KVKK Privacy Notice (Türkiye)
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Data controller
Under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform, your personal data in connection with TestMakerPro is processed by the following data controller.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| hasan@pingel.dev | |
| Web | pingel.dev |
2. Controller and processor roles
For student data (names, numbers, answers, scores) that teachers and schools add to TestMakerPro, the teacher or school is the controller and Pingel is a processor acting on their behalf. For teacher account and payment data, Pingel is the controller.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Teacher's name, e-mail, username, school/subject, password (hashed by Firebase) | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Teacher content Questions, tests, question banks, uploaded PDFs and images, classes | Providing test and exam creation | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Student data and exam results Student name, number, class, exam access code, answers, scores, optical sheet results | Running exams and showing results on behalf of the teacher or school (as processor) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Until the teacher/school deletes it; within 30 days after account closure |
| School account data School name, administrators, teacher invitations and permissions | Managing the school plan | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While the school account is open |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Compliance with a legal obligation (KVKK Art. 5(2)(ç)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
| Usage statistics Pages visited, session duration, approximate location (country/city), device type, cookie ID | Anonymised statistics to improve the site (Google Analytics) — only if you consent | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time | 14 months in Google Analytics |
4. Method of collection
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
5. Recipients and purposes of transfer
Your personal data is transferred, limited to the purposes above and in line with KVKK Arts. 8 and 9, to the following suppliers that provide the technical infrastructure (some located abroad):
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
Transfers abroad rely on appropriate safeguards under KVKK Art. 9 (standard contracts, providers' data protection commitments) and, for occasional transfers without them, the exceptions in Art. 9(6). Data may also be disclosed to authorised public bodies and courts on request and as required by law. Your data is never sold.
6. Your rights under KVKK Art. 11
- to learn whether your personal data is processed;
- to request information if it is processed;
- to learn the purpose and whether it is used accordingly;
- to know the third parties in Türkiye or abroad to whom it is transferred;
- to request correction if incomplete or inaccurate;
- to request deletion or destruction under Art. 7;
- to request that corrections and deletions be notified to recipients;
- to object to an adverse outcome resulting solely from automated analysis;
- to claim compensation for damage caused by unlawful processing.
7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request with your name, (for written requests) signature, address or e-mail for notification and the subject of your request from the e-mail address registered with us to hasan@pingel.dev, with a secure electronic or mobile signature, or in writing. We conclude requests free of charge within 30 days; if the action involves an additional cost, the fee set by the Board may apply. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.