KVKK Notice

Last updated:

This notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains how the personal data of people who use the www.projeiq.com website, the asis1.projeiq.com and asis2.projeiq.com practitioner panels and the ASIS 2 mobile application (together, the “Platform”) are processed.

ASIS training, training registration and payments do not take place on the Platform. They are handled at www.asistesti.com under that site’s own terms and notices; this notice does not cover asistesti.com.

1. Data controller

Address: Anadolu University ÜYEP Center, 26470 Eskişehir, Türkiye
E-mail: [email protected]
Phone: +90 222 335 05 80 (ext. 1907)

2. Personal data we process

Website (www.projeiq.com)

  • Contact form: your name, e-mail address, the subject you select and your message.
  • Technical records: IP address, browser and device information, the address visited, date and time, security and error logs.
  • Cookies: session and security cookies; Google Analytics 4 visit statistics only if you give consent. See the Cookie Policy for details.

Practitioner panels (asis1.projeiq.com, asis2.projeiq.com)

  • Account data: first name, last name, e-mail address, username (for the ASIS 1 tablet application), an irreversible hash of the password, institution, province and district, ASIS 1 and ASIS 2 certificate numbers, ÜYEP information, access periods and panel preference.
  • Profile data (optional): title, institution, province, photo, web address, phone, e-mail and CV (PDF). These are shown publicly only if you choose to publish your profile on the “Find a Practitioner” page, and only for the fields you switch on.
  • Activity records: sign-in and password actions, IP address, session data and the bug reports you send.
  • Assessment records: records entered by a practitioner in the panel or sent from the ASIS 1 tablet application or the ASIS 2 mobile application. They contain the assessed child’s name, date of birth, age, gender, grade, school, province and district, test date, referring person and reason for referral, test answers, scores and the practitioner’s report and comments.

3. Roles for assessment records

For assessment records about children, the data controller is the practitioner who carries out the assessment and enters the record on the Platform, or the institution the practitioner works for. ProjeIQ acts as a data processor on the practitioner’s behalf and on their instructions: it stores the records, calculates scores and produces reports and Excel exports.

Informing the parent or guardian and securing the required legal basis, including explicit consent where necessary, is the practitioner’s responsibility. Each practitioner sees only their own records. ProjeIQ administrators access these records only when the service requires it, such as technical support, fixing errors or a practitioner’s request.

4. Purposes of processing

  • Answering contact messages.
  • Opening practitioner accounts, verifying identity, managing panel access by certificate and access period, and sending password setup and reset e-mails.
  • Storing and scoring assessment records and producing reports and export files.
  • Publishing optional practitioner profiles on the “Find a Practitioner” page.
  • Receiving and answering bug reports.
  • Keeping information secure, preventing automated form submissions and password-guessing attacks, and detecting and fixing errors.
  • Producing website usage statistics if you consent.
  • Complying with legal obligations, answering requests from competent authorities and protecting rights in legal disputes.

5. Legal grounds

  • Practitioner accounts and the panel service: processing is directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c).
  • Contact messages and bug reports: ProjeIQ’s legitimate interest, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f).
  • Technical records, security measures and error tracking: compliance with a legal obligation (Art. 5/2-ç) and legitimate interest (Art. 5/2-f).
  • “Find a Practitioner” profile and analytics cookies: your explicit consent (Art. 5/1). You can withdraw it at any time: profile publication in the panel, cookie choice through the “Cookie preferences” link in the site footer.
  • Establishing, exercising or protecting a right: Art. 5/2-e.
  • Assessment records: the legal ground relied on by the practitioner as data controller. As data processor, ProjeIQ complies with the security obligations in KVKK Art. 12.

6. Transfers

Personal data may be transferred, for the purposes above and only as far as necessary, to:

  • hosting, data storage and backup providers;
  • the e-mail delivery provider (password and notification e-mails);
  • Cloudflare, Inc. (domain, security, content delivery and Turnstile bot protection on forms);
  • Functional Software, Inc. (Sentry error tracking). Request bodies, cookies and form values are removed from error records; users appear only by their numeric ID;
  • Google LLC (Google Analytics 4), only if you consent to analytics cookies;
  • competent public authorities and courts, on request and as permitted by law.

Servers of Cloudflare, Sentry, Google and some hosting services may be located outside Türkiye. These transfers are made in line with the procedures in KVKK Art. 9; for analytics cookies the basis is your explicit consent. Assessment records are never shared with third parties for advertising, marketing or profiling.

7. Method of collection

Personal data is collected electronically, by automated or partly automated means, through website and panel forms, submissions from the ASIS 1 tablet application and the ASIS 2 mobile application, cookies and server logs. Practitioner accounts and assessment records may have been migrated from ProjeIQ’s earlier ASIS 1 and ASIS 2 systems.

8. Retention periods

  • Contact messages: up to 2 years after they are answered.
  • Practitioner account and profile: while the account is open. After the account is closed, kept only for possible disputes during the general limitation period.
  • Assessment records: according to the practitioner’s instructions. When a practitioner requests deletion of their records, ProjeIQ deletes them.
  • Application and security logs: usually 14 days; error tracking records up to 90 days.
  • Google Analytics data: up to 14 months.

When the period ends, data is deleted, destroyed or anonymised.

9. Your rights under KVKK Article 11

You have the right to:

  • learn whether your personal data is processed,
  • request information if it has been processed,
  • learn the purpose of processing and whether it is used for that purpose,
  • know the third parties in Türkiye or abroad to whom it is transferred,
  • request correction if it is incomplete or inaccurate,
  • request deletion or destruction under the conditions in KVKK Art. 7,
  • request that correction, deletion or destruction be notified to the third parties to whom the data was transferred,
  • object to a result against you arising exclusively from automated analysis,
  • claim compensation if you suffer damage due to unlawful processing.

10. How to apply

You can send your request, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following:

  • in writing to the address above,
  • from the e-mail address registered on the Platform to [email protected].

Your request should include your name, Turkish ID number (for foreign nationals, nationality and passport number), postal address, e-mail and phone if available, and the subject of your request. Requests are answered free of charge within 30 days at the latest; if the action requires an additional cost, the fee set by the Personal Data Protection Board may be charged.

Requests about a child’s assessment record should first be sent to the practitioner who carried out the assessment. We forward such requests we receive to the practitioner and act on their instructions.

When this notice changes, the current version is published on this page; the date of the last update is shown at the top of the page.