How account, learning, correspondence and security data are used and retained, and how to exercise your rights.
This draft describes the platform’s current operation. The controller’s identity and contact details, domain, service providers, recipients and international transfer arrangements will be added when confirmed. The document must be completed before use as the final published notice.
Scope and information processed
This notice covers START-T’s Turkish and English public pages, accounts and protected learning area. It addresses Turkish Law No. 6698 (KVKK) and the General Data Protection Regulation (GDPR) where applicable.
- Account and profile: full name, email, password-verification record, organisation/business, sector, city, country, language preference and optional telephone number.
- Learning: section and course progress, completion dates, self-assessment answers and scores, business information captured with an assessment, reports and certificate records.
- Correspondence and rights requests: messages you send, request type, request status and necessary verification/correspondence records.
- Security: session and verification records, access events, IP-derived hashes used for rate limiting and necessary technical logs.
Purposes and legal bases
Information is used to create and verify accounts, provide protected content, maintain learning records, respond to requests and operate the service securely. The mapping below is proposed; the controller must confirm necessity and legitimate-interest assessments.
Acknowledging the Privacy/KVKK notice and accepting the Terms does not give blanket consent to processing. The current platform has no marketing-consent purpose or advertising profiling. A future separate consent-based purpose would require its own information and optional choice.
Purposes and proposed legal bases| Processing purpose | Proposed legal basis |
|---|
| Providing the requested account and learning service, including progress, assessment results and certificate records | Contract formation/performance only to the extent necessary for the service: KVKK Article 5(2)(c); GDPR Article 6(1)(b) where applicable. |
| Preventing abuse, securing accounts and handling service-related correspondence | Legitimate interests, subject to necessity and a balancing of individual rights: KVKK Article 5(2)(f); GDPR Article 6(1)(f) where applicable. |
| Handling data-protection requests | Compliance with applicable data-protection obligations: KVKK Article 5(2)(ç); GDPR Article 6(1)(c) where applicable. |
| Establishing, exercising or defending legal claims | Limited to necessary records: KVKK Article 5(2)(e); GDPR Article 6(1)(f) where applicable, subject to the relevant interests and rights assessment. |
Retention, erasure and anonymisation
The periods below describe the existing project plan and technical policy; they are not presented as statutory minimum periods for every record. The necessity of the 14 April 2032 threshold and longer retention must be assessed before the final policy is adopted.
Data whose retention is no longer justified is erased, destroyed or anonymised. A valid retention hold must be limited to relevant records, reasoned and time-bounded. Erasure requests are assessed through the request process rather than an automatic account-deletion button.
Current project retention schedule| Record type | Retention criterion or period |
|---|
| Active account and profile | For as long as necessary to provide the service. |
| Inactive learner account and linked learning/self-assessment records | The current technical plan starts anonymisation eligibility at the later of 24 months after last activity and 14 April 2032. An open request, security investigation or valid retention hold can postpone assessment. |
| Certificate files and private reports | Removed following an accepted erasure request unless a valid retention hold applies. |
| Minimal certificate-integrity record | 10 years from issue; the link to the identifiable person is anonymised unless separate identifiable retention is required. |
| Security audit records | 2 years from the event. |
| Operational logs | 90 days. |
| Privacy-request records | 3 years after the request is closed. |
| Restricted security-incident records | 5 years after the incident case is closed. |
| Backups | A rolling 30-day recovery-point cycle. Previous erasures are reapplied following a restore. |
Security and access
Protected learning records and files are subject to identity and permission checks. Passwords are held as one-way verification hashes; do not share passwords, verification links or administrator verification codes. Administrators use two-factor authentication.
Keep account information accurate and sign out on shared devices. Technical measures should not be understood as a guarantee of absolute security.
Your rights and requests
Subject to applicable conditions, you may request access, correction, erasure, restriction, objection and portability. If a separate activity relies on consent, you may withdraw it for future processing. You retain the right to complain to the competent data-protection authority. Türkiye-specific rights are also described in the KVKK Disclosure.
Verified account holders can submit a request through the Privacy Centre in Profile. The project target is to acknowledge receipt within three business days. A response is provided within the applicable legal period: at most 30 days under KVKK and, where GDPR applies, generally one month. Identity checks and a reasoned extension permitted by law may be necessary. An official route for people without an account will be added when contact details are confirmed.
Self-assessment and certificates
Self-assessment produces a rule-based score and learning feedback from your answers. A course certificate records a participant’s completion of required sections; it is not business accreditation or an award decision. You may request correction of inaccurate personal information. The historical integrity of completed records and applicable retention requirements are considered when assessing the request.
