1. IDENTITY OF DATA CONTROLLER AND LEGAL CAPACITY
Pursuant to KVKK Article 10 and global privacy standards, Webicro Software Technologies Inc., located at Refahiye, 282. Sk. C-1A Blok No: 4, Haliliye / Sanliurfa, Turkiye, acts as the Data Controller regarding website visitor records, commercial contract administration, and demo inquiries.
With respect to the academic, biometric access, and attendance data of students, parents, and teachers processed within the licensed school tenant environment, the educational institution serves as the primary Data Controller, and Webicro Software serves strictly as the technical Data Processor.
2. PROCESSED DATA CATEGORIES
- Identity Data: Full name, national identity number, date of birth, student enrollment ID, classroom and branch assignments.
- Contact Data: Verified telephone numbers, institutional and personal email addresses, notification addresses.
- Academic & Performance Data: Optical exam grading records, academic scores, coaching consultation logs, study room assignments, and homework completion records.
- Gate & Attendance (PDKS) Data: Turnstile badge timestamps, RFID card identifiers, classroom attendance statuses, visitor entry logs.
- Financial Transactions: Canteen balance reloads, expense history, tuition installments (Credit card information is processed solely through PCI-DSS certified banking gateways and is never stored on our servers).
- Technical Log Data: IP addresses, access timestamps, cryptographic security audit trails.
3. PURPOSES AND LEGAL BASES OF PROCESSING
Personal data is processed pursuant to KVKK Articles 5 & 6 based on:
- Contractual Performance: Providing uninterrupted campus management services, real-time parent notifications, and student attendance reporting.
- Legal Obligations: Compliance with Ministry of National Education (MEB) regulations, educational auditing, and statutory log retention laws (Law No. 5651).
- Legitimate Interests: Enforcing campus physical security, preventing unauthorized access, and maintaining server resilience against cyber threats.
4. DATA SUBJECT RIGHTS
Under Article 11 of the KVKK (and GDPR Articles 15-22), data subjects have the right to obtain confirmation as to whether personal data concerning them is being processed, request rectification of inaccurate data, request deletion or erasure, and object to automated individual decision-making. Inquiries may be submitted to kvkk@webicro.com or kvkk@ceptekampus.net.