Privacy Policy

Version 1.0.0 · Effective October 3, 2026

This Privacy Policy explains how Dijital Dergicilik Okulu ("DDO", "we", "us") collects, uses, shares and protects your personal data through www.dergicilikokulu.com. It is written with the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), the ePrivacy rules and children's online privacy rules (including COPPA) in mind.

1. Data Controller

The controller responsible for processing your personal data is Dijital Dergicilik Okulu, run from Türkiye and supported by Dijital Jenerasyon Derneği (the Digital Generation Association).

Contact: dergicilikokulu@gmail.com

2. Categories of Data We Process

• Account data: name, email address, profile photo, sign-in provider (Google, Apple or email).
• Application and profile data: school, date of birth, grade, education status, city.
• Learning data: lesson progress, quiz and exam results, certificates, capstone and magazine submissions and drafts, and the email address used if you link your MagPublish account.
• Work submissions: writing, designs and other work you upload.
• Legal acceptance records: the version of each document you accepted, timestamp, language, method of acceptance and browser user-agent.
• Technical data: IP address, device and browser information, pages visited and usage statistics through Google Analytics, cookies and local storage.
• Support correspondence: information you send us by email.

3. Sources of Data

We obtain data directly from you (forms, account creation, learning activity), from your sign-in providers (Google, Apple; only what you authorise) and automatically from your device or browser (cookies, logs).

4. Purposes and Legal Bases

• Creating your account and providing the education service (progress tracking, exams, certificates, verification): GDPR Art. 6(1)(b) performance of a contract; KVKK Art. 5(2)(c).
• Security, preventing abuse and fraud, improving the service, statistics: GDPR Art. 6(1)(f) legitimate interests; KVKK Art. 5(2)(f).
• Keeping legal acceptance records and proving our rights: legitimate interests; establishment, exercise or defence of legal claims (KVKK Art. 5(2)(e)).
• Analytics and advertising cookies, communication preferences: consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You may withdraw consent at any time.
• Legal obligations and requests from competent authorities: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a) and (ç)).
• Children's data: the bases above apply subject to the parental or guardian consent requirement.

5. Recipients and Processors

We share data only as needed to run the service, with:

• Google Firebase (Authentication, Firestore, Hosting): authentication, database and hosting.
• Google Analytics: usage statistics (subject to your consent).
• Google AdSense / Google Ads: ad delivery and measurement (subject to your consent; see the Cookie and Advertising Policy).
• Sign in with Apple: authentication if you choose Apple.
• Email service providers: sending notifications and support messages.
• MagPublish: only if you link your account to MagPublish, and only the information needed for the link.
• Public authorities: only where legally required.

These providers are subject to their own privacy policies and data processing terms.

6. We Do Not Sell Personal Data

We do not sell or rent your personal data. We do not sell personal information for money within the meaning of the CCPA/CPRA. However, advertising and analytics cookies may count as "sharing" or "cross-context behavioural advertising" under some laws. We therefore offer an opt-out of personalised ads: use the "Cookie Settings" link in the footer or Google Ads Settings. We do not use sensitive personal information for advertising.

7. International Transfers

Our service providers (notably Google) may process data on servers in Türkiye, the European Economic Area, the United States and other countries, so your data may leave your country of residence. Where required we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework and the safeguards under KVKK Art. 9.

8. Retention

• Account and learning data: for as long as your account is active; deleted or anonymised within a reasonable time after you ask us to delete it.
• Legal acceptance records: kept as evidence for the applicable limitation period.
• Certificate records: minimum verification details (such as name, certificate number and date) may be kept so that a certificate remains verifiable.
• Analytics and advertising data: according to the provider's settings and our Cookie and Advertising Policy.
• Support correspondence: deleted after your request is resolved and a reasonable period has passed.

When the period ends, data is deleted, destroyed or anonymised.

9. Security

We apply reasonable technical and organisational measures against unauthorised access, loss, alteration and disclosure, such as encrypted connections (HTTPS), access controls, Firebase security rules and restricted permissions. No system is completely risk-free, so absolute security cannot be guaranteed.

10. Children's Privacy

The platform is not directed at children under 13 and we do not knowingly collect their data. If we learn we have collected data from a child under 13, we will delete it, and parents may contact us to ask for this. Users aged 13 to 17 (or below the age of digital consent in their country) need parental or guardian consent. A parent may ask to access, correct or delete their child's data. We do not use children's data for advertising profiling.

11. Your Rights

Under GDPR / UK GDPR: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and withdrawal of consent.

Under KVKK Art. 11: to learn whether your data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom data is transferred in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction under KVKK Art. 7; to request that these actions be notified to third parties to whom data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.

Under CCPA/CPRA (California residents): rights to know and access, delete, correct, opt out of sale or sharing, and not to be discriminated against for exercising rights. We will not treat you differently for exercising them.

How to exercise them: email dergicilikokulu@gmail.com. We may ask for reasonable information to verify your identity. We will respond within 30 days.

Right to complain: if you are not satisfied, you may complain to the Personal Data Protection Board (KVKK Kurulu) in Türkiye, to your local data protection supervisory authority in the EU/UK, or to the relevant state Attorney General in the US.

12. Automated Decisions

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you. Automated calculations such as exam scoring are part of the education service and can be reviewed on request.

13. Data Breach Notification

If a breach affects the security of your personal data and creates a risk to your rights, we will notify the competent authority (for example the Board under KVKK Art. 12, or the supervisory authority within 72 hours under GDPR) and, where required, affected individuals, within the periods and in the manner set by applicable law.

14. Changes, Versioning and Acceptance Records

We may update this policy. The version number and effective date of each version appear at the top of this page. For material changes you will be asked to accept the new version again. To meet our legal obligations and to prove acceptance, each time you accept we record the document version, time of acceptance, language, method and browser user-agent; these records are kept in an unalterable form.

15. Contact

For all privacy questions and requests: [dergicilikokulu@gmail.com](mailto:dergicilikokulu@gmail.com)