Clarification Text on Processing of Personal Data

As Ibility Teknoloji Anonim Şirketi ("Ibility" or "Company"), we attach great importance to the protection of your personal data. We process your personal data in a transparent, fair and lawful manner within the limits set forth in Article 10 of the Personal Data Protection Law No. 6698 ("Law") and the Communiqué on Procedures and Principles to Be Followed in Fulfillment of the Disclosure Obligation, and we take care to take the necessary administrative and technical measures in this regard.

Within the scope of this clarification text, Ibility;

• acts as data controller with regard to personal data processed within the scope of its own commercial activities,
• acts as data processor with regard to personal data entered, created or managed by customers through the application.

With this clarification text, we would like to inform you about the personal data we process within the framework of your business relationship with Ibility.

1. Types of Personal Data Processed

The following categorized personal data are processed on our platform:

• Identity Information: Users' first and last names, names in expert profile information, client/customer names in expert consultancy sessions.
• Contact Information: Email address (user login, expert/client communication, team invitations), phone number (only in expert profiles).
• Financial Information: Invoice information (name-surname, address, city, country, postal code), tax number, last 4 digits of credit card (full card number is never stored in our system), subscription billing address.
• Security Data: Password hash (encrypted with bcrypt algorithm and not kept in plain text), refresh token hashes for session management, password reset token hashes.
• Access and Transaction Security (Log) Information: IP address recorded during media file access, browser information (user agent), timestamps.
• Professional Information (For Experts): Areas of expertise, certificates, educational background, experience.
• Visual/Profile Information: Expert profile photo, team logo.
• User Content Data: Test responses and scores, visual test responses, AI chat messages (free text inputs).
• Behavioral Data: Program event logs (module/page visit history), action execution records, XP points and level information, cursor position during real-time editing.
• Other: User metadata field (flexible additional information in JSONB format).

Warning Regarding Special Categories of Personal Data: Our platform's database structure does not have a dedicated field for special categories of personal data such as health, biometric data, race/ethnic origin, political opinion, religious belief, or criminal convictions. However, in the event that users voluntarily enter special categories of personal data into AI chat areas, test responses, and free text fields in JSONB format, such data will be processed only based on your explicit consent pursuant to Article 6 of KVKK and with cryptographic security measures in compliance with Board Decision No. 2018/10. Users are advised not to enter special category data into these fields unless mandatory.

2. Purposes of Processing Personal Data

Your personal data is processed in accordance with the principles of "processing for specified, explicit and legitimate purposes" and "being relevant, limited and proportionate to the purposes for which they are processed" as stated in Article 4 of KVKK, for the following purposes:

• Authentication and Authorization: Ensuring user login, session management and Role-Based Access Control (RBAC).
• Service Delivery: Complete provision of training programs, tests and AI assistant services.
• Team and Organization Management: Managing team memberships, invitations and role assignments in a multi-tenant SaaS structure.
• Payment and Billing: Receiving subscription payments and fulfilling legal invoicing obligations.
• Expert Consultancy Service: Expert-client matching and session management.
• Content Management: Creating and publishing blog content and media files.
• Notification Delivery: Sending email and in-app notifications within the platform's operational processes (session reminders, team invitations, password resets).
• Performance Tracking and Gamification: Calculating test scores, measuring completion rates, operating the XP point and level system.
• Security and Audit: Logging access to media files, preventing unauthorized access.
• AI Chat Service: Transmitting user messages to the AI model and generating responses.

Marketing and Advertising Prohibition: Your personal data will not be used for marketing, advertising or commercial communication purposes without your explicit consent and will not be shared with third parties for such purposes.

3. Legal Grounds for Data Processing

Your personal data is processed based on the following legal grounds specified in Articles 5 and 6 of KVKK:

• Establishment and Performance of Contract (Art.5/2-c): Email, name/surname, password, team memberships, program/test data and expert matching information necessary for service delivery.
• Fulfillment of Legal Obligation (Art.5/2-ç): Invoice information, tax number, payment records required by tax legislation and access logs required to be kept under Law No. 5651.
• Legitimate Interest of the Data Controller (Art.5/2-f): IP address, browser information and access logs kept for platform security and fraud prevention, without prejudice to your fundamental rights and freedoms.
• Explicit Consent (Art.5/1 and Art.6/2): Additional information not mandatory for service performance (notification preferences, profile photo, expert certificate information), possible special category personal data that may be entered in free text fields, and international transfers. (Explicit consent is not imposed as a precondition for service delivery).

4. Data Collection Methods

Your personal data is collected through fully or partially automated means or non-automated means provided that they are part of a data recording system; through web application (registration forms, tests, chat screens), REST API, WebSocket (real-time chat), email invitations, payment forms, file upload modules, and automatically recorded system logs (IP, browser information).

5. Transfer of Personal Data and International Sharing

Your personal data is transferred to the following recipient groups in accordance with Articles 8 and 9 of KVKK, the principles of proportionality and purpose limitation:

• Intra-Team Sharing: Test results, program data and blog content are shared only with authorized users (admin, editor roles) within the same team as a closed-circuit platform sharing.
• Expert-Client Sharing: Parties' information is mutually shared for performance purposes in consultancy sessions.
• International Transfer (Cloud and AI Infrastructure): All server and database infrastructure of our platform is hosted in the AWS EU (Frankfurt, Germany) region. In this context, Database (PostgreSQL), File storage (AWS S3), Email delivery (AWS SES), AI chat messages (AWS Bedrock) and Cache (Redis) data are transferred to Germany. While Germany is a country that provides adequate protection under GDPR, this transfer is carried out pursuant to your explicit consent or a Board-approved adequate protection commitment under Article 9 of KVKK, encrypted to international standards (ISO 27001).

6. Retention Period and Destruction Policy

Your personal data is retained for the duration required by the processing purposes or for the legal retention periods prescribed by the relevant legislation (e.g., 2 years for log records, 10 years for invoice records).

• Destruction Obligation: Personal data whose processing reason has ceased, whose legal retention period has expired, or for which a valid deletion request has been submitted by you, are deleted, destroyed or anonymized ex officio or upon your request pursuant to Article 7 of KVKK and related regulations.
• Soft Delete Application: The "soft delete" (is_active = false) process applied in our system is a temporary data integrity measure, and when legal retention periods expire, these data will be physically destroyed from the database permanently (including ON DELETE CASCADE mechanisms) or irreversibly anonymized. No unlimited data retention is performed.

7. Data Security and Breach Notification

As data controller, in order to prevent unlawful processing of your personal data and unlawful access to data pursuant to Article 12 of KVKK, we jointly take the following technical and administrative measures:

• Technical Measures: Hashing passwords with bcrypt algorithm instead of plain text, token expiry (expires_at) and revocation mechanisms, use of unpredictable UUIDs instead of sequential IDs, Role-Based Access Control (RBAC), credit card data minimization (only last 4 digits), periodic penetration tests and AWS infrastructure security.
• Administrative Measures: Execution of confidentiality agreements with employees, data minimization policies, KVKK awareness training for personnel and regular audit of authorization matrices.
• Breach Notification: In the event of any cyber attack or unauthorized access (data breach), this will be reported to the Personal Data Protection Board within 72 hours at the latest from the date of learning pursuant to Article 12/5 of KVKK, and to you (via email or website announcement) within the shortest reasonable time.

8. Profiling and Automated Assessment

Automated algorithms are used on our platform for the calculation of test scores, operation of the XP/Level system and tracking of the learning journey. Pursuant to Article 11/1-g of KVKK, you have the right to object to a result arising against you through the analysis carried out exclusively through automated systems.

9. Rights of the Data Subject and Application Channels

As a data subject, you have the following rights pursuant to Article 11 of KVKK:

1. To learn whether personal data is processed,
2. To request information about personal data if processed,
3. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data is transferred domestically or abroad,
5. To request rectification of personal data if processed incompletely or incorrectly,
6. To request deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of KVKK,
7. To request notification of operations carried out pursuant to paragraphs (5) and (6) to third parties to whom personal data has been transferred,
8. To object to a result arising against the person through the analysis of processed data exclusively through automated systems,
9. To claim compensation for damages in case of unlawful processing of personal data.

Application Procedure: In order to exercise your above-mentioned rights, you may submit your requests in writing or through registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address registered in our system to the following communication channels: Your requests will be concluded free of charge within the shortest time and at the latest within 30 (thirty) days depending on their nature. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged. In case of rejection of your request, the reason for rejection will be communicated to you in writing or electronically in accordance with the principle of good faith.

Identity of the Data Controller

Company Title: Ibility Teknoloji Anonim Şirketi
MERSIS No: 0465151885700001
Trade Registry No: 1008207
Tax Office / Tax No: Sarıyer / 4651518857
Contact Address: Reşitpaşa Mah. Katar Cad. İTÜ Tasarım ve Prototip Merkezi Binası No:2/41 İç Kapı No:2 Sarıyer/İstanbul, 34469
E-Mail Address: [email protected]
KEP Address: [email protected]