1. Data Controller
On the platform, the data controller of the personal data of students, parents and staff is the school where the user is registered. EduOne OS is the data processor that hosts and processes the data on behalf of the school. Therefore, KVKK requests are directed first to the registered school.
2. Personal Data Processed
- Identity/Contact: full name, e-mail, phone.
- Education: class, number, absences, grades, homework, development observation.
- Special category data: health/allergy information (only for kindergarten safety, under explicit consent/school policy).
- Visual: kindergarten class activity photos (subject to school policy).
- Finance: payment status (card information is not processed).
- Transaction security: check-in/out records, audit logs.
3. Processing Purposes
Personal data is processed for the purposes of carrying out educational activities, informing parents, ensuring school safety (secure check-in/out and handover), scholarship processes and financial tracking.
4. Legal Grounds
- Being necessary for the establishment/performance of a contract.
- The data controller (school) fulfilling its legal obligation.
- Legitimate interest (school safety) — to the extent that it does not harm fundamental rights and freedoms.
- Explicit consent for special category data (health) or cases foreseen in the relevant legislation.
5. Transfer
Personal data is not shared or sold with third parties other than the secure cloud infrastructure (hosting) used to provide the service. Where a transfer abroad is involved, the safeguards required by the KVKK are provided.
6. Rights of the Data Subject (KVKK Art. 11)
Every data subject has the right to learn whether their personal data is being processed, to request its correction/deletion, to object to the processing and to demand compensation for damage. Requests can be directed to the registered school, and for technical matters to destek@eduoneos.com.
7. Security Measures
Role-based access, tenant isolation, server-side security rules, encrypted communication and audit logs are applied. Special category data is limited to authorized staff and the relevant parent only. Details: Data Processing.