Skip links
Okulyo

Privacy Policy

We embrace holistic development within our sectors.

PERSONAL DATA PROCESSING AND PRIVACY POLICY

1. Collection and Use of Location Data

1.1 Types of Data Collected

To provide its services, the OKULYO application collects the following location data:

Precise Location (precise/fine location): Latitude and longitude information obtained via the device’s GPS sensor.

Approximate Location (approximate/coarse location): Approximate location information obtained via Wi-Fi access points and base stations.

Background Location Data: Location information collected periodically from the device even when the application is not open in the foreg

1.2 Android Permissions Used

Our application utilizes the following Android permissions:

  • ACCESS_FINE_LOCATION – Precise location access.

  • ACCESS_COARSE_LOCATION – Approximate location access.

  • ACCESS_BACKGROUND_LOCATION – Background location access.

1.3 Purpose of Use

Location data is collected and processed solely for the following purposes:

Student Location Tracking: To allow parents to view the real-time locations of their students during school shuttle routes and school hours.

Shuttle Route Tracking: To verify that school shuttle vehicles are following the designated routes.

Security Notifications: To send notifications to parents if a student leaves designated areas (school, home, route

Why background location access is necessary: Location data must be collected even when the application is running in the background to ensure uninterrupted safety monitoring for students. If location data is not collected while the app is closed or in the background, shuttle route tracking and security notifications cannot function.

1.4 Data Retention Period

  • Real-time location data is not stored on the device after transmission.

  • Location history data stored on servers is kept for 1 year and then automatically deleted.

  • Users may request the earlier deletion of location history.

1.5 Third-Party Sharing

Collected location data is not shared, sold, or rented to any third party except in the following cases:

  • Formal requests from legal authorities.

  • Business partners necessary for the performance of the service (payment infrastructures, school administrations).

  • Explicit consent of the user.

Location data is under no circumstances used for advertising, marketing, or profiling purposes, nor is it shared with third-party advertising networks.

2. User Rights and Controls

  • Users can withdraw location permissions at any time through device settings; however, this will disable location-based features.

  • Users may request the deletion of their personal data (including location history) via destek@okulyo.com.

  • Users have the right to request a copy of their personal data

3. Data Security

Collected location data is protected by TLS/SSL encryption during transmission and is stored encrypted on servers. Industry-standard security measures are implemented to prevent unauthorized access.

 

CLARIFICATION TEXT ON THE PROTECTION, STORAGE, PROCESSING, AND DELETION OF PERSONAL DATA (CONSENT FORM)

With this consent form regarding the protection, storage, processing, and deletion of Personal Data, I hereby declare that I consent to the processing, protection, storage, deletion, and anonymization of the personal data of the student for whom I am the legal guardian at the school/institution they attend, which I have provided of my own free will to the Okulyo mobile application and web system.

This consent covers the use of the “Student Attendance Control System Mobile Application (OKULYO)” with Turnstile or Non-Turnstile Security and SMS Notification Systems to:

  • Minimize security vulnerabilities and prevent unauthorized entry/exit to the institution.

  • Increase institutional security by controlling student, staff, parent, and visitor entries and exits.

  • Provide SMS notifications regarding specific student situations, particularly sending lesson-by-lesson attendance results taken by teachers via the mobile application to the parent.

  • Enable the use of services provided by “Okulyo Products” (cards with payment infrastructure capabilities used in areas such as canteens, cafeterias, and school entrances) delivered by Okulyo to school administrations, and to perform the operations defined in the scope below.

1. Within the scope of this consent form:

(a) “Personal Data”: Refers to any information relating to an identified or identifiable natural person.

(b) “Processing of Personal Data”: Refers to any operation performed on data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, whether fully or partially by automated means or non-automated means provided that it is part of a data recording system

Furthermore, in accordance with the KVKK Law No. 6698 and in the capacity of Data Controller, within the framework explained:

  • Your personal data will be recorded, stored, updated, disclosed to third parties where permitted by legislation, transferred, classified, and processed in the manners specified in the KVKK.

  • Your personal data shared under Law No. 6698 may be processed by us—either fully or partially, automatically or non-automatically—as part of any data recording system, by being subject to any kind of processing.

  • Any operation performed on data within the scope of KVKK is considered “processing of personal data.”

In order to fulfill the requirements of the services provided to our parents in accordance with the contract and technology, and to improve our products and services:

  • To record identity, address, and other necessary information to identify the transaction owner within the scope of Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on the Protection of Consumers, and related regulations including the Regulation on Service Providers and Shared Service Providers in Electronic Commerce (Official Gazette 26.08.2015, No. 29457) and the Distance Contracts Regulation (Official Gazette 27.11.2014, No. 29188).

  • To organize all records and documents that will be the basis for transactions in electronic or paper environments, including mandatory payment systems in the field of Banking and Electronic Payments.

  • To comply with information storage, reporting, and disclosure obligations as required by legislation and other authorities.

  • To provide information to prosecutor’s offices, courts, and relevant public officials upon request and as required by legislation regarding matters of public safety and legal disputes.

  • Data will be processed in accordance with KVKK Law No. 6698 and related secondary regulations.

Information on Third Parties or Organizations to Whom Personal Data May Be Transferred:

For the purposes stated above, the third parties/organizations to whom your personal data shared with our Company may be transferred include:

  • Suppliers, cargo companies, and other individuals and organizations related to the services provided.

  • Program partner organizations, domestic/international organizations, and other third parties from whom services are received or with whom cooperation is established to carry out our activities and/or in the capacity of Data Processor.

(c) Methods of Collecting Personal Data:

Your personal data is processed and collected through:

  • Forms on our company’s website and mobile applications (Name, surname, T.R. Identity number, address, mobile phone, work or private e-mail address).

  • Preferences on pages logged into with username and password, IP records of transactions, cookie data collected by the browser, navigation duration and details, student location data, student photos, and displaying student educational grades in the application profile by obtaining them via E-Okul.

  • Answers received from AI applications for questions asked by the user via the application.

  • Verbally, in writing, or electronically through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers.

  • Physical or virtual environments, face-to-face or remotely, from persons who share their personal data via business cards, CVs, or bids for purposes such as establishing a commercial relationship or job applications.

  • Indirectly through different channels such as (micro) websites used for blogs, contests, surveys, games, campaigns, etc., social media platforms, e-bulletin reading or clicking movements, data from public databases, and publicly shared profiles/data on social media.

Personal Data Obtained Before KVKK: Personal data obtained lawfully before the effective date of KVKK (April 7, 2016) via membership, electronic communication permission, or product/service purchases are also processed and preserved in accordance with the terms and conditions regulated in this document.

(d) Transfer of Personal Data Abroad:

Your personal data collected through any of the methods listed above—whether processed in Turkey or processed and stored outside of Turkey—may be transferred to service intermediaries located abroad (in countries accredited by the Personal Data Protection Board where there is adequate protection), provided they remain within the scope of KVKK and are in accordance with the contract purposes.

(e) Storage and Protection of Personal Data:

  • Your personal data will be stored confidentially in the database and systems of our Company in accordance with Article 12 of the KVKK.

  • It will not be shared with third parties except for legal obligations and the regulations specified in this document.

  • Our Company is obliged to take software measures such as access management and physical security measures to prevent unlawful processing of personal data and unauthorized access in accordance with Article 12 of the KVKK.

  • If it is learned that personal data has been obtained by others through illegal means, the situation will be immediately reported to the Personal Data Protection Board in writing and in accordance with legal regulations.

(f) Keeping Personal Data Accurate and Up-to-Date:

In accordance with Article 4 of the KVKK, our Company is obliged to keep your personal data accurate and up-to-date. In this context, to enable our Company to fulfill its obligations arising from current legislation, our parents must share accurate and up-to-date data or update it via the website/mobile application.

Definitions:

(g) Explicit Consent: Refers to consent regarding a specific subject, based on being informed and expressed with free will.

(h) Anonymization: Refers to making personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.

(i) Deletion and Destruction of Personal Data: Refers to the deletion or destruction of personal data by the data controller upon the request of the data subject when the reasons requiring the processing of data—which were processed in accordance with Law No. 6698 and other relevant laws—no longer exis

Rights of the Parent: By applying to the data controller, the student’s parent has the right to:

  • Learn whether personal data is being processed.

  • Request information if personal data has been processed.

  • Learn the purpose of processing and whether it is used in accordance with its purpose.

  • Request correction of incomplete or incorrectly processed data.

  • Request the deletion or destruction of personal data within the framework of Article 7 of Law No. 6698.

  • Object to an outcome against the person by analyzing the processed data exclusively through automated systems.

  • Claim compensation if damage is incurred due to unlawful processing.

  • Know the third parties to whom personal data is transferred domestically or abroad.

Additional Provisions:

(j) Software and Card Access Systems: In addition to the software and card access systems provided under this consent, the cards used as part of the system can also be used as cards carrying payment infrastructure (prepaid or debit cards).

(k) Personalization and Distribution: Following the receipt of consent and card preferences, the Okulyo system personalizes the cards with the student’s name, class, and other information. The School Administration (Institution) performs the distribution and delivery of these cards.

(l) Promotion and Advertisements: Refers to Okulyo’s ability to conduct promotional activities carrying useful content via the internet application (“Okulyo Products”) integrated with the payment-enabled cards distributed by the institution