Privacy Notice (KVKK)
This English text is for information only. In case of discrepancy, the Turkish version prevails.
Pursuant to the Personal Data Protection Law (KVKK) No. 6698, we, as data controller gerekli.tr, wish to inform you about the processing of your personal data.
1. Data Controller
Data Controller: gerekli.tr
Contact: destek@gerekli.tr
gerekli.tr is an independent platform currently offered as a free student helper tool, providing academic planning and course schedule creation for Hacettepe University students. It is not operated, endorsed, or supported by Hacettepe University or any official institution. Official academic processes must be verified through the university's authorized systems.
2. Personal Data Processed
The following personal data may be processed:
- Identity and contact data: Full name, email address
- Account data: User identifier (UUID), session information, registration date
- Academic profile data (optional): Department; optional, unverified Hacettepe institutional email (@hacettepe.edu.tr) stored for possible future university-specific features (currently grants no access or privileges)
- Planning data: Course schedules, GPA calculations, attendance records, locked semester data
- Share link data: Course schedule content when the sharing feature is used (sign-in not required)
- Consent and acknowledgement records: Record that the KVKK notice was shown/read, terms of use acceptance time, cookie preferences
- Technical data: IP address, browser type, device information, session cookies, server error logs (for authentication and service security)
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Creating user accounts and authentication
- Providing course schedule planning, GPA calculation, and attendance tracking services
- Cloud synchronization of your data across devices
- Creating and serving course schedule share links
- Personalizing user profiles (department-based content delivery)
- Service security, server error detection, and continuity
- Fulfilling legal obligations
- Product analytics and performance measurement (only with cookie preference)
4. Legal Bases for Processing Personal Data
Your personal data is processed on the following legal bases specified in Article 5 of the Personal Data Protection Law (KVKK) No. 6698:
- Explicit consent (Art. 5/1): Optional analytics, performance measurement, session recording, and non-essential cookies via separate choices in the cookie preference banner
- Performance of a contract/service (Art. 5/2-c): Account creation, authentication, schedule planning, GPA and attendance tracking, cloud sync, share links, and delivery of core services
- Legitimate interest (Art. 5/2-f): Service security, abuse prevention, server-side error logs (Sentry), and service reliability
- Legal obligation (Art. 5/2-ç): Keeping request/consent records and responding to lawful requests
Recording that the KVKK notice was shown and read during profile completion is an acknowledgement record, not explicit consent for all processing.
5. Transfer of Personal Data
Your personal data may be transferred to the following third parties to the extent necessary to provide the service:
- Supabase (determined by project configuration): Database, authentication, and cloud synchronization
- Google OAuth (USA): Optional Google sign-in — email, name, and profile photo
- PostHog (EU): Product analytics with your consent; session recording, if enabled, is sampled only (
eu.i.posthog.com) - Sentry: Server error logs (Germany / DE, legitimate interest); client error reporting (DE, with performance preference)
- Vercel: Website hosting, secure delivery, and service availability
- Vercel Analytics / Speed Insights: Traffic and performance measurement only where the relevant analytics/performance preference allows it
Under no circumstances is your data sold or rented to advertising networks, data brokers, or third parties for marketing purposes.
6. Cross-Border Data Transfer (KVKK Art. 9)
Because some service providers use infrastructure located outside Türkiye, your personal data may be transferred abroad. Such transfers are handled under the applicable mechanisms of Article 9 of the Turkish Data Protection Law, relevant service provider agreements, and explicit consent where required.
| Recipient | Region | General basis |
|---|---|---|
| Supabase | determined by project configuration | Service infrastructure; applicable Art. 9 mechanisms and provider agreements |
| Vercel (hosting) | USA | Service infrastructure; applicable Art. 9 mechanisms and provider agreements |
| Google OAuth | USA | Performance of contract (Art. 5/2-c); applicable Art. 9 mechanisms |
| PostHog | EU | Explicit consent (analytics preference); applicable Art. 9 mechanisms |
| Sentry (server) | Germany (DE) | Legitimate interest (Art. 5/2-f); applicable Art. 9 mechanisms |
| Sentry (client) | Germany (DE) | Explicit consent (performance preference); applicable Art. 9 mechanisms |
| Vercel Analytics / Speed Insights | USA | Explicit consent (relevant cookie preference); applicable Art. 9 mechanisms |
7. Retention Periods for Personal Data
- Account data: While your account is active; permanently deleted within 30 days of a deletion request
- Planning and attendance data: Until account deletion or manual clearing by the user; when cloud sync is enabled, GPA calculator rows are kept in the same scope
- Share links: academic term end + 60 days (180 days after creation when academic calendar data is unavailable)
- Browser local storage (localStorage): Only on your device; not automatically sent to servers except via cloud synchronization
- Consent records: At least 10 years with a pseudonymous reference for legal proof
- PostHog data: Up to 90 days
- Sentry error records: Up to 90 days
When account or cloud data is deleted, course plan, semester/attendance, and GPA cloud data are removed. Consent audit records may be retained for a limited period after removing the direct user id, keeping a pseudonymous reference, document version, and timestamp. These records are not anonymous; they are pseudonymous records kept for legal proof.
Withdrawal of analytics consent applies going forward. Anonymous aggregate outputs that already passed small-group thresholds before withdrawal may remain because they cannot be separated back into individual contributions.
8. Data Subject Rights (KVKK Art. 11)
Under Article 11 of the Personal Data Protection Law (KVKK) No. 6698, you have the following rights:
- To learn whether your personal data is being processed
- To request information if it has been processed
- To learn the purpose of processing and whether it is used in accordance with that purpose
- To know the third parties to whom data is transferred domestically or abroad
- To request rectification if processed incompletely or inaccurately
- To request erasure or destruction under KVKK Art. 7
- To request notification of rectification and erasure to third parties to whom data was transferred
- To object to a result against you arising solely from automated analysis of processed data
- To claim compensation for damages arising from unlawful processing
To exercise your rights, you may apply to destek@gerekli.tr or follow the instructions on our Data Subject Application (KVKK) page. Applications are concluded within 30 days at the latest.
9. Special Notice on Analytics Tools
The following tools are loaded on the client side only when you grant the relevant preference in the cookie banner:
- PostHog (analytics category): Page views and page leave; with consent, session recording may be enabled at approximately 10% sampling. Masking of sensitive fields is not guaranteed.
- Vercel Analytics (analytics category): Traffic and page view measurement
- Sentry (performance category): Client JavaScript errors; session recording disabled; limited performance trace sampling may apply
- Vercel Speed Insights (performance category): Core Web Vitals and page load performance
Server-side Sentry error logs are processed under legitimate interest independently of cookie consent; session recording is disabled.
You can change your preferences via the Cookie Preferences link in the page footer. For details, see our Cookie Policy.
10. Profiling and Automated Decision-Making
gerekli.tr does not perform profiling or automated decision-making that produces legal or similarly significant effects against you by analyzing your personal data exclusively through automated systems.