PRIVACY POLICY

At Delights of Turkish, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our platform, in compliance with the GDPR (General Data Protection Regulation) and KVKK (Turkish Personal Data Protection Law No. 6698).

Minors: Our Services are exclusively available to individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a minor has provided us with personal data, we will delete it immediately.

We collect the following categories of personal data, each with a defined legal basis under GDPR Article 6:

• •
  Identity Data: Full name, email address, and profile picture (if provided).
  Legal basis: Performance of a contract (Art. 6(1)(b)) — necessary to create and manage your account.
• •
  Marketing Data (Optional): Your email address for promotional newsletters and offers.
  Legal basis: Consent (Art. 6(1)(a)) — only processed if you do not opt out. You may unsubscribe at any time.
• •
  Educational Data: Learning progress, quiz results, credit balance, and lesson history.
  Legal basis: Performance of a contract (Art. 6(1)(b)) — necessary to deliver the tutoring services you have purchased.
• •
  Technical Data: IP address, browser type, and device information (collected automatically via our infrastructure providers).
  Legal basis: Legitimate interests (Art. 6(1)(f)) — to maintain platform security, prevent fraud, and ensure service stability.
• •
  Audio/Video Data: Real-time video and audio streams during lessons (processed via Daily.co).
  Legal basis: Performance of a contract (Art. 6(1)(b)) — necessary to conduct live lessons.
• •
  Session Recordings (if opted in): Recorded audio/video of lessons stored in Supabase Storage.
  Legal basis: Consent (Art. 6(1)(a)) — only processed when you explicitly opt in via your account settings. You may withdraw this consent at any time.

To provide our Services, we share necessary data with the following trusted third-party processors. As these providers are headquartered outside the European Economic Area (EEA), international data transfers occur. Each provider maintains adequate safeguards, including Standard Contractual Clauses (SCCs) or equivalent mechanisms, as required by GDPR Chapter V.

Lessons are only recorded if you explicitly opt in via your account settings ("Record My Lessons"). Recorded files are stored securely using Supabase Storage.

• Access: Recordings are accessible only by you (for personal study) and the tutor (for quality assurance and dispute resolution purposes).
• Retention: Session recordings are retained for 12 months from the date of the lesson, after which they are permanently deleted. You may request earlier deletion at any time by contacting us.
• Restrictions: Recordings are never sold to third parties or used for marketing without your explicit written consent.

Retention: We retain your personal data only for as long as your account is active or as needed to provide the Services. Different data types are retained as follows:

• Account & educational data: Retained for the duration of your active account.
• Session recordings: Retained for 12 months from the date of the lesson (see Section 5).
• Tax & payment records: Retained for the period required by applicable law (typically 5–10 years), managed by Paddle.

Account Deletion: If you request account deletion, your personal data will be permanently erased or anonymized within 30 days, except for data we are legally required to retain (e.g., tax records held by Paddle).

Security: We implement industry-standard security measures including SSL/TLS encryption for data in transit and encryption at rest via Supabase's infrastructure.

Data Breach: In the event of a personal data breach, we will notify you and the relevant supervisory authority within 72 hours via email, as required by law.

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to Restriction: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., session recordings), you may withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact us at support@delightsofturkish.com. We will respond within 30 days. If you believe your rights have not been respected, you have the right to lodge a complaint with your local supervisory authority.

If you are a Turkish citizen or resident, you have the following rights under KVKK (Law No. 6698):

• The right to learn whether your personal data is being processed.
• The right to request information about how your data is processed.
• The right to learn the purpose of processing and whether data is used in accordance with that purpose.
• The right to know the third parties to whom your data is transferred.
• The right to request correction of incomplete or inaccurate data.
• The right to request deletion or destruction of your data under applicable conditions.
• The right to object to outcomes against your interests arising from automated processing.
• The right to claim compensation for damages arising from unlawful processing.

How to Apply: Requests under KVKK must be submitted in writing to support@delightsofturkish.com. We will respond within 30 days as required by law. Requests are free of charge unless they require excessive effort, in which case a fee consistent with the tariff set by the Personal Data Protection Board (Kişisel Verileri Koruma Kurumu — KVKK) may apply.