Privacy Policy

Last updated: 24 July 2026 · Online Exam Training

Privacy Policy & Personal Data Protection Notice

This notice is prepared in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”), secondary legislation of the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), and — where applicable — related obligations for online payment services. It describes how we process personal data in connection with the website oetcenter.com and our online education services.

1. Data Controller

The data controller (“Controller”, “we”, “us”) for personal data processed through this website and related services is:

Online Exam Training Yabancı Dil Eğitim Hizmetleri Ltd. Şti.
Küçükbakkalköy Mah. Dudullu Cad.
Brandium R1 (23-25A)/259
Ataşehir, İstanbul, Türkiye
Phone: +90 (216) 504 8863
WhatsApp: +90 (552) 455 4442
E-mail: [email protected]
Website: www.oetcenter.com

We provide online English language training, exam preparation (including IELTS and TOEFL-oriented materials and practice), tutoring, lesson booking, learning resources, and related customer support.

2. Scope and Definitions

This Policy applies to visitors of our public website, registered students, teachers/tutors, applicants, and persons who contact us (collectively, “you” / “data subjects”).

Terms such as “personal data”, “processing”, “data controller”, “data processor”, “explicit consent”, and “special categories of personal data” have the meanings given in KVKK and related guidance of the Authority.

3. Categories of Personal Data We Process

Depending on how you use our services, we may process the following categories:

Category Examples
Identity Name, surname, username, date of birth / age, nationality, profile display name
Contact E-mail address, telephone / WhatsApp number, residence or location information you provide, postal address if shared
Account & credentials Username, password (stored in hashed form), role (student / teacher / admin), account status
Profile & professional Profile photo, biography, hobbies, specialty, years of experience, country/flag display, teacher availability
Education & service Course preferences, lesson bookings, lesson times and statuses, progress or materials interaction related to our platform
Transaction / payment Order references, package or lesson purchase details, payment status, invoice/receipt information, partial card data returned by the payment institution (e.g. masked PAN, brand, expiry month/year) — we do not store full card numbers or CVV
Communication Contact-form messages, support correspondence, complaint or application content
Technical / usage IP address, browser and device information, session identifiers, cookies, log records, approximate access times, error logs
Audio-visual (lessons) Camera/microphone streams during live lessons via integrated video providers; any materials you upload or share in class tools
Legal process Data needed to establish, exercise or defend legal claims; records required by tax and commercial law

We do not intentionally collect special categories of personal data (e.g. health, religion, biometric templates) as part of our standard service. Please do not submit such data unless we expressly request it and obtain the required legal basis (including explicit consent where mandatory).

4. Purposes of Processing

We process personal data for purposes including:

  • Creating and managing user accounts (students, teachers, and authorised staff);
  • Presenting tutor profiles on the public Tutors page and matching students with teachers;
  • Scheduling, confirming, conducting and recording the status of online lessons;
  • Delivering course content, practice tests, resources and educational communications;
  • Processing payments, refunds, chargebacks and invoicing through licensed payment service providers (including iyzico);
  • Customer support, contact-form handling and responding to requests;
  • Improving platform security, preventing fraud and abuse, troubleshooting technical issues;
  • Complying with legal obligations (tax, commercial books, consumer and electronic commerce rules where applicable);
  • Establishing, exercising or defending legal rights;
  • Sending service-related notifications (booking confirmations, class access, account alerts);
  • Where required by law or with your consent, limited marketing communications about our courses and services.

5. Legal Bases under KVKK

Personal data are processed in accordance with Articles 4, 5 and (where relevant) 6 of KVKK. Depending on the activity, one or more of the following legal bases may apply:

  • Explicit consent (Art. 5/1) — e.g. optional marketing, certain non-essential cookies, or processing that cannot rely on another ground;
  • Performance of a contract or taking steps prior to entering into a contract (Art. 5/2-c) — account registration, lesson delivery, payment for purchased services;
  • Legal obligation of the controller (Art. 5/2-ç) — tax, accounting, regulatory requests;
  • Establishment, exercise or protection of a right (Art. 5/2-e);
  • Legitimate interests of the controller, provided they do not harm fundamental rights and freedoms of the data subject (Art. 5/2-f) — e.g. information security, service improvement analytics that do not require consent under applicable rules.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Methods of Collection

We collect personal data:

  • Directly from you (registration, login, profile forms, contact forms, booking flows, support channels);
  • Automatically through cookies, session mechanisms and server logs when you use the website or member portals;
  • From payment institutions and technical service providers as necessary to complete transactions or video sessions;
  • From teachers or staff when they maintain operational records related to lessons (within the scope of our services).

7. Recipients and Transfers of Personal Data

Personal data may be shared, only as necessary and in accordance with KVKK, with:

  • Authorised employees of OET Center who need access to perform their duties;
  • Teachers/tutors for the limited data required to deliver booked lessons (e.g. student display name, booking time, lesson-related notes);
  • Payment service providers, including iyzico Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico”), for payment authorisation, collection, fraud prevention and reconciliation;
  • Hosting, infrastructure and IT providers that host our website, databases, e-mail and backups;
  • Online video / classroom providers used to run live lessons (e.g. Whereby or similar tools integrated into our portals);
  • Professional advisers (legal, accounting) under confidentiality obligations;
  • Public authorities and courts when required by law or binding requests.

Cross-border transfers: Some providers (for example video platforms or cloud infrastructure) may process data on servers located outside Türkiye. Where we transfer personal data abroad, we do so in compliance with Article 9 of KVKK and applicable Board decisions/procedures (including, where required, adequacy, appropriate safeguards, or explicit consent). Details of current processors may be provided upon request.

8. Payments and iyzico

When you purchase lessons, packages or other paid services on our platform, payment transactions are processed through licensed payment institutions. We are integrating / using iyzico as a payment service provider.

  • Card details entered on iyzico-hosted or iyzico-secured payment pages are processed by iyzico under its own security standards and privacy terms;
  • We do not store full payment card numbers (PAN) or CVV/CVC codes on our systems;
  • We may receive limited payment outcome data (success/failure, transaction ID, amount, currency, masked card info, buyer identity needed for accounting);
  • Payment data are used to confirm purchases, issue receipts/invoices where applicable, prevent fraud, handle refunds/chargebacks, and meet legal record-keeping duties;
  • For more information about how iyzico processes personal data, please also review iyzico’s publicly available privacy / KVKK notices on the iyzico website.

9. Video Lessons and Third-Party Classroom Tools

Live lessons may be delivered through embedded or linked third-party video classroom services (such as Whereby). When you enter a class:

  • Your device may request access to camera and microphone (browser permissions are controlled by you);
  • Audio, video and screen-share content are processed to enable real-time teaching;
  • Those providers may process technical and session data under their terms and privacy policies;
  • Recording of lessons is not the default of our platform; if recording is introduced or required for a specific program, we will inform participants and obtain any additional legal basis required.

10. Cookies and Similar Technologies

We use cookies and similar technologies for:

  • Strictly necessary functions (login session, security, load balancing, remembering essential preferences);
  • Functional features (e.g. language preference on this page);
  • Analytics / performance (if enabled) to understand aggregate usage and improve the service.

You can control cookies through your browser settings. Blocking necessary cookies may prevent login or booking features from working correctly. Where non-essential cookies require consent under applicable rules, we will obtain it before placing them.

11. Retention Periods

We retain personal data only for as long as necessary for the purposes set out in this Policy, and in any event in line with statutory limitation and record-keeping periods, including for example:

  • Account data: for the life of the account and a reasonable period thereafter for disputes and legal claims;
  • Booking and service records: for the duration needed to deliver the service and handle complaints;
  • Payment and invoicing records: for periods required under Turkish commercial and tax legislation (commonly up to 10 years where applicable);
  • Contact-form messages: for the time needed to resolve the request and a limited archive period;
  • Technical logs: for security and operational periods typically measured in months, unless needed longer for investigations;
  • Marketing consents / preferences: until withdrawn or no longer needed.

When the retention period ends, data are deleted, destroyed or anonymised in accordance with KVKK and the Regulation on Deletion, Destruction or Anonymisation of Personal Data.

12. Data Security

We implement administrative and technical measures appropriate to the risk, including for example:

  • Access controls and role-based permissions on member portals;
  • Password hashing rather than storing passwords in plain text;
  • Use of HTTPS where configured on the hosting environment;
  • Separation of payment card capture via licensed payment providers;
  • Logging and monitoring for security events where available;
  • Staff awareness of confidentiality obligations.

No method of transmission or storage is 100% secure. We encourage you to use strong unique passwords and to protect your account credentials.

13. Your Rights under Article 11 of KVKK

As a data subject, you may apply to us to:

  1. Learn whether your personal data are processed;
  2. Request information if your personal data have been processed;
  3. Learn the purpose of processing and whether data are used in accordance with their purpose;
  4. Know the third parties in Türkiye or abroad to whom personal data are transferred;
  5. Request correction of incomplete or inaccurate data;
  6. Request deletion or destruction of personal data under the conditions set forth in KVKK Article 7;
  7. Request notification of correction/deletion/destruction to third parties to whom data were transferred;
  8. Object to results arising against you by means of analysis of processed data exclusively through automated systems;
  9. Request compensation for damage arising from unlawful processing of personal data.

14. How to Submit a KVKK Application

You may submit your requests under Article 11 of KVKK in writing or by other methods determined by the Personal Data Protection Board, including:

  • E-mail to [email protected] (preferably from your registered e-mail, with a clear subject such as “KVKK Application”);
  • Post or hand delivery to our address above, with identity verification documents as appropriate;
  • Through the contact form on our website, clearly stating that the message is a personal-data application.

Your application should include your identity information, contact details, the right you wish to exercise, and any information that helps us locate your data. We will conclude your request free of charge as soon as possible and within 30 days at the latest, in accordance with KVKK Article 13. If the process requires additional cost, fees may be charged in line with the tariff determined by the Board.

If your application is rejected, the response is insufficient, or it is not answered in due time, you may file a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within 30 days of learning our response and in any case within 60 days of the application date (KVKK Art. 14), without prejudice to other legal remedies.

15. Children and Minors

Our educational services may be used by younger learners under parental or guardian supervision. Where a user is a minor under applicable law, account creation and payment should be performed by a parent or legal guardian. We do not knowingly market directly to children in a manner inconsistent with applicable law. Guardians may contact us to review or request deletion of a minor’s data within legal limits.

16. Changes to This Policy

We may update this Policy to reflect changes in our services, payment integrations, or legal requirements. The “Last updated” date at the top of this page will be revised accordingly. Material changes may also be announced on the website or by e-mail where appropriate. Continued use of the services after an update constitutes awareness of the revised Policy to the extent permitted by law; where consent is required for a new processing activity, we will seek it.

17. Contact

For privacy and personal data questions, please contact:
Online Exam Training
E-mail: [email protected]
Phone: +90 (216) 504 8863
Address: Küçükbakkalköy Mah. Dudullu Cad., Brandium R1 (23-25A)/259, Ataşehir, İstanbul, Türkiye

This document is provided for transparency and compliance support. It is not a substitute for individual legal advice. For high-stakes filings, you may wish to have a Turkish attorney review company-specific details (trade registry title, MERSİS number, VERBİS registration status, etc.).