Türkiye Privacy Addendum (KVKK)

1. Controller and contact

For Course accounts, service security, support communications, and iyely's own legal obligations, the controller is the iyely legal entity identified in your organization's service agreement. Data-protection contact: kvkk@iyely.com.

For applicant, student, guardian, and operational data entered by your organization, your organization is the controller and iyely generally acts as processor under its instructions.

2. Categories of personal data

• Identity and contact: name, work email, phone, job title, and account identifiers.
• Customer transaction and operations: applications, stages, tasks, meetings, notes, documents, memberships, sales, and payment records.
• Transaction security: IP address, session data, timestamps, request, error, and audit logs.
• User preferences: language, theme, security choices, and optional AI permission.
• Social sign-in: identity, email, and verification result from Google or Apple only when selected.

3. Purposes and legal bases

Processing relies on the conditions in Articles 5 and, where relevant, 6 of the KVKK, including performance of a contract, legal obligation, establishment/exercise/protection of a right, legitimate interests that do not override fundamental rights, or explicit consent where required.

• Establish and perform the service agreement and provide the account and authorized workspace.
• Authenticate identity, control access, resolve errors, audit activity, and prevent fraud and misuse.
• Answer support requests and comply with legal obligations.
• When explicit AI permission is given, generate the requested answer and perform Course actions the user expressly requests.

4. Recipients and transfers

Where a cross-border transfer is necessary, an appropriate mechanism under Article 9 of the KVKK and data minimization are applied. Personal data is not sold or shared for advertising.

• Authorized workspace users and organization administrators.
• Google Cloud Platform and Cloudflare infrastructure to the limited extent needed to operate the service.
• Google or Apple authentication services only when the corresponding sign-in method is selected.
• Authorized public bodies and legal advisers when a valid legal request or obligation applies.

5. Collection and retention

Data is collected automatically or partly automatically through the web and mobile apps, API requests, support email, a selected social-login provider, and authorized users of your organization.

Data is retained for the period needed for the purpose and any period required by law, then deleted, destroyed, or anonymized. Account deletion and limited retention are described on the Account and Data Deletion page.

6. Your rights under Article 11

• Learn whether personal data is processed and request information if it is.
• Learn the purpose of processing and whether data is used consistently with that purpose.
• Know the third parties to whom data is transferred in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request erasure/destruction where the conditions are met and notification to recipients.
• Object to an adverse outcome based solely on automated analysis.
• Claim compensation for loss caused by unlawful processing.

7. How to apply

Email kvkk@iyely.com from the address registered to your account. Include your name, account email, workspace/organization, subject of the request, and preferred response method; never send a password or verification code.

Requests are resolved within 30 days and ordinarily free of charge. If you consider the response inadequate, you may complain to the Turkish Personal Data Protection Board subject to the conditions and time limits in the KVKK.