This document is a draft and is not yet in effect. The final version will be published at this address before sales open.
This is an English translation provided for convenience. If you are a consumer in Turkey, the Turkish version prevails.
This notice explains how your personal data is processed when you use heysengo Hey Click and buy a course. It is prepared under art. 10 of Personal Data Protection Law No. 6698 ("KVKK").
1. Data controller
Heysengo, address Çağla Group Plaza, Mithatpaşa Cd. No:116 Kat 2, 34760 Ümraniye/İstanbul, email kvkk@heysengo.com. Referred to in this notice as "heysengo".
2. What data we process and for what purpose
| Data | Example | Purpose | Legal basis (KVKK art. 5(2)) |
|---|---|---|---|
| Identity and contact | Name, surname, email | Opening an account, setting up the order, sending access and notification emails | (c) formation and performance of a contract |
| Invoice | Full name, address, Turkish ID number if you choose to give it, country | Issuing invoices, keeping tax records | (ç) legal obligation, (c) contract |
| Order and payment | Order number, amount, currency, payment method, the payment institution's transaction number | Matching the payment, opening access, making refunds | (c) contract, (ç) legal obligation |
| Confirmation records | Name and version of the text you confirmed, time of confirmation | Proving the pre-contract information and the confirmations | (ç) legal obligation, (e) establishment and protection of a right |
| Usage and learning | Lessons you opened, progress, prompt library searches | Providing access, showing your progress, measuring the refund condition | (c) contract, (f) legitimate interest |
| Security and transaction logs | IP address, session information, browser information, error logs, reading rate counters | Preventing account sharing and abuse, fixing errors | (f) legitimate interest, (ç) legal obligation |
| Support | Messages you send us | Answering your question | (c) contract, (f) legitimate interest |
| Heysi Eğitmen conversations (if included in your package and you use it) | Questions you ask and the answers | Answering your lesson questions | (c) contract |
Commercial electronic messages. Campaign and announcement emails are sent only if you give a separate, optional consent. This consent is a separate box and is not a condition of purchase. You can withdraw your consent at any time.
The "Takıldım" tool. The "Takıldım" ("I'm stuck") help prompt tool runs entirely in your browser. It does not send what you write to our server; it masks values such as keys and IP addresses.
3. How do we collect data?
We collect data electronically in the following ways:
- From what you write in the registration, order and support forms.
- From the transaction logs created while you use the site.
- For card payments, from the payment result that Dodo Payments sends us.
If you choose "Sign in with Google", we also collect the name and email information that Google sends us.
4. Who do we transfer data to in Turkey?
- Financial advisers and accounting service providers. The purpose is invoicing and tax records.
- Authorized public institutions and organizations, and judicial authorities. Data is transferred if there is a legal obligation or a request.
5. Transfers abroad
Some of our service providers are abroad, so that we can provide the course. For this reason, your personal data is transferred abroad.
Our basis. We base these transfers on the standard contract safeguard in KVKK art. 9(4)(c). The standard contract is the text announced by the Personal Data Protection Board. It is signed with each recipient and notified to the Turkish Data Protection Authority within 5 business days after signature. In the country of transfer, you can also exercise your rights under KVKK and seek legal remedies (KVKK art. 9(4)).
| Recipient | Country | Role | Data transferred | Purpose | Safeguard |
|---|---|---|---|---|---|
| Appwrite (Appwrite Cloud) | USA, New York region | Data processor | Account, order, confirmation, progress and support records | Database, authentication and file hosting | Standard contract (KVKK art. 9(4)(c)) |
| Dodo Payments, Inc. and its group companies | USA and the other countries where Dodo processes data | Merchant of Record for card payments; independent data controller | Name, email, country, order number, product and amount | Opening the payment page, collection, invoicing, tax, refunds | Standard contract (KVKK art. 9(4)(c)) |
| Email delivery service (Resend) | USA | Data processor | Email address, name, email content | Access, order, verification and support emails | Standard contract (KVKK art. 9(4)(c)) |
| Error monitoring service (Sentry) | USA | Data processor | User ID, IP address, error logs | Detecting errors and abuse | Standard contract (KVKK art. 9(4)(c)) |
| AI provider (Heysi Eğitmen; if included in your package and you use it) | USA | Data processor | The questions you write to Heysi and the lesson context. Name, email and payment information are not sent. | Answering your questions | Standard contract (KVKK art. 9(4)(c)) |
Additionally, for payment through Dodo. You enter your card and payment details directly on Dodo's payment page. These details do not reach heysengo. Dodo processes them under its own privacy policy, as an independent data controller: https://dodopayments.com/legal/privacy-policy.
Your Google Cloud account is separate. In the course, you open a Google Cloud account in your own name. The information you enter in this account (identity, card, project, billing) is part of the relationship between you and Google. Google's own terms and privacy policy apply.
- heysengo does not access this account and does not transfer data to it.
- This is not a transfer abroad made by heysengo.
- The course explains how you run the setup commands yourself, in your own account.
- Do not send keys, passwords or card details to us or to Heysi during setup.
6. Retention period
We keep your data for the period required by the purpose of processing and for the retention periods in the applicable legislation:
- Account and access records are kept for as long as your account remains open.
- Invoice and accounting records and confirmation records are kept for the periods set in tax and commercial legislation and, for possible disputes, for the limitation period.
- Security and error logs are kept for as long as needed to fix errors and investigate misuse.
When the period ends, the data is deleted, destroyed or anonymized.
7. Your rights (KVKK art. 11)
By applying to heysengo, you can:
- (a) Learn whether your personal data is processed.
- (b) If it has been processed, request information about it.
- (c) Learn the purpose of processing and whether the data is used in line with that purpose.
- (ç) Know the third parties in Turkey or abroad to whom the data is transferred.
- (d) Request correction if the data is incomplete or processed incorrectly.
- (e) Request deletion or destruction under the conditions in KVKK art. 7.
- (f) Request that the actions under (d) and (e) be notified to the third parties to whom the data was transferred.
- (g) Object to a result against you that arises from analysis exclusively by automated systems.
- (ğ) Request compensation if you suffered damage because of unlawful processing.
8. Application
You can send your application in writing to kvkk@heysengo.com from the email address registered in your account. We conclude your application as soon as possible, depending on its nature, and free of charge within 30 days at the latest (KVKK art. 13(2)). If the action requires an additional cost, the fee in the Board's tariff may be charged.
If your application is rejected, if you find the answer insufficient, or if no answer is given in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning of our answer and in any case within 60 days of your application (KVKK art. 14(1)). You must apply to us before filing a complaint (art. 14(2)).