Privacy Policy and Information Notice

Under KVKK, your personal data is processed by the legal entity operating under the Ferrumone brand as data controller, as set out below.

When you use Ferrumone services, personal data in the following categories may be processed:

• Identity information: first name, last name, username.
• Contact information: email address, phone number, city/district.
• Customer transaction information: purchased package, order number, payment amount, billing details, discount/coupon codes.
• Payment information: your card details are not stored by Ferrumone. Payments are processed through the licensed payment provider PayTR; order number, amount and transaction status may be shared with PayTR for this purpose.
• Student profile information: grade level, study stream, preferred target field.
• Service usage information: lessons watched, tests completed, question history, pomodoro study records, favorites, interactions with Ferrum AI.
• Transaction security information: IP address, browser and device information, session records, login/logout times.
• Marketing information: cookie preferences, campaign interactions, email open/click status (where you have given explicit consent).

Your personal data is processed for the following purposes:

• Creating and managing membership/account on the Platform,
• Providing purchased education packages and enabling access to content,
• Running payment and billing processes and collecting payments through PayTR,
• Delivering a personalized learning experience (progress tracking, recommended topics, Ferrum AI responses),
• Communicating with you, handling support requests, and reviewing complaints and suggestions,
• Operating the referral/rewards program and tracking points and rewards earned,
• Ensuring Platform security and detecting unauthorized access or misuse,
• Carrying out statistical and anonymized analysis to improve products and services,
• Fulfilling legal obligations and responding to requests from authorized institutions,
• Where you have given explicit consent, informing you about campaigns, discounts and updates via electronic commercial communication.

Your personal data is processed on the following legal grounds under KVKK Articles 5/2 and 6/3:

• Being directly related to the establishment or performance of a contract (Art. 5/2-c) — e.g. package purchase, account creation,
• Being necessary for compliance with a legal obligation to which the data controller is subject (Art. 5/2-ç) — e.g. invoicing, statutory record keeping,
• Being necessary for the establishment, exercise or protection of a right (Art. 5/2-e),
• Being necessary for the legitimate interests of the data controller, provided that fundamental rights and freedoms are not harmed (Art. 5/2-f) — e.g. fraud prevention, service quality improvement,
• Explicit consent (Art. 5/1, Art. 6/2) — e.g. marketing emails, optional cookie categories.

Your personal data may be transferred to the following parties, limited to the purposes above:

• Payment institutions: licensed payment service providers such as PayTR (to complete payment transactions).
• Cloud & infrastructure providers: suppliers providing hosting, database, email, analytics and authentication services.
• Legal advisers and auditors: for exercising the right of defense and compliance processes.
• Authorized public institutions: where required by applicable legislation upon request.

Because some cloud/analytics services are provided abroad, your personal data may be transferred internationally. Such transfers are carried out in compliance with KVKK Article 9 and relevant Board decisions.

Your personal data is collected fully or partially through automated means via forms you complete on the Platform, account registration/login, purchase flows, written/electronic communication with us, support requests, browser cookies and similar technologies.

Your personal data is retained for periods required by applicable law and for as long as reasonably necessary for the processing purpose. These periods include in particular:

• Membership and account data: while your account is active, and for up to 10 years after deletion where required by contractual obligations and statutory limitation periods,
• Billing and commercial records: at least 10 years under Turkish Tax Procedure Law and Turkish Commercial Code,
• Log records: at least 2 years under Law No. 5658,
• Data processed for marketing: until you withdraw your explicit consent.

As Ferrumone, we implement administrative and technical measures required under KVKK and related legislation to protect your personal data. These include encryption, access controls, firewalls, regular backups and confidentiality obligations for our staff to prevent unauthorized access. Payment information is not stored on Ferrumone servers; card data is transmitted only to PayTR's PCI-DSS compliant infrastructure.

Ferrumone is an education platform aimed at students preparing for university entrance exams; therefore some users may be under 18. Use of the Platform and processing of personal data by users under 18 is based on the knowledge and consent of a parent or legal guardian. By registering a user under 18, the parent/legal guardian is deemed to have accepted the membership terms and this notice.

The Platform uses cookies to provide functionality, remember preferences, maintain security and measure performance. Cookies may be classified as strictly necessary session cookies, preference cookies and (with your explicit consent) analytics/marketing cookies. You can change or delete cookie preferences at any time in your browser settings. Some parts of the Platform may not work properly if strictly necessary cookies are disabled.

You may exercise the following rights under KVKK Article 11 by contacting Ferrumone as data controller:

• To learn whether your personal data is being processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether data is used accordingly,
• To know third parties to whom data is transferred domestically or abroad,
• To request correction if data is incomplete or inaccurate,
• To request deletion or destruction under the conditions set out in KVKK Article 7,
• To request notification of correction/deletion/destruction to third parties to whom data was transferred,
• To object to a result against you arising solely from automated analysis,
• To request compensation for damage arising from unlawful processing.

To exercise your rights, you may email info@ferrumone.com or apply in writing to the postal address above. Your request must clearly state what you are asking for together with information identifying you. Requests are handled free of charge within 30 days in accordance with the Communiqué on Application Procedures and Principles to the Data Controller; however, if the process requires additional cost, a fee under the tariff determined by the Personal Data Protection Board may be charged.

Ferrumone may update this Privacy Policy and Information Notice from time to time in line with changes in legislation or operations. The current version is always available on this page. We may also notify you of material changes by email or Platform notification.