KVKK Information Notice

Data controller

This notice is provided by Creafair Teknoloji Anonim Şirketi (the "Company") as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK").

• Address: Sururi Mah. Hoca Hanı Sok. No:19/82 Fatih / İstanbul
• MERSIS: 2749995418999892
• E-mail: [email protected]
• Phone: +90 212 709 10 36

The Company operates the UZEM learning platform (uzem.io and its subdomains). For data that institutions process about their own learners and staff on their platforms, the institution is the data controller and the Company processes that data on the institution's behalf.

What data we process

• Identity and contact: first name, last name, e-mail, phone.
• Institution details: institution name, platform address, sector.
• Account security: password (stored only as a one-way hash), verification codes.
• Request details: what you write in the demo, quote, support and contact forms.
• Transaction security: IP address, browser information, sign-in records.
• Source and preferences: which link brought you to the site, your currency and cookie preferences.
• Billing and order details (if you buy a paid package): billing type, full name or company name, billing address, tax office and, where required for the invoice, tax or identity number, billing e-mail and phone; the package ordered, period, amount, payment method, payment status and order reference code.
• Payment transaction details: the transaction result and transaction reference reported by the payment institution; if you choose to have your card stored, the card key issued by the payment institution and a masked summary used to recognise the card (last four digits, card brand/type, expiry month and year). We do not process or store your card number and security code; they are entered in the payment institution's secure payment form.
• Consent records: the version, language, content and time of the text you accepted or were shown; the IP address and browser information at the time.

Purposes and legal grounds

• Opening the institution account and providing the service — establishing and performing the contract (KVKK Art. 5(2)(c)).
• Taking paid package orders, collecting payment, (if chosen) automatic renewal charges and subscription management — establishing and performing the contract (Art. 5(2)(c)).
• Invoicing, tax and commercial book records and keeping records of distance sales — legal obligation (Art. 5(2)(ç)).
• Keeping sales contracts and consent records as evidence — legal obligation and establishing, exercising or protecting a right (Art. 5(2)(ç), (e)).
• Responding to demo, quote, support and contact requests — pre-contract discussions and legitimate interest (Art. 5(2)(c), (f)).
• Keeping the Platform secure and preventing misuse — legitimate interest and legal obligation (Art. 5(2)(f), (ç)).
• Understanding which channel brought visitors to the site and remembering your preferences — legitimate interest (Art. 5(2)(f)).
• Complying with legal obligations and protecting rights (Art. 5(2)(ç), (e)).

Your explicit consent is not requested for these purposes. The card storage and automatic charge consents at checkout are your choices about the contract; they do not replace the information in this notice and are not used as explicit consent under the KVKK. If processing based on explicit consent is ever started, your explicit consent will be requested with a separate text and a separate checkbox that is not pre-ticked; refusing it will not prevent you from using the service.

We do not send commercial electronic messages for marketing; if we do in the future, we will ask for your separate consent. Service notices such as orders, invoices, renewal reminders and account security are separate from this.

How data is collected

Data is collected electronically through the Platform's forms and account actions, as well as through cookies and server logs.

Who we share it with

Your personal data is shared with authorised public authorities (e.g. the tax administration) upon request, to comply with legal obligations, and with the service providers listed below, to provide the service.

• Payment services: licensed payment institutions, for card payments and, if you choose it, card storage; only the order, amount, billing and contact details needed to make the payment.

Transfers abroad

Some of the service providers we use to run UZEM have their servers abroad. Your personal data is transferred to the following recipient groups only to the extent required by the relevant service:

• Hosting and backup: the servers and backups the Platform runs on — Hetzner Online GmbH; servers in Germany, backups in Finland.
• E-mail delivery: sending verification codes and account notifications — Amazon Web Services (Amazon SES); Ireland (European Union) region.
• Security and content delivery: serving the site quickly and securely, blocking malicious traffic and checking forms for automated submissions — Cloudflare, Inc.; headquartered in the USA, traffic passes through its servers worldwide.
• Video hosting: storing and playing institutions' training videos — BunnyWay d.o.o. (Bunny Stream); headquartered in Slovenia, videos are played through its worldwide delivery network.
• Live classes: running live classes for institutions that use the Platform's live class account — Zoom Communications, Inc.; USA.
• Business e-mail: hosting the mailboxes of institutions that use this service — Contabo GmbH; headquartered in Germany.

Under Article 9 of Law No. 6698, personal data may be transferred abroad where the Personal Data Protection Board has issued an adequacy decision for the destination country, sector or international organisation; failing that, where one of the appropriate safeguards listed in the Law is in place; or, for incidental transfers only, where one of the exceptions listed in the Law applies. The mechanism relied on for the transfers above: pending a decision; it will be stated in a new version of this text.

Retention

Personal data is retained for the period laid down in legislation or for as long as necessary for the purpose for which it is processed. We do not delete data in bulk merely because a fixed period has passed; when the reason for processing ceases to exist, the data is deleted, destroyed or anonymised ex officio or upon your request. Some data is cleaned up automatically because its purpose has ended:

• Incomplete signup applications: deleted 7 days after the last activity.
• Users' names, e-mail addresses and phone numbers in cancelled institutions: anonymised 30 days after cancellation.
• Sign-in records: deleted after 180 days.

Records that must be kept by law are retained for the applicable period.

Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate, and deletion or destruction under Article 7 of the KVKK, and that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising solely from analysis by automated systems; and to claim compensation for damage caused by unlawful processing.

You can send your application through the following channels:

• In writing: Sururi Mah. Hoca Hanı Sok. No:19/82 Fatih / İstanbul
• E-mail: [email protected]

Applications are concluded free of charge within thirty days at the latest. For data on an institution's platform, please contact that institution first; the Company supports the institution as needed.