Privacy Policy and Data Protection Notice

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), Legal English TR acts as data controller and processes your personal data as described below.

• Data controller: Legal English TR — EKC Yazılım ve Teknoloji A.Ş.
• Address: Üniversite Mah. Sarıgül Sk. Istanbul Teknokent No: 37/1 Door No: 28, 34320 Avcılar / Istanbul, Türkiye
• Tax office / number: Avcılar Vergi Dairesi / 3260715403
• MERSIS: 0326071540300001 · Trade registry: 1159414 (İstanbul Ticaret Sicil Müdürlüğü)
• Registered email (KEP): ekcteknoloji@hs01.kep.tr
• Email: info@legalenglishtr.com · Phone: +90 545 477 97 70

This notice serves both as the disclosure required by Article 10 of the KVKK and as an explanation of how privacy works on https://legalenglishtr.com and in the Legal English TR mobile app (iOS and Android).

We process only what we need to run the service. What applies to you depends on how you use it.

We do not collect special categories of personal data. We never ask about health, beliefs or political views — please do not include such details in support messages.

We do not send commercial electronic messages for marketing (newsletters, promotions). If we start doing so, we will first ask for your consent as Turkish Law No. 6563 requires.

We do not carry out profiling or automated decision-making that produces adverse effects for you solely on the basis of automated analysis.

• What you type in when creating an account or placing an order
• Records the system generates as you use the Platform (sign-in logs, viewing progress, IP address)
• Transaction results returned by our payment service provider
• In the mobile app, purchase information from the app store where you bought and from our subscription infrastructure provider (RevenueCat)
• In the free version of the mobile app, advertising and device data that the Google AdMob software sends directly from your device to Google
• The security check on forms (Cloudflare Turnstile)
• What you tell us when you email us or use the contact form
• Browser storage and similar technologies (see section 7)

We keep data for as long as the purpose requires and for the limitation periods set by law. When the period ends, data is deleted, destroyed or anonymised.

Deleting your account: you can delete your account yourself on the website under My Account → Account & security, or in the mobile app under Settings → Account → Delete my account. Your profile, session data, video progress, reading and download records and the invoice details in our systems are deleted at once; records we must keep by law are kept for the periods above. Deleting your account does not cancel a subscription bought through the App Store or Google Play; you need to cancel that separately in your store account settings.

We do not sell your personal data. To run the service we share the minimum necessary with the recipients below. Each transfer relies on the legal basis shown for the relevant purpose in section 3 (KVKK Art. 8). Our service providers process the data on our behalf and on our instructions; the payment institution, the bank, the app stores and Google (AdMob) also process it on their own behalf under their own regulations and policies.

Transfers abroad: transfers to the recipients shown as "abroad" in the table are made under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. For our service providers, the safeguard we rely on is the standard contract published by the Personal Data Protection Board; a standard contract is notified to the Board within five business days of signing. The app stores and Google (AdMob) are independent data controllers processing the data on their own behalf; that processing is also subject to their privacy policies.

Our website uses no advertising or tracking cookies and writes no cookies to your device. There is no ad network or script that tracks you across sites; the two measurement tools that do run (cookie-free visit counting and error recording) are described at the end of this section.

The information the site needs in order to work is kept in your browser's storage (local storage and session storage) rather than in cookies:

• Your session: the session key that keeps you signed in after you log in; without it you would have to sign in again on every page. At sign-in we also save a short account summary (your name, email address and account type) and the time you signed in. If there is no activity for 30 minutes you are signed out for security and this information is deleted.
• Your language preference: remembers whether you chose Turkish or English.
• Your email address awaiting verification, and where to return: kept so that you do not have to type your address again on the verification page when you need to verify your email address. If you signed up while buying something or from another page, the address of that page and the product you chose are also kept, for up to 24 hours, so that you can return there after verifying.
• Video viewing ID: a random ID given to each browser tab to enforce the rule that one account can watch on one screen at a time. It is deleted when the tab is closed.
• Update marker: a temporary marker that makes sure an open page is reloaded only once when the site is updated. It is deleted when the tab is closed.

This information is used only to provide the service, never for advertising or profiling. The session key and the video viewing ID are sent to our servers while you use the site; the rest stays on your device only. Because they are strictly necessary, they need no separate consent. You can clear site data in your browser settings; if you do, you will be signed out and your language preference will be reset.

Subscription payment form: when you buy a subscription, the payment form prepared by the payment institution (including your name, e-mail address and phone number) is kept temporarily in this tab's storage while you move from the checkout page to the payment page. It is deleted when the payment page opens; if it does not open, it becomes unusable after 30 minutes at the latest.

Offer announcement: when an offer announcement is shown, the time it was shown is saved in your browser's storage so that the same announcement does not open again within 7 days; whether the offer and sales are currently open is also kept until the tab is closed. These records contain no personal information and are not sent to our servers.

On the sign-in, sign-up, password reset and email verification forms, the Cloudflare Turnstile security check runs to tell automated (bot) submissions apart. For the check, your IP address and technical signals about your browser are sent to Cloudflare (see section 6). It is used only to prevent abuse of those forms, never for advertising or tracking.

Video lessons play in Bunny.net's player, in a separate frame embedded in the page; to deliver the video the player receives your IP address and browser information.

Visit counting (Umami): on public pages, the cookie-free Umami counter runs to count, in aggregate, which pages are viewed and how often. It writes nothing to your device; it sends the address of the page viewed (with the query string and personal details removed), the referring site, browser, device type and language. Your IP address is processed only transiently during the request to determine your approximate location (country) and is not stored in the visit records. The counter does not run on account, payment, sign-in or admin pages or while you watch a lesson, and no count is made if your browser sends a "Do Not Track" signal (see section 6).

Error recording (Sentry): when a software error occurs on the site, the type of error, the page where it occurred and browser and device information are sent to Sentry; load times of some pages are also measured on a sample basis. Sentry writes no cookies or other information to your device. Your IP address is not recorded, and your name, email address and account ID are not sent. These records are used only to find and fix errors (see section 6).

Mobile app

In the mobile app, your session and app settings are kept in the app's storage on your device. Your flashcard progress (reviews, streaks, bookmarks) is stored only on your device and is not sent to us; your language preference is saved to your account. The sign-in and sign-up screens run the same Cloudflare Turnstile check as the website. Crashes and errors in the app are recorded with Sentry in the same way as on the website (no IP address, name or email is sent); the visit counter is not used in the app.

The free version of the mobile app shows ads; Premium subscribers see no ads. Ads are served by Google AdMob. To show ads, limit how often they appear, measure them and prevent fraud, the AdMob software sends Google your advertising ID, your IP address and the approximate location estimated from it, device and app information, and your interactions with ads (see sections 2 and 6).

Personalised ads are shown only with your consent. In the European Economic Area, the United Kingdom and Switzerland, the app shows Google's consent form during your first study session. On iOS you are also asked whether to allow the app to track you; if you do not allow it, your advertising identifier (IDFA) is not shared. If you have not given consent, or no consent form is offered where you are (including Türkiye), ads are shown without personalisation; even then Google may use device identifiers and your IP address to limit how often ads appear, to measure ads and to prevent fraud.

You can change your choices as follows:

iPhone and iPad: turn off tracking for the app under Settings → Privacy & Security → Tracking.

Android: reset or delete your advertising ID under Settings → Google → All services → Ads (menu names vary by device).

European Economic Area, United Kingdom and Switzerland: change or withdraw your consent in the app under Settings → Ad preferences.

• All traffic is encrypted with TLS/SSL; the site is served over HTTPS only.
• Passwords are never stored in plain text — only as an irreversible hash.
• Row-level access rules in the database mean each user can reach only their own records.
• Payment data is handled by a PCI-DSS compliant payment institution or bank, and for purchases in the mobile app by Apple or Google; card details never enter our systems.
• Videos are served through time-limited, account-bound access tokens; no directly downloadable link is ever issued.
• Access to admin tools is restricted by role and logged.
• In the event of a data breach we notify the Turkish Personal Data Protection Board and the individuals affected as soon as possible, as the KVKK requires.

Article 11 of the KVKK gives you the right to:

• Learn whether your personal data is being processed
• Request information about it if it is
• Learn why it is processed and whether it is used for that purpose
• Know the third parties, in Türkiye or abroad, to whom it has been transferred
• Have incomplete or inaccurate data corrected
• Request deletion or destruction of your data under the conditions in Article 7 of the KVKK
• Have any correction, deletion or destruction notified to the third parties who received the data
• Object to an adverse outcome produced solely by automated analysis of your data
• Claim compensation for damage caused by unlawful processing

How to apply

Under the Communiqué on the Procedures and Principles of Applying to the Data Controller, you may apply in any of these ways:

• Email info@legalenglishtr.com from the address registered to your account
• Send it from your registered electronic mail (KEP) address to ekcteknoloji@hs01.kep.tr
• Email an application signed with a secure electronic signature or mobile signature to info@legalenglishtr.com
• Send or hand-deliver a signed written request to Üniversite Mah. Sarıgül Sk. Istanbul Teknokent No: 37/1 Door No: 28, 34320 Avcılar / Istanbul, Türkiye

Your application must be in Turkish and include your name and surname, your signature if it is in writing, your Turkish ID number (or, if you are a foreign national, your nationality and passport or ID number), your residential or business address for notifications, your email address and phone number if you have them, and what you are asking for. We respond as soon as possible and within 30 days at the latest, free of charge. Where the request involves an actual cost, the fee set by the Board may apply.

If your request is refused, our answer is inadequate or we do not respond in time, you may complain to the Personal Data Protection Board within 30 days of learning our response and in any event within 60 days of your application.

Some choices need no application: you can delete your account yourself as described in section 5, and withdraw your consent to ads in the mobile app in the ways described in section 7.

The website and the mobile app are not directed at children; they are designed for adults who want to learn legal English. Purchases are made by people aged 18 and over. Anyone under 18 may open an account only with the consent and supervision of a parent or guardian. If we learn that a child's data has been processed without such consent, we delete it without delay. Please tell us at info@legalenglishtr.com if you believe that has happened.

Ads in the mobile app are limited to content suitable for a general audience.

We may update this notice as the law or the service changes. The current version is always published here and the "Last updated" date changes with it. Where our processing changes materially we email registered users, and where consent is required we ask for it again.

• Legal English TR — EKC Yazılım ve Teknoloji A.Ş.
• Address: Üniversite Mah. Sarıgül Sk. Istanbul Teknokent No: 37/1 Door No: 28, 34320 Avcılar / Istanbul, Türkiye
• Email: info@legalenglishtr.com
• Phone: +90 545 477 97 70

For purchase and refund terms see the Distance Sales Agreement and the Refund and Cancellation Policy; for platform rules see the Terms of Use.