account,
- Providing personalised study plans, question solving, mock-exam analysis and coaching,
- Subscription, payment, invoicing and licence management,
- Sharing progress reports with teachers and parents,
- Running information-security processes and preventing abuse,
- Handling requests and complaints, customer relationship management,
- Measuring and improving service quality,
- Marketing and promotional activities, subject to your explicit consent,
- Informing competent authorities and fulfilling legal obligations.
4. Method of Collection and Legal Basis
Your personal data is collected electronically, by automatic or partially automatic means, through the website, mobile applications, web panel, contact form, e-mail and payment providers.
Data is processed on the following legal bases set out in KVKK Articles 5 and 6:
- Being directly related to the conclusion or performance of a contract (Art. 5/2-c),
- Being mandatory for the controller to fulfil its legal obligations (Art. 5/2-ç),
- Being mandatory for the legitimate interests of the controller, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f),
- Being mandatory for the establishment, exercise or protection of a right (Art. 5/2-e),
- Your explicit consent where none of the above applies (Art. 5/1).
5. Transfer of Personal Data
In accordance with KVKK Articles 8 and 9, your personal data may be transferred:
- Domestically: to competent public institutions, our legal advisers, business partners and suppliers,
- Abroad: to providers located outside Türkiye that deliver payment infrastructure (Paddle), e-mail delivery (Mailjet), content delivery and security (Cloudflare), cloud hosting, AI models, mobile subscription management (RevenueCat) and app stores (Apple, Google), where adequate protection exists, standard contracts approved by the Personal Data Protection Board are signed, or based on your explicit consent.
6. Retention Period
Your personal data is retained for as long as the processing purpose requires and for the limitation periods prescribed by applicable law. When you delete your account, data not subject to a statutory retention obligation is deleted, destroyed or anonymised within 30 days. Detailed retention periods are listed in the Privacy Policy.
7. Your Rights (KVKK Art. 11)
Regarding your personal data you have the right to:
- Learn whether it is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in line with that purpose,
- Know the third parties to whom it is transferred domestically or abroad,
- Request rectification if it is incomplete or inaccurate,
- Request erasure or destruction under the conditions of KVKK Art. 7,
- Request that rectification, erasure and destruction be notified to third parties to whom the data was transferred,
- Object to a result that is to your detriment arising from analysis exclusively by automated systems,
- Claim compensation for damages arising from unlawful processing.
8. How to Apply
You may submit requests in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- By e-mail to [email protected] from the e-mail address registered in our system,
- By a wet-signed petition to the company address above (via notary or registered mail),
- Through the Security → Delete my account / Download my data options in the web panel.
Your application is concluded free of charge within 30 days at the latest; if the process requires an additional cost, the tariff set by the Board applies.