KVKK Information Notice

Data controller and scope

This notice explains how personal data is processed when you visit UniverseHall, create an account, use learning and game features, take a level check, or submit a privacy request.

The commercial title, MERSİS/registration details and physical notification address of the data controller have not yet been finalized. These fields must be published here before commercial launch. Until then, privacy requests can be recorded securely through the form below.

Data categories

UniverseHall processes only the information needed for the relevant feature.

• Identity and contact: display name, username and email address.
• Account and security: password hash and salt, session records, password-reset records and sign-in security events. Plain-text passwords are not stored.
• Learning and assessment: answers, scores, progress, assigned modules, submissions and feedback.
• Usage and preference: interface language, consent choices, selected game character and room participation.
• Technical security: short-lived rate-limit identifiers and necessary browser preferences. Optional analytics are currently disabled.

Purposes and legal grounds

Data is processed to create and secure accounts, deliver lessons and assessments, calculate and send results, track learning progress, operate class/game rooms, answer requests, prevent abuse and meet legal obligations.

Depending on the operation, the legal grounds are establishment or performance of a contract, compliance with a legal obligation, establishment or protection of a right, and the controller’s legitimate interests without harming fundamental rights. Explicit consent is requested separately only where consent is the appropriate legal ground, such as optional marketing or non-essential analytics.

Collection method and recipients

Data is collected electronically through account and level-check forms, lesson interactions, security logs and privacy requests. It may be shared, only as necessary, with authorized UniverseHall operators; hosting, security and transactional email providers; professional advisers; and competent public authorities when legally required. Personal data is not sold.

If a service provider stores or accesses data outside Türkiye, the transfer will be activated only after an applicable Article 9 transfer mechanism and provider inventory are documented.

Retention and deletion

Level-check contact and result records are set to expire after 180 days. Security sign-in events are retained for 30 days; ordinary sessions for up to 8 hours or 30 days when “Remember me” is selected; password-reset records for 1 hour; and temporary game rooms for 2 hours. Account and learning records remain while the account is active and thereafter only for an applicable legal or claims period. When the purpose and legal basis end, data is deleted, destroyed or anonymized under the applicable policy.

Your rights and application process

Under Article 11 of Law No. 6698, you may ask whether your data is processed; request information and learn the purpose and recipients; request correction, deletion or destruction where conditions apply; request notification of these operations to recipients; object to a result produced exclusively by automated analysis; and request compensation for unlawful processing.

Use the form below without entering passwords, identity-document images or sensitive data. A reference number is issued immediately. Identity verification may be requested before a response is disclosed. Applications are answered as soon as possible and no later than 30 days, subject to the statutory fee rules.

Children and local speaking practice

Where a learner cannot legally manage an account alone, the account and permissions must be managed with a parent or legal guardian. UniverseHall does not request special-category personal data for ordinary learning use.

Speaking self-practice remains in browser memory on the learner’s device. The current automated check uses only local recording duration and availability signals; it does not create a transcript, upload audio, identify the speaker or claim to grade pronunciation. A future server or third-party analysis feature will require a separate notice, a documented legal basis and any necessary permission before it is enabled.