Privacy Policy

Data controller: OKULUMNET Address: Yıldırım Beyazıt Mah., Aşık Veysel Blv. No:61 Erciyes Tekno-1 Daire:32 Melikgazi/Kayseri, Türkiye Email: [email protected]

For questions about your rights or our data-processing practices, you may write to the address above or contact us by email.

a) Account Data: name, email address, the name of your organisation, your role and your password.

b) Customer Content: teacher definitions you upload to the Service (name, email, subject, availability), class and classroom details, timetable data and school rules. This data belongs to your organisation; Atlas processes it solely on your behalf.

c) Usage Data: which features you use and how often, plus general usage statistics.

d) Technical Data: IP address, browser and device information, language preference.

Atlas does not process student data. The system does not contain individual student records; timetable planning is performed only at the class and teacher level.

e) Payment Data: payments by schools outside Türkiye are taken on our payment service provider's secure payment page; card details are never passed to Atlas. Schools in Türkiye enter their card details in the payment form on Atlas's Licence page; the card number, expiry date and security code are sent over an encrypted connection to our payment service provider solely to make that payment and are never recorded or stored by Atlas. For these payments, the paying user's name, email address, the phone number entered in the payment form and IP address are also passed to the payment service provider to prevent fraud; Atlas does not store the phone number. Of the payment itself, Atlas keeps only its record (amount, currency, date and the payment service provider's transaction, order and subscription identifiers) and your school's billing country.

f) Invoice Data: Atlas issues the invoices of schools in Türkiye. For this, before the first payment we collect the invoice type (company or individual), the registered name or full name, the tax number or Turkish ID number, the tax office, the billing address and the email address the invoice is sent to. These details are used only to issue and send the invoice and to keep the financial records, and are kept for as long as the financial records are. When a payment is completed, the paying user receives a confirmation email.

[Pending legal review: how the passing of card details through Atlas's servers to the payment service provider, and the transfer of the paying user's name, email, phone and IP address for fraud prevention, and the collection of a Turkish ID number for individual invoices, are to be stated in the KVKK privacy notice and on which legal basis.]

We process your personal data for the following purposes:

• Providing, maintaining and managing your account in the Service.
• Detecting and resolving technical issues, and ensuring security.
• Fulfilling legal obligations (invoices, financial records, responses to data-subject requests, etc.).
• Improving service quality (anonymised statistical analysis).
• Communication and announcements (important updates, termination notices, etc.).

We do not sell, trade or share your data with independent third parties for marketing purposes.

Under KVKK Articles 5 and 6, we process your data on the following legal bases:

• Performance of a contract (necessary to provide the Service to you).
• Legitimate interests of the data controller (system security, error analysis, abuse detection).
• Compliance with legal obligations (financial regulation, KVKK requests).
• Your explicit consent (only for marketing communications and optional features).

Under KVKK Article 11 you have the following rights as a data subject:

• Learn whether your personal data is being processed.
• Request information about how it is processed.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties to which the data is transferred, domestically or abroad.
• Request correction if the data is incomplete or inaccurate.
• Request erasure or destruction of the data.
• Request that correction or erasure be communicated to the parties to which the data has been transferred.
• Object to outcomes drawn against you exclusively by automated processing.
• Claim compensation if you have suffered damages due to processing that violates KVKK.

To exercise these rights, you may submit a written request to [email protected]. Your request must include information that verifies your identity (name, email, registered organisation) and a clear statement of your request. We will respond within 30 days at the latest.

• Account data: while the account is active, plus 30 days after termination (export window). After this period it is permanently deleted.
• Customer content: while the account is active, plus 30 days after termination.
• Financial records and invoices: as required by financial law (generally 10 years).
• Usage and technical logs: a maximum of 12 months.
• Records of KVKK requests: for the duration of the applicable legal retention period.

At the end of the retention period, data is securely deleted or anonymised.

To deliver the Service, we work with the following categories of suppliers (data processors):

• Technical infrastructure providers (for running the Service and storing data).
• Email-delivery service provider (for transactional emails, such as timetable notifications to teachers).
• Payment service providers: they take the payment for a purchase; for purchases by schools outside Türkiye the provider acts as the seller (Merchant of Record), issuing the invoice and handling tax. During a purchase, your email address and billing details are collected by the payment service provider. [Pending legal review: the payment service providers' position in this notice (processor or independent controller), whether they must be named, whether the agreement statement below applies to them, and the legal basis under KVKK art. 9 for transferring personal data abroad.]

KVKK-compliant data-processing agreements are in place with all suppliers. A current and personalised supplier list is available in writing on request from [email protected].

Atlas uses two kinds of cookies:

• Essential cookies: the ones the site needs to work, such as your session (sign-in) and language preference. They are always on and do not track you.
• Analytics cookies (optional): analytics measurement is enabled only after you consent. We use Google Analytics 4 to understand, anonymously and in aggregate, how pages are used; IP is anonymized and ad/personalization signals are off. If you do not consent, no analytics cookie is written. Under Google Consent Mode, before your consent, cookieless technical consent signals may be sent that do not identify you.

We use no advertising or third-party ad-tracking cookies. You can change your cookie choice from the 'Cookie Preferences' link at the bottom of every page, and delete or block cookies in your browser. See our Cookie Policy for details.

We apply industry-standard technical and organisational measures to protect your data. Our staff can access data only as required for their duties and are bound by confidentiality obligations.

In the event of a data breach we will notify the Personal Data Protection Authority and the affected data subjects within 72 hours, as required by KVKK Article 12(5).

This Privacy Policy may be updated from time to time. The updated version will be published on this page, and the "Last updated" date at the top of the page will change.

For material changes, we will notify you at your registered email address and announce them in the application. Continuing to use the Service after the new Policy takes effect constitutes acceptance of the current version.

For any questions about privacy or KVKK, and for data-subject requests:

Email: [email protected] Post: Yıldırım Beyazıt Mah., Aşık Veysel Blv. No:61 Erciyes Tekno-1 Daire:32 Melikgazi/Kayseri, Türkiye

Data controller: OKULUMNET