1. Data Controller
Under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is:
- Name: Levent Altay
- Email: info@leventaltay.com
- Website: leventaltay.com
In this notice, "the site," "the website," or "the service" refer to the online processes connected to AP Computer Science, AP Computer Science Principles, AP Cybersecurity, and Java/algorithms tutoring, the level check, and the contact forms.
2. Personal Data Processed
Depending on the forms and tests used on the website, the following categories of personal data may be processed:
| Data Category | Example Data | Source |
|---|---|---|
| Identity and contact information | Full name, email address, phone/WhatsApp number | Contact form or level-check start form |
| Education and inquiry information | Course of interest, grade level, goal, short message content | Forms filled out by the user |
| Level check information | Test answers, number of correct answers, estimated academic score, timing information | Level check page |
| Financial aid request information | Support preference, reason for the request, and a short description written by the user | The financial-aid field in the contact form |
| Technical and security logs | Hashed version of the IP address, user agent, submission time, spam/rate-limit records | Server logs and Cloud Function security checks |
| Behavioral test signals | Copy, paste, tab switching, focus loss, and similar exam-integrity signals | Signals generated by the browser during the level check |
The website does not request special-category personal data. Users are advised not to enter health, religious belief, political opinion, biometric data, or similar special-category information into any form. When submitting a financial-aid request, users are advised to include only the limited information necessary and that they wish to share for evaluation.
3. Purposes of Processing Personal Data
Personal data may be processed for the following purposes:
- Receiving and responding to contact requests,
- Providing information about AP CSA, AP CSP, AP Cybersecurity, or Java/algorithms lessons,
- Generally assessing the student's current level and lesson needs,
- Using level-check results to plan lessons and build a suitable study program for the student,
- Conducting an initial review of financial-aid requests and determining a suitable support option,
- Maintaining form security and preventing spam and misuse,
- Checking the accuracy, reliability, and processing history of records when needed,
- Fulfilling legal obligations and protecting rights in the event of a potential dispute.
4. Legal Grounds for Processing Personal Data
Depending on the specific process, personal data may be processed based on the following legal grounds under Article 5 of Law No. 6698:
- Being directly related to the establishment or performance of a contract,
- Being mandatory for the data controller's legitimate interests,
- Being mandatory for the establishment, exercise, or protection of a right,
- The explicit consent of the data subject, where required.
5. Method of Collecting Personal Data
Personal data may be collected electronically through the website's contact form, level-check form, email, phone/WhatsApp communication, and security-related server logs.
Form submissions go through server-side checks via a Cloud Function rather than being written directly to the database. Basic validation, spam prevention, and rate-limit checks may be applied during this process.
6. Transfer of Personal Data
As a rule, personal data is not sold or shared with third parties for marketing purposes. However, the infrastructure of the following service providers may be used for the technical operation of the service:
- Firebase / Google Cloud infrastructure,
- Web hosting and server logging systems,
- Email and communication services,
- Where necessary, authorized public authorities under legal obligations.
These service providers may be used to operate the website, receive form submissions, perform security checks, and carry out the communication process.
7. Retention Period
Personal data is retained for as long as the processing purpose requires. The general principles are as follows:
- Contact form records: for the duration of evaluating the request and a reasonable follow-up period,
- Level-check records: for as long as necessary to plan lessons and track the student's progress,
- Security and rate-limit records: for the short period necessary for spam and misuse control,
- Records with a potential legal dispute: for the statute-of-limitations periods set out in applicable law.
Once the retention purpose has ended, personal data may be deleted, destroyed, or anonymized.
8. Data Security
Reasonable technical and administrative measures are applied to protect personal data against unauthorized access, loss, misuse, or unlawful processing.
- Form submissions are validated server-side,
- Rate limiting is applied against spam and excessive use,
- Technical information such as IP addresses may be kept in hashed rather than plain form,
- Database access is kept limited,
- An effort is made not to request personal data that isn't necessary.
9. Rights of the Data Subject
Under Article 11 of Law No. 6698, data subjects may exercise various rights regarding their personal data by applying to the data controller. These rights include learning whether personal data is being processed, requesting information if it has been processed, learning the purpose of processing, requesting correction if it has been processed incompletely or incorrectly, and requesting deletion or destruction where the conditions are met.
Requests regarding data subject rights can be made through the contact address below.
10. Requests and Contact
For requests under KVKK, you can get in touch through the following email address:
Your request should clearly state your full name, contact information, and what you are requesting. The subject of the request may require identity verification.
11. Cookies, Third-Party Services, and External Links
Technical logs may be generated on the website for basic operation, security, and performance purposes. The site may use third-party technical services for purposes such as fonts, hosting, form security, and data storage.
- Google Fonts may be used to load fonts.
- Firebase / Google Cloud may be used for hosting, Cloud Functions, and database operations.
- The site may contain links to third-party websites.
These third-party services may have their own privacy and security policies. Levent Altay is not responsible for the content or data-processing practices of links outside the website.