Version: 2026-09-20
Controller and scope
The controller is Zontroy A.Ş., Teknopark Ankara, Türkiye; [email protected]. This notice explains processing during student, teacher and parent registration and use of educational services under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK). Language determines the translation shown. Country and language selection do not waive your legal rights, including applicable mandatory protections outside Türkiye.
Data, purposes and legal bases
Name, surname, username, chosen contact/account identifier, password hash, country, language, account type and membership declarations are processed to establish the account, authenticate users and provide the service under KVKK Article 5(2)(c). Student grade and, during use, questions, answers, assignments, examination results, chats and uploaded files support educational services on the same basis. Teacher and parent relationships support authorized educational tracking.
Security, legal records and collection
Connection/session information and security records are processed to protect accounts and the service under Article 5(2)(f), subject to your fundamental rights; legal obligations rely on Article 5(2)(ç), and establishing, exercising or defending rights on Article 5(2)(e). If you make a payment, necessary transaction/invoice data is processed for the contract and legal obligations. Data is collected electronically through forms, browser/application use, uploads, support and authorized educational relationships. You may use an email address instead of a national identity number; avoid unnecessary identity or sensitive data.
Recipients and transfers
Necessary data may be disclosed to hosting, storage, technical support, email and selected AI service providers; payment providers when you pay; authorized teachers, parents or educational institutions within their relationships; and competent authorities for lawful requests. Content sent to AI is processed by the selected provider. Domestic transfers must meet Article 8 and international transfers the current Article 9. Regular international transfers require an adequacy decision or an appropriate safeguard such as a standard contract; occasional-transfer exceptions do not cover ongoing transfers. This registration form does not obtain international-transfer consent.
Retention and erasure
Retention must be limited to the time necessary for service provision, applicable statutory duties and protection of rights. Closing an account does not immediately erase every record; continuing legal obligations and disputes require separate assessment. When the processing ground ends, data is erased, destroyed or anonymized under Article 7. Document versions, language, country, account type, declarations and server timestamp are recorded as evidence of the notice and contracting process.
Consent and children
Accepting membership and acknowledging this notice are not consent to processing. Marketing, optional tracking or any other purpose requiring consent must not be bundled into these declarations; where needed, consent must be obtained through a separate, specific and optional process. Consent may be withdrawn. A parent/legal guardian must handle a child’s registration and legal representation; a teacher account does not replace that authority.
Your rights and applications
Under Article 11, you may learn whether data is processed, request information, learn its purposes and appropriate use and its recipients, request correction or erasure/destruction subject to legal conditions and notification of these actions to recipients, object to adverse results based solely on automated analysis, and seek compensation for unlawful processing. Contact [email protected] for assistance and submit requests to the controller using your registered email or other methods permitted by the applicable Communiqué. Requests are resolved within 30 days; the Board’s tariff may apply where additional costs arise.