Data Protection Notice (KVKK)
Version 1.0 · Effective: Draft Draft
This document is a draft under legal review. Fields in square brackets will be completed after approval.
1. What this notice is for
This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
This notice is information only; it does not ask for your consent. Where we rely on your explicit consent, we ask for it separately, with separate texts: Explicit Consent Texts.
For a fuller, plain-language explanation (including information for users in the EEA/UK under GDPR), see the Privacy Policy.
2. Data controller
| Item | Value |
|---|---|
| Company name | Barboros Yazılım ve Pazarlama Teknolojileri (BYPT) |
| Address | Kartaltepe Mah. Belediye Cad. No:3 Limanoğlu İş Merkezi No:38, Küçükçekmece / İstanbul |
| Tax office / Tax ID | Küçükçekmece / 1420771221 |
| [email protected] | |
| Phone | +90 554 434 09 99 |
[KARAR: lawyer to assess VERBİS registration obligation or exemption; we are established in Türkiye, so no data controller representative is required under KVKK.]
3. What data we process, why, and on what legal basis
| Data category | Data | Purpose | Legal basis (KVKK) |
|---|---|---|---|
| Identity | First and last name | Creating your account, orders and invoices | Art. 5/2-c (contract), Art. 5/2-ç (legal obligation) |
| Contact | E-mail, phone (required at checkout) | Account verification, transactional e-mails, payment | Art. 5/2-c, Art. 5/2-ç |
| Transaction security | Password hash (scrypt), Google account ID, two-factor secret (encrypted) and recovery codes (hashed), session data, security logs with truncated IP, Cloudflare request data | Account and system security, preventing abuse | Art. 5/2-c, Art. 5/2-ç, Art. 5/2-f (legitimate interest) |
| Customer transactions | Orders, subscriptions, amount paid, purchased courses | Sales, subscription management, accounting, resolving disputes | Art. 5/2-c, Art. 5/2-ç, Art. 5/2-e (establishing and protecting a right) |
| Customer transactions (learning) | Progress, watch position, notes, quiz and skill results, badges, struggle-map signals | Providing the learning service; giving instructors aggregated, anonymous statistics (minimum 5 students) | Art. 5/2-c, Art. 5/2-f |
| Customer transactions (AI) | AI Coach and instructor twin messages, usage counters | Providing the AI Coach and twin, applying the daily quota | Art. 5/2-c, Art. 5/2-f |
| Audio-visual recordings | Audio recordings you send with Hoca Dinlesin | Delivering the recording to your instructor for feedback | Art. 5/2-c |
| Audio-visual recordings | The same recordings | Improving the listening engine (optional) | Art. 5/1 (explicit consent) |
| Marketing | Your consent to commercial messages and its İYS record | Sending offers and announcements | Opt-in under Law No. 6563; KVKK Art. 5/2-ç |
| Marketing (cookies) | Google Analytics cookie IDs and usage data | Measuring site usage | Art. 5/1 (explicit consent) |
| Transaction security (cookies) | Strictly necessary cookies, cookie consent record (anonymous ID hash, choices, policy version, time) | Running the site, storing your choice and proof of consent | Art. 5/2-c, Art. 5/2-ç, Art. 5/2-f |
The search log contains no user ID and no IP address.
4. How we collect data
We collect data electronically, by automated or partly automated means:
- information you enter in sign-up, sign-in, checkout and settings forms,
- name, e-mail and Google account ID from Google if you use "Continue with Google",
- records created while you use the platform (progress, watch position, security logs),
- cookies and browser storage (Cookie Policy),
- audio recordings you choose to send and messages you write.
The audio analysis in "Çal, dinlesin" runs in your browser; your audio is not sent to us for this.
5. Who we transfer data to, and why
| Recipient | Purpose | Location | Legal basis |
|---|---|---|---|
| Hetzner Online (hosting) | Storing all data on the server | Finland | Art. 5/2-c, Art. 5/2-f; Art. 9 for transfer abroad |
| Cloudflare (CDN, DNS, security) | Delivering the site quickly and securely | Global | Art. 5/2-f; Art. 9 |
| PayTR (payment institution) | Taking payment | Turkey | Art. 5/2-c, Art. 5/2-ç |
| Resend (e-mail) | Sending transactional e-mails | USA | Art. 5/2-c; Art. 9 |
| Google LLC (Gemini API) | AI Coach and instructor twin answers | USA | Art. 5/2-c; Art. 9 |
| Google LLC (Sign in with Google) | Signing in with a Google account | USA | Art. 5/2-c; Art. 9 |
| Google LLC (Analytics / Tag Manager) | Usage measurement — only with consent | USA | Art. 5/1; Art. 9 |
| Vimeo and YouTube (youtube-nocookie) | Video playback | USA | Art. 5/2-c; Art. 9 |
| The relevant instructor | A Hoca Dinlesin recording or a question passed on by the twin | Türkiye [KARAR: can an instructor be resident abroad?] | Art. 5/2-c |
| Competent public authorities and courts | Legal requests | Turkey | Art. 5/2-ç, Art. 8 |
Transfers abroad: Under KVKK Article 9, for countries without an adequacy decision we use the standard contracts published by the Board and notify the Turkish Personal Data Protection Authority within 5 business days of signing. [KARAR: confirm a standard contract is signed and notified for each recipient; decide whether the instructor is a processor or a separate controller]
6. How long we keep data
Retention periods are listed in section 11 of the Privacy Policy. In short: AI Coach messages 30 days, Hoca Dinlesin recordings 90 days, security logs 180 days, backups 14 days; account data while your account is open; order records de-identified for the legal period [KARAR: süre — VUK 5 yıl / TTK 10 yıl, avukat belirlesin].
7. Your rights (KVKK Art. 11)
You can apply to us to:
- learn whether your personal data is processed,
- request information if it is,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for incomplete or inaccurate data to be corrected,
- ask for deletion or destruction under the conditions of KVKK Article 7,
- ask for the actions in items 5 and 6 to be notified to recipients,
- object to an outcome against you resulting solely from automated analysis,
- claim compensation for damage caused by unlawful processing.
You can download your data as JSON and delete your account yourself in Settings.
8. How to apply (KVKK Art. 13)
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:
- with a wet-signed letter delivered by hand or post to Kartaltepe Mah. Belediye Cad. No:3 Limanoğlu İş Merkezi No:38, Küçükçekmece / İstanbul,
- by registered e-mail (KEP) to ,
- signed with a secure electronic or mobile signature, to [email protected],
- from the e-mail address registered in your Musichool account, to [email protected].
Your application should include your name, signature (if written), Turkish ID number (or nationality and passport/ID number if you are a foreign national), postal address for notifications, e-mail and phone if available, and what you are asking for.
We will respond free of charge within 30 days at the latest. If the request requires an additional cost, a fee may be charged according to the Board's tariff.
If your request is rejected, you find our answer insufficient, or we do not answer in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application (KVKK Art. 14). If GDPR applies to you, you may also complain to your local data protection authority.
The Turkish version of this notice prevails if there is any conflict between the two versions.