KVKK information notice (Aydınlatma Metni)

This notice is given under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK). It tells you who processes your personal data on Skorway, why, on what legal basis, who receives it and how you can use your rights. Our privacy policy gives more detail.

Data controller

• [Company legal name]
• Address: [Company address]
• Registration number: [Registration number]
• Tax office: [Tax office and number]
• Email: privacy@skorway.com
• KEP address: [KEP address]

Personal data we process

• Identity and contact: name, email address and, if you sign in with Google or Apple, the profile photo they share.
• Settings: interface and explanation language, email choices and, optionally, test date and target band.
• Test and practice data: answers, essays, Speaking recordings and their transcripts, scores, feedback, re-score requests and practice history.
• Transaction data: order, amount, currency, date and receipt number. We never see or store card numbers.
• Optional data: official score reports and reviews you choose to send.
• Referral and partner data: invitations, coupon and teacher codes used, and teacher commission records.
• Communication data: support emails.
• Transaction security data: technical logs (such as IP address, browser and device), error reports and cookie choices.
• Marketing data: analytics data, only with your consent.

We do not process special categories of personal data under Article 6. We do not use voice recordings to identify you.

Purposes and legal bases

• Setting up and running your account, sign-in, mocks, practice, study plans and emails needed for the service. Legal basis: the processing is necessary to set up and perform a contract with you (Article 5(2)(c)).
• Transcribing and scoring your answers with AI, writing feedback and re-scoring. Legal basis: performance of the contract (Article 5(2)(c)).
• Payments, receipts, refunds, tax and accounting records. Legal basis: performance of the contract and compliance with our legal obligations (Article 5(2)(c) and (ç)).
• Checking scoring quality, re-scoring answers, reminders and plan emails, security, error fixing and preventing abuse. Legal basis: our legitimate interests, provided they do not harm your fundamental rights and freedoms (Article 5(2)(f)).
• Handling disputes and legal claims. Legal basis: establishing, exercising or protecting a right (Article 5(2)(e)).
• Analytics cookies, the newsletter, and occasional transfers abroad where no other safeguard is available. Legal basis: your explicit consent (Article 5(1) and Article 9). You can withdraw consent at any time.

Transfers in Türkiye and abroad

We share personal data only as needed for the purposes above:

• Service providers: Anthropic (AI scoring; answers are not used to train its models under Anthropic's commercial API terms), Deepgram (speech-to-text), Resend (email), Paddle (US dollar payments, merchant of record), iyzico (Turkish lira payments), Vercel (application hosting), Neon (database, EU region Frankfurt), Cloudflare R2 (recordings, EU), PostHog (analytics, EU cloud, only with consent) and Sentry (error reports).
• Teachers, only if you used their partner code and agreed to share your reports.
• Anyone with your report number, who can see only your initials, date and bands at skorway.com/verify.
• Authorised public institutions, such as tax authorities and courts, when the law requires it.

Several of these providers are located, or process data, outside Türkiye, including in the European Union and the United States. Under Article 9, we transfer personal data abroad only:

• to countries with an adequacy decision of the Personal Data Protection Board; or
• with appropriate safeguards, such as the standard contracts published by the Board, which we notify to the Personal Data Protection Authority within the legal deadline; or
• for occasional transfers where none of the above is available, with your explicit consent or another exception listed in Article 9.

How we collect your data

We collect data electronically, when you create an account, sign in, take mocks and practice sets, record Speaking answers, make payments, send us emails or use the site. Some data comes from Google or Apple when you choose them for sign-in, and from Paddle or iyzico when you pay. Analytics data is collected through cookies only after your consent.

Retention

We keep account data, answers and recordings while your account exists. After you delete your account, they are deleted within 30 days, and backups rotate out within 35 days. Receipts and payment records are kept as long as tax and commercial law requires (up to 10 years in Türkiye), with nothing else attached. A one-way, keyed code made from your email address is kept with the free allowances you used, so the same address does not get them twice; it cannot be turned back into your address (preventing abuse, Article 5(2)(f)). Anonymised statistics may be kept. When the reason for keeping data ends, it is deleted, destroyed or anonymised.

Your rights under Article 11

You have the right to:

• learn whether your personal data is processed;
• request information about the processing;
• learn the purpose of the processing and whether data is used for that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• ask for incomplete or incorrect data to be corrected;
• ask for data to be deleted or destroyed under the conditions in Article 7;
• ask for corrections and deletions to be notified to third parties who received the data;
• object to a result against you that arises only from automated analysis of your data, such as AI scoring;
• claim compensation for damage caused by unlawful processing.

You can correct your details, download all your data ("Download my data") and delete your account yourself on the Account page.

How to apply

Under Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in Turkish or English:

• in writing, by post or by hand, to [Company address];
• by registered electronic mail (KEP) to [KEP address], or with a secure electronic or mobile signature;
• by email to privacy@skorway.com, from the email address registered on your Skorway account.

Please include your name and surname, signature (for written applications), your Turkish ID number or, if you are not a Turkish citizen, your nationality and passport or ID number, your address or email for reply, and what you are asking for.

We will reply within 30 days at the latest, free of charge. If the reply requires a significant cost, we may charge only the fee set by the Personal Data Protection Board. If your application is refused, our reply is unsatisfactory or we do not reply in time, you can complain to the Personal Data Protection Board within 30 days of our reply, and in any case within 60 days of your application (Article 14).