LEGAL TERMS · VERSION 1 OCTOBER 2026
Personal Data Notice (KVKK)
Effective date: 1 October 2026. An order is governed by the version published at the time of the order and accepted on the checkout page. Earlier versions are available on request.
Data controller
For the purposes of Law No. 6698 on the Protection of Personal Data (6698 sayılı Kişisel Verilerin Korunması Kanunu) (the "Law"), the data controller is SU GRUP ENERJİ YATIRIMLARI MÜHENDİSLİK İNŞAAT PROJE MÜŞAVİRLİK TİCARET LİMİTED ŞİRKETİ. Address: Dağyaka Mah. F.S.M. Bulvarı 2008. Sk. No: 15, 06890 Kahramankazan / Ankara. MERSİS: 0781046351100017. KEP: sugrupenerji@hs01.kep.tr. E-mail: hello@aiworkschool.com.
What data, for what purposes
Identity and contact data (name and surname or trade name, e-mail address; for an individual buyer, the Turkish identity number (T.C. kimlik numarası) if required for the invoice) are processed to activate the seat, verify sign-in and communicate with you. Customer transaction data (order, number of people, amount, payment result, the texts accepted and the moment of acceptance, withdrawal, termination and refund requests) are processed to conclude and perform the contract, record the sale, invoice and keep evidence for any dispute. Usage data (modules opened and completed, the moment module notes were downloaded) are processed to provide the advisory service, provide a progress report and prove the moment at which the right of withdrawal ended. Transaction security data (sign-in records, IP address, browser information) are processed to ensure information security and prevent abuse. Card details are not processed. Special categories of personal data are not processed, and entering them into the service is prohibited. For exams and the certificate: attempt date and duration, score, topics answered wrongly, number of tab changes, certificate number, average score and grade; the purpose is to assess the exam, issue the certificate and make it verifiable.
Method of collection
Data are collected electronically, partly by automated means, through order, invitation and sign-in forms, e-mail correspondence, payment result notifications, strictly necessary cookies and server logs. In a company order, participants' names and e-mail addresses are provided by the company placing the order.
Legal basis
Processing is based on Article 5(2) of the Law: it is necessary for the conclusion and performance of a contract (sub-paragraph (c)); record-keeping and retention obligations under tax, commercial and consumer legislation (sub-paragraph (ç)); it is necessary for the establishment, exercise or protection of a right (sub-paragraph (e)); and our legitimate interest in the security of the service, provided that it does not harm your fundamental rights and freedoms (sub-paragraph (f)). If processing requiring explicit consent (for example, marketing messages) is to be carried out, your consent is requested separately, on an optional basis and without being made a condition of the service.
To whom data are transferred and for what purpose
Personal data are transferred only to the extent required by the service, to the following groups of recipients. Hosting and database: Render (Frankfurt, Germany). Sign-in verification: WorkOS. Transactional e-mails: Resend (EU region). Corporate e-mail: Google Workspace. The site's AI assistant: Anthropic, PBC (USA). Payment, tax and customer invoicing: Polar Software, Inc. (USA) and its payment processor Stripe. Accounting: our financial adviser. Authorised public institutions and organisations and judicial authorities: only where there is a legal obligation. In a company order, whether a participant has taken up their seat and the number of modules they have completed are provided to the company that placed the order. Domestic transfers are made in accordance with Article 8 of the Law, and transfers abroad in accordance with Article 9. Transfers to providers headquartered abroad are carried out on the basis of the standard contracts announced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); the process of signing the contracts and notifying the Authority (Kurum) is ongoing, and this text will be updated as it is completed.
Retention period
Data are kept for the periods stated in the Privacy Policy; when the period expires, they are deleted, destroyed or anonymised. Exam records are kept for the seat's term and three years after it ends; the certificate record and verification data for as long as the certificate remains valid.
Your rights
Under Article 11 of the Law, you have the right to learn whether your personal data are processed; to request information if they have been processed; to learn the purpose of processing and whether they are used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom they are transferred; to request correction if they are incomplete or inaccurately processed; to request deletion or destruction where the conditions are met; to request that these actions be notified to the third parties to whom the data were transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer loss because of unlawful processing.
How to apply
You may submit your application in Turkish by a petition bearing your wet-ink signature to the address above, by KEP to sugrupenerji@hs01.kep.tr, or from the e-mail address registered in your order or account to hello@aiworkschool.com. The application must clearly state your name and surname, your contact details and your request. We conclude an application for which we can verify your identity within thirty days at the latest, free of charge as a rule; if the action requires an additional cost, the tariff set by the Board may be applied. If you find the response inadequate or do not receive a response in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 14 of the Law.
Language
This is a translation. In case of any discrepancy, the Turkish text prevails.