KVKK Privacy Notice

1. Data controller

As Adil Onur Karahan Şahıs Şirketi (the “Company”), the privacy and security of your personal data are among our top priorities. Our Company processes your personal data in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the secondary legislation. Personal data means any information that makes your identity identified or identifiable.

This notice has been prepared to inform you about your personal data processed when you benefit, as a member or as a guest, from the services (the “Platform Services”) offered on the Attendify+ mobile application and website (the “Platform”) owned by our Company.

When you use Attendify+ without creating an account (as a guest), your term, course, attendance, event and note data is stored only on your device; it is not sent to the Company’s servers and the Company cannot access this data. When you delete the app, this data is also deleted and cannot be recovered.

2. What personal data do we process?

• Your user account information (only if you create an account): your membership email address, your password (stored in irreversibly hashed form), your account ID, your email verification and password reset records, your first and last name, your optional profile photo and, if you sign in with Google or Apple, your account ID at the provider and (with Sign in with Apple) the encrypted refresh token.
• Your Platform usage information (on the server only if you create an account): your term and course information, your course schedule (day, time, classroom, instructor name), your attendance records by class hour (present, absent, other, cancelled), “other” reasons and their subcategories, absence allowances, your exams, homework and meetings, your lecture notes and the photos, files and voice notes you attach to notes, your Pomodoro focus sessions, and your storage usage.
• Your Explore and community information (only if you create an account and use these features): your university and department, the school email address you verify, the notes you publish on Explore, your likes, saves and reports, your community memberships, and your likes and votes on announcements.
• Your transaction security information: your IP address, request time, server access logs, session keys and app version.
• Your marketing information: your advertising ID and your ad interaction information (in the app through Google AdMob and its mediation partners Meta Audience Network and Unity Ads, also in guest use); on the web panel, the advertising cookies used by Google AdSense, your IP address and your browser information.
• Your notification information (only if you create an account and allow notifications): your phone’s notification token (Firebase Cloud Messaging), your app language and your notification preferences.
• Your usage statistics information: the random installation ID generated by the app when it is first opened, the days on which the app was opened and the number of sessions, the platform, the app version, the language and whether you were logged in that day (also in guest use; not associated with your account, your advertising ID or the device’s hardware ID).
• Your request and legal transaction information: your applications, requests and complaints, the feedback you send from the app or the web panel, and the information in correspondence with competent persons, institutions and organizations.

Content you voluntarily enter in your notes, reasons or attachments (e.g. a friend’s name or a note about your health) is stored together with that content. The Company does not process this content for any purpose other than providing the service; we recommend that you do not enter special categories of personal data.

3. Legal grounds and purposes of the processing of your personal data, and methods of collection

Your personal data is collected by automated means in electronic form through the Platform; by email if you contact us by email; and in physical form if it is submitted by application form, notification or post, or served by legal authorities. The purposes and legal grounds of processing are set out below.

3.1. Membership, account creation and provision of the Platform Services

Your personal data processed in this category: your user account information, your Platform usage information, your transaction security information, your notification information, your Explore and community information.

• Establishment and performance of the membership agreement,
• Creation of the account, verification of the email address, password reset, management and closure of the account,
• Storage of data on the server, its synchronization across devices and application of the storage limit,
• Storage of photos attached to notes in resized form,
• Provision of the Explore, community and Pomodoro leaderboard features, review of posts and reports,
• Sending notifications to your phone when your posts are liked or saved, and about moderation decisions and replies to your feedback.

Legal grounds: It is necessary for the establishment and performance of the membership agreement between you and us (KVKK Art. 5/2-c).

3.2. Improvement of the Platform experience

Your personal data processed in this category: your transaction security information, your usage statistics information, your request information.

• Detection and correction of errors,
• Measuring on how many devices and how often the app is used, and determining development priorities,
• Evaluation of requests, complaints and suggestions.

Legal grounds: It is necessary for the performance of the agreement; the legitimate interest of our Company, provided that your fundamental rights and freedoms are not harmed (KVKK Art. 5/2-c, f).

3.3. Information security and prevention of misuse

Your personal data processed in this category: your user account information, your transaction security information.

• Conduct of information security processes,
• Limitation of excessive and automated requests, and detection and prevention of unauthorized access attempts.

Legal grounds: It is mandatory for our Company to fulfill its legal obligation; the legitimate interest of our Company (KVKK Art. 5/2-ç, f).

3.4. Conduct of legal affairs

Your personal data processed in this category: your user account information, your transaction security information, your request and legal transaction information.

• Conduct of legal affairs and litigation, and review of and response to data subject applications,
• Provision of information to competent persons, institutions and organizations,
• Fulfillment of obligations arising from the legislation to which we are subject, in particular Laws No. 6563, 6102, 5237, 5651 and 6502.

Legal grounds: It is expressly provided for by law; fulfillment of a legal obligation; establishment, exercise or protection of a right (KVKK Art. 5/2-a, ç, e).

3.5. Advertising activities

Your personal data processed in this category: your marketing information, your transaction security information.

• Display of banner, interstitial and in-feed ads within the app,
• Display of advertisements on the web panel used after logging in,
• Provision of advertisements personalized to your interests.

Legal grounds: The legitimate interest of our Company in being able to offer the Platform free of charge (KVKK Art. 5/2-f) and the consent you give to the display of personalized advertisements by downloading and using the Platform. Advertising data is transferred to the servers abroad of Google and of AdMob’s mediation partners Meta and Unity in accordance with Article 9 of the KVKK. You may turn off personalized ads at any time in your device settings and, on the web panel, at adssettings.google.com or in your browser’s cookie settings; in that case, non-personalized ads are shown.

4. To whom and for what purposes is your personal data transferred?

Our Company shares your personal data in accordance with the “need-to-know” and “need-to-use” principles, ensuring data minimization and taking the necessary technical and administrative measures. Your account data is stored on servers in Türkiye. Your personal data may be shared, limited to the purposes above and in accordance with Articles 8 and 9 of the KVKK, with the following recipient groups:

Notes you publish on Explore of your own accord are visible to everyone (including visitors who are not logged in), together with your display name (your first name and the initial of your last name, e.g. “Ayşe D.”), profile photo, university and department, and with their like and save counts; this information, together with your badges and Explore statistics, also appears on your public profile page and on the Explore leaderboard. When you share a note via a share link, the note can be viewed by anyone who has the link. The Pomodoro leaderboard and the lake of a community you are a member of show your display name, profile photo and focus time; you can hide yourself from the leaderboard. When you join a community, the community’s administrator sees your first name, last name, profile photo, the date you joined and, if you have verified a school email address, only its domain (e.g. ege.edu.tr); for likes and votes you give on community announcements, your display name is visible to those who can see the announcement and your full name to the community administrator. Your email addresses are never shown to other users. You may remove your Explore post and your share link and leave a community at any time; apart from these, your data cannot be viewed by other users.

5. How does the Company protect your personal data?

In its capacity as data controller, the Company takes the necessary technical and administrative measures to protect the confidentiality and integrity of information:

• Data transmission between the Platform and the servers is encrypted with SSL/TLS.
• Passwords are stored in irreversible form; verification codes and session keys are also kept on the server only as hashes.
• Session keys are stored on the device in the operating system’s encrypted storage (Android Keystore / iOS Keychain).
• Access to personal data is restricted by authorization, and access logs are kept.
• Regular checks for security vulnerabilities are carried out, and data is backed up regularly.

6. Your rights regarding the protection of your personal data

Pursuant to Article 11 of the KVKK, by applying to our Company:

• to learn whether your personal data is being processed,
• to request information about it if it has been processed,
• to learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• to know the third parties in Türkiye or abroad to whom it has been transferred,
• to request its rectification if it is incomplete or inaccurately processed, and to request that this operation be notified to the third parties to whom it has been transferred,
• to request its erasure or destruction if the reasons requiring its processing no longer exist, even though it has been processed in accordance with the Law, and to request that this operation be notified to the third parties to whom it has been transferred,
• to object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems,
• to claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

you have each of the rights listed above.

7. Contact for your rights and requests

You may submit your requests, with a petition in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller or using the Data Subject Application Form on our Policies page, through the following channels:

We kindly ask that you write “Data Subject Request under the Law on the Protection of Personal Data” in the subject line of the application envelope or email.

*For applications in person, only the front side of a document proving your identity needs to be presented (with the blood type and religion fields not visible).

Your requests will be concluded free of charge within 30 (thirty) days at the latest. If the process additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

8. About this privacy notice

The Company may update this notice in line with changes in the legislation and on the Platform. The current version is published on the Platform.