1. Data Processor–Data Controller Relationship
The school (institution) is the data controller, EduOne OS is the data processor. EduOne OS processes school data only to provide the service, in line with the school's instructions; it does not use it for its own purposes.
2. Tenant Isolation
- Each school's data is kept separately under
tenants/{schoolId}. - A user of one school cannot access another school's data; this is enforced by server-side security rules.
- Only the platform super administrator (for maintenance/support purposes) has cross access, and their operations are audited.
3. Role-Based Access
Access is restricted by roles such as General Manager, Principal, Vice Principal, Coordinator, Counselor, Teacher, Parent, Student. Each role accesses only the data appropriate to its duty. Privilege escalation (a user moving themselves to a higher role) is prevented by server rules.
4. Sensitive Data Protection
- Health/allergy, counseling, secure handover data is limited to authorized staff and the relevant parent only.
- Messages and notifications are read only by the relevant parties; they are closed to general access.
- Card/bank information is not kept in payment records; only status and amount information is processed.
- Photo uploads are stored with unpredictable secure links; they are not used for sensitive identity documents.
5. Transfer and Retention Security
- All data transfer is done over encrypted (HTTPS) channels.
- Administrative operations (role change, deletion, payment) are written to the audit log.
- Some operational logs (check-in/out) are automatically purged after a certain period.
- User deletion is done with a reversible backup (accident protection).
6. Data Ownership and Portability
The school is the owner of its data. Data export (backup) is possible from the management panel. At the end of the contract, school data can be exported and, upon request, securely disposed of.
7. Controller Obligations
The school must obtain the necessary disclosures and consents when collecting student/parent data, and apply its own policy when processing sensitive data (health, photos). EduOne OS provides the technical infrastructure and access controls for this.
8. Contact
For security assessment and data processing agreement (DPA) requests: destek@eduoneos.com. Related documents: Privacy, KVKK, Terms of Use.