Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

The data controller is ROUTA EĞİTİM VE DANIŞMANLIK ANONİM ŞİRKETİ (the "Company"), Haseki Sultan Mah. Müni̇fpaşa Sk. No: 66 İç Kapı No: 1, Fatih / İstanbul. MERSİS: 0735237591100001. Trade registry no: 1164543 (İstanbul Ticaret Sicil Müdürlüğü). Tax: Beyazıt V.D. 735 237 5911. Data protection contact: info@edurouta.com. No telephone number is published on the site; you can reach us through the website, e-mail and the Telegram bots.

This notice covers personal data processed through the website, the admission forms, the housing form, e-mail, the Telegram bots and the panel. If you share data through another channel, that channel's terms may apply as well.

• 2.1Identity and contact: name, surname, date of birth, nationality, sex, phone, e-mail, country, preferred contact channel.
• 2.2Education and request details: target country, study level, programme, budget, intake, language levels, free-text notes.
• 2.3Documents: passports, diplomas, transcripts, language certificates, photographs and similar files you upload, together with their upload and review records.
• 2.4Conversations: website chat, e-mail correspondence and Telegram bot messages, with timestamps.
• 2.5Housing application: study details, dormitory preference, transfer and migration-support choices, planned arrival date, and the name and phone of the parent or responsible adult you name.
• 2.6Transaction security: salted hash of your IP address, browser and device information, session records, error logs.
• 2.7Special-category data: health information only if you report it and give explicit consent, to plan suitable housing and support. The service is available without it.

We process data to receive and answer your request, to run university, language-course, housing and visa processes, to prepare the application and pass it to the institution, to communicate with you, to check the process and the documents, to measure and improve service quality, to produce anonymised statistics and analysis, to prevent forgery and misuse, and to meet accounting and legal duties.

Analytics use aggregated results that do not identify you; we do not build profiles tied to your identity and we do not sell data to advertising networks.

Processing relies on Article 5/2 KVKK: necessity to conclude or perform a contract, compliance with a legal obligation, establishment or protection of a right, and our legitimate interest; where none applies, on your explicit consent.

Cross-border transfer (Art. 9) and commercial electronic messages require your explicit consent separately. Special-category data is processed only under Art. 6 with your explicit consent. The consent steps in the application form reflect this; services that do not require processing are available without giving a consent.

Data is shared only with the parties needed to deliver the service:

• 5.1Infrastructure: hosting (VPS), database and file storage.
• 5.2Communication: the e-mail delivery service (SMTP) and Telegram.
• 5.3Artificial intelligence: the DeepSeek API generates chat answers. Only the conversation text is sent; images of identity documents are not.
• 5.4At your request, the university, school, language course, dormitory or authorised agency you apply to.
• 5.5Agreed translation, notary and advisory partners in the document process.
• 5.6Accountant, bank and competent public authorities where the law requires it.

Transfers cover only what the institution asks for and serve the completion of your application.

Our servers and some providers are located outside Türkiye, so data may be transferred abroad under Article 9 KVKK. Transfer relies on your explicit consent or on the safeguards the Authority requires. You may withdraw consent at any time; withdrawal does not make earlier processing unlawful.

Advice records are kept for 2 years after the request closes, accounting records for 10 years, data-subject requests for 2 years and server access logs for 12 months.

Application documents are kept while the process is open and for no more than 12 months afterwards; rejected applications are deleted as soon as possible. Afterwards data is deleted, destroyed or anonymised; anonymised data may be used for statistics without a time limit.

The Company limits access by role and section, logs access, requires three-step verification for the admin panel (password, staff code, one-time code), stores passwords irreversibly, encrypts sensitive fields, keeps files in private storage and takes regular backups.

No information system is absolutely secure. Having taken reasonable, industry-standard measures, the Company is not liable for damage caused by unauthorised access, cyber attacks, failures of infrastructure or service providers, data loss or outages. Where the law requires notification, the Company notifies the competent authority and the people concerned.

You may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, ask for correction or deletion, learn to whom it was transferred, object to automated analysis with an adverse result, and claim compensation for damage.

You may withdraw your explicit consent at any time. Some deletion requests may be limited by statutory retention duties; you will be told the reason.

Send your request to info@edurouta.com with your name, contact details and what you are asking for. We answer within 30 days free of charge. If you are not satisfied, you may complain to the Personal Data Protection Authority.