Privacy Notice (KVKK) and Privacy Policy

1. Data controller

Your personal data is processed by Student Apply Eğitim Teknoloji Danışmanlık Ltd. Şti. ("TasselWay", "we") as the data controller.

Address: Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34, Esenler / İstanbul, Türkiye · Email: info@tasselway.com · Phone: +90 539 623 22 20

2. Personal data we process

We do not ask for special categories of personal data such as health, religion or ethnic origin; please do not include such information in the documents you upload.

• Identity: first name, last name, date of birth, nationality, passport number and passport copy.
• Contact: email address, phone / WhatsApp number; for agencies, company name, contact person, country, city and website.
• Education: diploma, transcript, grade, language certificates, preferred country, university, program and intake.
• Image: the ID photo uploaded for the application.
• Application process: application number, status and history, university application number, admission and enrolment details, notes and correspondence.
• Financial (agencies): service fees, commissions, payment and invoice records.
• Transaction security: session data, login records, IP address and server logs.

3. Purposes of processing

• Receiving and assessing university applications made individually or through an agency, and forwarding them to the chosen university,
• Carrying out admission, visa, language preparation and enrolment processes and communicating with you,
• Informing you of your application status via the tracking page and email,
• Sending information and reminder e-mails about missing payments and documents so that your application can be completed,
• Contacting you by phone, WhatsApp or email when you request a consultation,
• Assessing partnership applications, establishing and managing relationships with agencies, and handling service fees, commissions and invoices,
• Ensuring information security, preventing misuse, meeting legal obligations and protecting rights in possible disputes.

4. Legal grounds

Your personal data is processed by automated means (web forms and our management system) on the following legal grounds under KVKK Article 5(2):

• Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): receiving your application and forwarding it to the university; our relationship with agencies.
• Compliance with our legal obligations (Art. 5(2)(ç)): obligations under commercial, tax and accounting law.
• Establishment, exercise or protection of a right (Art. 5(2)(e)).
• Our legitimate interests, provided they do not harm your fundamental rights and freedoms (Art. 5(2)(f)): information security and service quality.

5. Transfer of personal data

Your personal data is transferred only for the purposes above and only to the extent necessary, to:

• The universities you apply to: universities in Türkiye and universities in the People's Republic of China (abroad).
• The partner agency that referred you or applied on your behalf (only data of its own students).
• Our service providers: web hosting (Vercel Inc., USA), database (Neon, data centres in the European Union), file storage (Cloudflare R2) and email delivery service.
• Bot protection: Cloudflare Turnstile (Cloudflare, Inc., USA), which processes browser and IP information to prevent automated form submissions.
• Competent public authorities and courts, upon request.

6. Transfers abroad

Transfer to the university abroad that you apply to is necessary to make the application you chose, and is carried out occasionally under KVKK Article 9(6) for the performance of the service relationship between you and us.

Transfers to our service providers abroad are made with appropriate safeguards under KVKK Article 9(4) (standard contracts announced by the Personal Data Protection Board).

The legal system of recipients abroad may not provide the same level of protection as in Türkiye; please contact us if you have any questions about this.

7. How we collect data

Your personal data is collected electronically through the individual application, tracking and partnership forms on our website; information entered by partner agencies into the agency portal; and email and phone correspondence.

When an agency applies on your behalf, the agency is responsible for providing you with this notice and for having a valid legal basis to share your data.

Applications can also be made through the chat assistant on our website. Questions and answers in the chat are not sent to our servers or stored; only the information you give in the application steps and the documents you upload are processed, in the same way as in the application form. When you upload a passport photo, the machine-readable zone is read only in your browser to fill in your details automatically; the image is not sent to any third party for this.

8. Retention and security

Your personal data is kept for as long as required by the purpose of processing and the limitation and retention periods set by law; afterwards it is deleted, destroyed or anonymised.

Your documents are stored in non-public storage accessed over encrypted connections; only our authorised staff and the relevant agency can see them. Access is logged.

9. Cookies

Without your consent, we only use cookies that are strictly necessary for the service: a cookie that remembers your language and a session cookie for agency / admin login. Your choice to pause animations is stored in your browser.

Advertising and marketing cookies are used only with your explicit consent. If you consent, the Google tag (Google Ads and Google Tag Manager; Google Ireland Limited and Google LLC) is loaded to measure how our ads perform; cookie identifiers, your IP address and visit information are transferred to Google and may be processed abroad. If you do not consent, this tag is not loaded. You can change your choice at any time through the "Cookie preferences" link at the bottom of the site.

A tracking cookie valid for 2 hours lets you access your application on the tracking page and in the chat assistant. An unfinished chat is kept only in your browser's session storage so you can continue in the same tab, and is deleted when the tab is closed.

10. Your rights (KVKK Article 11)

By applying to the data controller, you may:

• learn whether your personal data is processed and request information about it,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of KVKK Article 7,
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
• object to a result against you arising exclusively from automated analysis,
• claim compensation if you suffer damage due to unlawful processing.

11. How to apply

You can send your requests, with information verifying your identity and in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, by email to info@tasselway.com or in writing to Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34, Esenler / İstanbul, Türkiye.

Your request will be concluded free of charge within 30 days at the latest, depending on its nature. If an additional cost arises, the fee set by the Board may apply.

12. Site statistics and unfinished applications

To understand how our website is used, we keep anonymous visit statistics without cookies: the page viewed, site language, device type (phone/tablet/computer), the source of the visit (e.g. a search engine or social media link) and country. Visits are grouped by a random identifier specific to the browser tab, which is deleted when the tab is closed. IP addresses and browser details are not stored in these records; they do not identify you and are deleted after 180 days. If "Do Not Track" is enabled in your browser, nothing is recorded.

If you enter your email address or phone number in the application form or the chat assistant but do not submit the application, the name, contact details, nationality and selected programme/intake you entered are saved as an "unfinished application" (passport details, date of birth and documents are not saved). This is processed on the basis of our legitimate interest (KVKK Art. 5/2-f) to help you complete your application: a single reminder email may be sent after one day and our team may contact you. The record is deleted after 90 days; you can ask for it to be deleted at any time by writing to info@tasselway.com.

If you enter your email address for a "notify me / remind me" option on the application calendar, your address, the university you chose and the site language are processed at your request only to email you once when that university's applications open or its deadline approaches, and to help with your application if needed. The record is deleted 30 days after the email is sent, or after 400 days at the latest if it is not sent; you can ask for deletion at any time.