Schoolobe KVKK Privacy Notice

1. Identity of the data controller

GLOBAL INC. LTD, which provides services under the Schoolobe brand, and INDEX GLOBAL DENETİM AŞ, the statutory representative it has designated in Türkiye within the scope of the law and its obligations, are the data controller under Law No. 6698 on the Protection of Personal Data (“KVKK”). Atatürk Cad. İDTM B2/12 Bakırköy İSTANBUL. 4780612353: Contact: support@schoolobe.com.

This notice explains the purposes and legal grounds for which personal data of platform users, purchasers of education, students and parents/legal representatives are processed. The notice is given before personal data is collected. This notice is not a declaration of explicit consent, and “approval” of this notice is not requested from the data subject as permission to process personal data.

2. Data processed and methods of collection

Depending on the scope of the service, the following data are obtained, automatically or by non-automatic means that form part of a data filing system, through membership and order forms, the student account, the live lesson application, payment transaction notifications, support correspondence, telephone/e-mail communication, the user’s device and platform activity records. Some information about the student may be provided by the parent/legal representative.

• Identity and representation data: First name, last name, student number, age or age group required for the education, parent/representative details and, where necessary, information verifying the authority of representation.
• Contact data: E-mail, telephone and invoice/notification address.
• Transaction and financial data: Order, package, license activation, invoice, payment and refund amount, transaction reference and the limited payment instrument data that is necessary. Payment security data such as the account password or CVV are not requested in support requests.
• Education data: Level, lesson schedule, attendance and absence, homework and answers, teacher assessment, learning progress and the student-specific development report.
• Visual and audio data: In lessons for which separate explicit consent is given, the image, voice, in-lesson messages, shared screen and work of the student and of the participants who join the recording. Participants are informed so that unnecessary images from inside the home are not included in the recording.
• Transaction security data: IP address, session and access time, device/browser information, security and authorization records.
• Application and dispute data: Information and necessary documents shared in support, complaint, cancellation, refund, force majeure and legal applications.

Unnecessary identity photocopies, health reports or other sensitive data should not be sent. If a force majeure document contains health data, only the part necessary to assess the request is taken; document processing does not begin until an appropriate condition for processing special categories of data is met.

3. Purposes and legal grounds

Membership, orders and service delivery to the buyer: The buyer’s identity, contact, order and transaction data are processed under KVKK 5/2-c to the extent necessary to create the account, place the order, define the license, notify the schedule and perform the contract. The mere existence of a contract with the buyer is not regarded as sufficient to process the data of everyone who is not a party to the contract on this legal ground.

Organization of the student’s education: If the student is a party to the contract, or becomes one through valid representation, the necessary education data are processed under KVKK 5/2-c. The minimum identity, attendance and learning progress information of a beneficiary student who is not a party to the contract is processed under KVKK 5/2-f only where the legitimate interest condition — which does not harm the student’s fundamental rights and is assessed separately in respect of the child — is concretely met. This assessment does not automatically cover full audio and video recording of the lesson.

Invoicing and legal compliance: Invoice, transaction and financial records are processed under KVKK 5/2-a where the relevant legislation expressly provides for it, and under KVKK 5/2-ç where it is mandatory for Schoolobe to fulfill its legal obligations.

Support and protection of rights: Support requests relating to the performance of the contract are processed under KVKK 5/2-c; records directly related to a dispute or a claim are processed under KVKK 5/2-e to the extent necessary for the establishment, exercise or protection of a right. This ground does not mean that all lessons are recorded and kept indefinitely.

Security: The limited technical records necessary to prevent unauthorized access and to ensure system security are processed under KVKK 5/2-f, within the framework of the legitimate interest condition that does not harm the fundamental rights of the data subjects. For security records required by law, the processing condition based on the relevant legal obligation also applies separately.

Lesson recording and education analysis on the recording: Audio and video recording of the live lesson, viewing of the recording and pedagogical assessment based on the recording rest on separate explicit consent under KVKK 5/1. Not giving consent, or withdrawing it, is not in itself a reason to remove the student from the education, to charge an additional fee or to impose a disciplinary sanction. An attendance option without recording, or an education arrangement in which no equivalent recording is made, is provided.

Special categories of data: Health information that is mandatory for an optional excuse assessment is processed under KVKK 6/3-a, with explicit consent obtained separately where necessary. For special categories of data that are mandatory for the establishment, exercise or protection of a specific legal right, the conditions of KVKK 6/3-d are assessed separately. Health data is not processed on the basis of a general membership approval without the conditions set out in the law.

Marketing and optional cookies: The personal data processing consent and commercial electronic message permissions required for these purposes are obtained separately. Purchasing education or reading this notice does not replace these permissions.

4. Scope and analysis of lesson recordings

Scope of recording: All lessons, as video with audio. Analysis method: REVIEW BY THE EDUCATION STAFF AND, IF ANY, THE CLOSED ANALYSIS TOOL USED. Recording service: Video conferencing infrastructure Storage location: The country where the students taking the lessons are located

Recordings are used to assess the student’s learning needs in the lesson, to prepare the teacher’s pedagogical feedback and to review the quality of the education. Only education staff authorized by reason of their duties can access the recordings for content review. Analysis outputs are limited to student-specific educational purposes.

Within this scope, no biometric recognition aimed at uniquely identifying a person through face or voice, no health/psychological diagnosis and no general-purpose artificial intelligence model training is carried out. Lesson recordings are not uploaded to external artificial intelligence services. If a different method or purpose is to be used in the future, the necessary legal assessment, notification and, where required, separate consent are obtained beforehand.

Decisions producing adverse consequences for the student are not left solely to the result of automated analysis; an assessment by the education staff is made. In group lessons the rights of other students are respected; a group recording is not started unless the recording conditions are met for all participants.

5. To whom and for what purposes data may be transferred

Personal data are processed under an access model limited by duty and purpose. Education records and analysis content are not given to unrelated third parties, sold or published for advertising purposes. The recipient groups to whom transfers are actually made, and the scope of those transfers, are as follows:

• Authorized education staff: Education data necessary to conduct the lesson and to assess the student’s development; recordings and analyses within the scope of valid consent. If there is an independent external instructor, this person is also assessed separately as a data recipient: USE OF EXTERNAL INSTRUCTORS AND SCOPE / NONE.
• Parent/legal representative: Only the necessary education and transaction information relating to the student they represent, after their identity and authority of representation have been verified. Raw group lesson recordings containing the image, voice or personal information of other students are not routinely shared. Statutory access requests are assessed separately with regard to the rights of other persons.
• Banks and payment institutions: Transaction data necessary for payment, refund, transaction verification and management of payment objections. Recipients: PROVIDERS.
• License provider: The minimum data mandatory for account or license activation. Recipient, data and purpose: PROVIDER, DATA CATEGORY AND PURPOSE / NO PERSONAL DATA TRANSFER.
• Hosting, live lesson and technical support providers: Data mandatory for the operation and security of the stated service. Recipient, data processed, recording access and role: INFORMATION PER PROVIDER. These persons are not granted any right of independent content use, advertising or model training.
• Accounting and legal service providers: Limited information necessary to carry out financial obligations or certain legal claims. General access to the lesson archive is not granted; in a concrete legal dispute the mandatory data is further limited.
• Legally authorized public authorities, courts and supervisory bodies: Data only to the extent required by legal authority or obligation.

For domestic transfers, the relevant processing condition is sought under KVKK 8. For lesson recording based on explicit consent, the scope of technical recipients is also explained before consent is given. The storage of a recording by a technical service provider outside the education staff — even where its personnel do not view the content — is a data processing/transfer activity that must be assessed separately.

6. Transfers abroad

Status of transfers abroad and the systems used: FOR EACH SERVICE, THE RECIPIENT’S TRADE NAME, COUNTRY, DATA TRANSFERRED, PURPOSE AND THE KVKK 9 MECHANISM APPLIED; IF THERE IS NO TRANSFER, VERIFIED INFORMATION.

Purchasing a foreign license does not in itself show that student data is transferred abroad. On the other hand, hosting on a foreign server or providing access from abroad may constitute a transfer. If there is such a transfer, a valid transfer mechanism under KVKK 9 is provided together with the appropriate processing condition under KVKK 5 or 6.

Regular transfers rely, to the extent appropriate, on appropriate safeguard mechanisms such as an adequacy decision or standard contractual clauses. The specific safeguard used is shown above. Regular use of foreign cloud services is not based solely on a general membership consent or on the exceptions provided for occasional transfers. No transfer is made unless a valid transfer condition is met.

7. Retention periods

• Raw live lesson recordings: For 1 month from the recording date, for the purpose of academic analysis.
• Student analysis and development reports generated from the recordings: During the education period and for 3 years afterwards - for the purpose of defining a consistent course if the candidate resumes education.
• Membership, lesson attendance and support records: For 3 years.
• Security and access logs: For 5 years, on grounds of rights, objections and legal reasons.
• Contract, invoice, payment and refund records: For 5 years, in line with the mandatory retention obligations applicable to the relevant record type.
• Force majeure documents: For 5 years, limited to concluding the request and the necessary process of protecting rights.
• Explicit consent and withdrawal records: For 5 years, as necessary to prove consent management and lawfulness.

When the purpose and the legal ground for retention end, data are deleted, destroyed or anonymized. As regards backups, the arrangement for completing deletion: for 5 years. Data that are subject to a concrete dispute or a statutory retention obligation are kept limited to the relevant record and moved into an archive closed to access; the whole lesson archive is not kept indefinitely on this ground.

8. Children’s data and withdrawal of consent

For minor students, the authority of legal representation is verified; the student is given an explanation appropriate to their age and level of understanding. In the explicit consent process, the student’s capacity to discern and the nature of the transaction concerned are taken into account. Parental approval is not regarded as unlimited permission for all data processing and transfer activities.

Explicit consent to lesson recording and analysis of recordings may be withdrawn with prospective effect through support@schoolobe.com / IN-ACCOUNT PREFERENCE MANAGEMENT. Withdrawal does not retroactively make earlier lawful processing unlawful. After withdrawal, new recording and analysis based on consent are stopped; unless there is another valid retention ground, the deletion/destruction process is run for the existing data. The person concerned is informed about the education arrangement without recording.

9. Rights of the data subject

Under KVKK 11, you may learn whether your personal data are processed; request information if they are processed; learn the purpose of processing and whether the data are used in accordance with that purpose; ask about the third parties to whom the data are transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; and, when the conditions of KVKK 7 are met, request deletion or destruction.

You may also request that correction and deletion/destruction be notified to the third parties to whom the data have been transferred, object to an outcome to your detriment arising solely from analysis carried out by automated systems, and request compensation for your damage if you suffer harm because of unlawful processing.

10. Application procedure

You may submit your application in writing to the address stated above; to the registered electronic mail (KEP) address, if any; with a secure electronic signature or mobile signature; from your e-mail address previously notified to Schoolobe and registered in the system, to support@schoolobe.com; or through the support panel provided for this purpose.

The application must contain your name and surname, a signature for written applications, the identity information required by legislation, a notification address, a notification e-mail/telephone if any, and the subject of the request. For applications made through a representative, the necessary proof of representation is attached. No additional documents unrelated to the purpose are requested for identity verification.

Requests are concluded as soon as possible according to their nature and, as a rule, free of charge within 30 days at the latest. If the process requires a separate cost, only a fee in line with the tariff determined by the Board may be charged. If the application is rejected, the response is inadequate or no response is given in time, the right to complain to the Board may be exercised under the procedures and time limits set out in the KVKK.