Scope
This policy briefly explains how personal data is processed on the UZEM platform (uzem.io) operated by Creafair Teknoloji Anonim Şirketi (the "Company"). Details are in the KVKK Information Notice.
For data that institutions process about their own learners and staff on their platforms, the institution is the data controller and the Company processes that data on the institution's behalf.
Information we collect
- Account and contact details: first name, last name, e-mail, phone, institution name and platform address.
- What you write in forms: demo, quote, support and contact requests.
- Technical information: IP address, browser information, sign-in records and cookies.
- If you buy a paid package: billing and order details and the payment result reported by the payment institution. We do not process or store your card number and security code; they are entered in the licensed payment institution's secure payment form. If you choose to have your card stored, only the card key issued by the payment institution (encrypted) and a masked summary to help you recognise the card (last four digits, card brand/type, expiry month and year) are stored.
Your password is stored only as a one-way hash.
How we use it
- To open your account and provide the service.
- To respond to your requests.
- To take paid package orders, collect payments and issue invoices.
- To keep the Platform secure and prevent misuse.
- To comply with legal obligations.
We do not sell your data. We do not send marketing messages; if we do in the future, we will ask for your separate consent. Service e-mails such as account and security notices are separate from this.
Service providers and transfers abroad
Card payments are taken through licensed payment institutions. To run the Platform we use hosting and backup, e-mail delivery, security and content delivery, and video hosting services. These providers have their servers abroad, and only the data required by the relevant service is shared with them.
If an institution connects its own third-party account (e.g. a video conferencing account) to the Platform, data processing in that account is the institution's responsibility.
Retention
Data is retained for the period laid down in legislation or as long as necessary for the purpose, and is deleted or anonymised when the purpose ends or upon your request. Data that is cleaned up automatically, and the related periods, are listed in the KVKK Information Notice.
Security
Connections are encrypted, passwords are stored as one-way hashes and access is limited by authorisation. No system is entirely risk-free; if we become aware of a security incident, we will make the notifications required by law.
Your rights and contact
To exercise your rights under the KVKK:
- In writing: Sururi Mah. Hoca Hanı Sok. No:19/82 Fatih / İstanbul
- E-mail: [email protected]
Changes
When this policy is updated, the new version is published on this page with its version number and effective date.