Privacy notice

Your personal data is processed by 1Study Bilişim Danışmanlık Ticaret Anonim Şirketi (“1Study”, “we”), the data controller.

Legal name

1Study Bilişim Danışmanlık Ticaret Anonim Şirketi

Address

Merkez Mah. Gültekin Sk. No: 14 İç Kapı No: 8
34310 Avcılar / İstanbul, Türkiye

Email

privacy@1study.com

This notice covers the personal data you give us through 1study.com and its subdomains (including panel.1study.com), by email, phone or WhatsApp, or through our authorised partners.

It is written under article 10 of Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform. Where the EU General Data Protection Regulation (“GDPR”) applies to you, it also gives the information required by articles 13 and 14 GDPR.

What we process depends on the service you use. We ask only for what that purpose needs.

We do not ask for special categories of data (health, religion, ethnic origin, biometrics, etc.). If a document you upload contains such information, such as a religion field or blood group on an ID card, please cover it before sending. If a university requires a document such as a medical report, we process it only with your explicit consent (KVKK art. 6, GDPR art. 9(2)(a)) and only to pass it to that university.

• From you. Through the application, contact, transfer and preference forms on the site, and by email, phone, WhatsApp or in person.
• From our partners. If you applied through a representative or agency in your country, from that partner.
• From universities. Correspondence about your admission, pre-registration and enrolment.
• Automatically. Server and security logs created when you visit the site.

Data is collected partly by automated means (online forms, server logs) and partly by non-automated means that form part of a filing system (email and correspondence files, paper documents).

Because the data needed for your application is processed to enter into and perform a contract with you, we do not ask for your consent for it. We ask for consent only in the cases marked above. Saying no never stops you using our service, and you can withdraw consent at any time.

• The universities you choose. So they can assess your file and enrol you. Each university then processes your data as a controller in its own right.
• Our service providers. Hosting, email, cloud storage and IT support companies. They act as processors, only on our instructions and under contract.
• Our authorised partners. If you came to us through a representative or agency, to the extent needed to handle your application together.
• Our advisers. Lawyers, accountants and auditors, under a duty of confidentiality.
• Public authorities. Courts, tax offices and other authorities, only when the law requires it.

We share data only under the conditions in articles 8 and 9 KVKK and only for the purposes above. We do not sell or rent your personal data, or share it with anyone for advertising.

Our website and email systems are hosted in the Amazon Web Services Frankfurt (Germany) region, and some of our communication and cloud providers may have servers in other countries. These transfers rely on the standard contracts published by the Turkish Personal Data Protection Board under article 9 KVKK.

If you choose to write to us on WhatsApp, your messages travel over WhatsApp’s (Meta’s) infrastructure under its own terms. If you work with a partner in your country, we send them the information your application needs; this relies on the occasional-transfer exception in article 9/6 KVKK, as it is necessary to perform our contract with you.

If you send us data from the European Economic Area, it is processed in Türkiye. There is no European Commission adequacy decision for Türkiye, so we commit to giving you the protections described in this notice.

When the period ends or the reason for processing no longer applies, we delete, destroy or anonymise your data under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Records related to an ongoing dispute or official investigation may be kept until it is closed.

We use no advertising, analytics or tracking cookies, and the site loads no third-party resources. Only these strictly necessary technologies are used:

• NEXT_LOCALE cookie. Remembers your language and is deleted when you close your browser.
• Session storage. Some forms keep what you have entered in your browser so you don’t lose it; it is cleared when you close the tab.
• Panel session cookies. Keep you securely signed in when you use panel.1study.com.

Strictly necessary cookies rely on articles 5/2-c and 5/2-f KVKK and need no consent. If we ever add analytics or marketing cookies, we will switch them on only after you agree. You can delete or block cookies in your browser settings; the site will then not remember your language.

• Every connection is encrypted with TLS (HTTPS), and the site enforces a strict Content Security Policy.
• Access to your data is limited to the staff who need it for their work.
• Our staff and service providers are bound by written confidentiality obligations.
• The documents you upload are used only for your application.

If we learn that your data has been accessed without authorisation, we notify the Personal Data Protection Board within 72 hours and tell you as soon as possible.

We accept applications from candidates under 18 only with the knowledge of their parent or guardian. Service contracts and anything that needs consent are approved by the parent or guardian.

Under article 11 KVKK you can ask us to:

1. tell you whether we process your personal data;
2. give you information about that processing;
3. tell you why we process it and whether it is used for that purpose;
4. tell you who we have shared it with, in Türkiye or abroad;
5. correct it if it is incomplete or wrong;
6. delete or destroy it under the conditions in article 7 KVKK;
7. tell the people we shared it with about any correction or deletion;
8. reconsider any decision against you that results solely from automated analysis;
9. compensate you for damage caused by unlawful processing.

If the GDPR applies to you, you can also ask for data portability or restriction of processing, object to processing based on legitimate interest, and complain to the data protection authority in your country.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in English or Turkish in one of these ways:

• By post or by hand. A signed letter with a copy of your ID to: Merkez Mah. Gültekin Sk. No: 14 İç Kapı No: 8, 34310 Avcılar / İstanbul, Türkiye.
• Signed email. Signed with a qualified electronic or mobile signature, to privacy@1study.com.
• From your registered email. From the email address you gave us before and that is on file with us, to privacy@1study.com.

Please include your full name, your Turkish ID number (Turkish citizens) or your nationality and passport number (everyone else), a postal address, your email and phone number if you have them, and what you are asking for. Writing “Data protection request” in the subject line speeds things up.

We answer free of charge as soon as possible and within 30 days at the latest. If a request involves an extra cost, we may charge the fee set by the Board. If we refuse your request, you are not satisfied with our answer, or we do not answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of our answer, and in any case within 60 days of your request.

We may update this notice when the law or our services change. The current version is always on this page, with the date of the last update at the top, and we will tell you about important changes.

This notice is published in Turkish, English, Persian, Arabic and Russian. If the versions differ, the Turkish version prevails.