Privacy Policy

The data controller (veri sorumlusu) is EDUGATE EĞİTİM DANIŞMANLIK (EduGate Education Consultancy), an education consultancy based in Istanbul, Turkey (“EduGate”, “we”, “us”). This notice is given under Article 10 of Turkey’s Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, “KVKK”).

For anything about your personal data, contact us using the details below.

Identity

Full name, nationality, date of birth, and the copy of your passport (which shows your passport number, photograph and place of birth).

Contact

Phone number, WhatsApp number and email address.

Education

High-school and university certificates, transcripts, grade average (GPA), language certificates, and the country, degree, major and university you are applying for.

Application file

Your reference number, status history, the documents you upload, notes on your file, and the messages you exchange with our team through the student portal.

Payments

Invoices we issue to you and whether they have been paid. This website does not collect or store payment-card numbers.

Consent records

Which consents you gave on the application form, the version of the documents you agreed to, and the date and time.

Photos and testimonials

Only if you choose to send them, and published only with your separate consent.

Technical data

The cookies described in our Cookie Policy, and the IP address, browser type and request logs our hosting providers keep to run and secure the site.

Please do not send us information we have not asked for, such as health information or information about your religion or beliefs.

If you are under 18, the application must be submitted, and the consents given, by or together with your parent or legal guardian.

We collect personal data directly from you, by electronic means: the application and contact forms on this website, the student portal, and your messages to us by WhatsApp, phone, email or social media. We also receive data about your application from the universities and partners we submit it to, such as decisions and acceptance letters.

We process your personal data only for the purposes below, each on a legal basis set out in Articles 5 and 6 KVKK.

Assessing your profile, preparing your university application, submitting it and following it up

Necessary to establish and perform our service agreement with you (Art. 5/2-c). For your identity and academic documents, and for sending them abroad, we also rely on your explicit consent (Art. 5/1, Art. 6 and Art. 9).

Matching you with scholarships and study packages

Necessary to perform the service you asked for (Art. 5/2-c).

Contacting you about your application by WhatsApp, phone, email or the portal

Necessary to perform the service you asked for (Art. 5/2-c).

Issuing invoices and keeping accounting records

Required by the laws we are subject to (Art. 5/2-ç).

Keeping proof of your consents and defending or bringing legal claims

Necessary to establish, exercise or protect a right (Art. 5/2-e).

Keeping the website and student accounts secure and preventing misuse

Our legitimate interest, which does not override your fundamental rights (Art. 5/2-f).

Publishing your acceptance, photo or testimonial

Only with your separate explicit consent (Art. 5/1), which you can withdraw at any time.

We do not sell personal data. We do not send marketing messages without your separate prior consent. We do not take decisions about you solely by automated means: every application is reviewed by a person.

Your passport, certificates and transcripts are the most sensitive material you give us. We process them, and transfer them to universities and partners, only with your explicit consent (açık rıza). You give that consent through a separate, unticked checkbox on the application form, apart from accepting the Terms of Service, and we keep a dated record of it.

That consent covers sharing your data and documents with the parties needed to deliver the service you are requesting: the universities, schools and other educational institutions you apply to, our partners, and the service providers that operate our platform, as listed in section 6. We cannot provide the service without sharing your information with them.

Article 6 KVKK defines “special categories of personal data” as data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Documents you upload can contain or reveal such data — for example a photograph, a health report or an entry on an identity document. Where they do, we process that data only on the basis of your explicit consent and under the security measures in section 9.

You may withdraw your explicit consent at any time by contacting us. Withdrawal applies from then on and does not affect processing already carried out. Because we cannot submit an application without your documents, withdrawing consent may mean we cannot continue with it.

We share personal data only as far as each purpose requires, with:

Universities, schools and other educational institutions

The institutions you apply to, in the country you choose, and their admissions offices receive your application file and documents so they can decide on your admission or scholarship. They handle your data under their own privacy policies.

Study Fans Global

Our partner organisation, through which some university applications and scholarship places are processed.

Supabase

Provides our database, private document storage and portal sign-in. Our data is hosted on its servers in Asia.

Vercel

Hosts this website. Requests to the site are processed on its servers in the European Union and the United States.

Google (Gmail)

Delivers the emails that notify our team of a new application or contact message, and our email correspondence with you.

Other providers that help us operate the platform

Any further technical or operational service we need to run the website, the portal and our communications. This list is updated when a provider is added.

Public authorities and courts

Only where a law or a binding order requires it.

By giving your consent on the application form you agree to this sharing. We share only what each recipient needs for the service you asked for.

We do not give your data to any of these recipients for their own marketing, and our service providers may use it only to provide their service to us.

If you choose to contact us through WhatsApp, Instagram, Facebook or TikTok, those platforms process your messages under their own terms and privacy policies.

Our service is international by nature, so your personal data is transferred abroad:

• to the universities and partners in the country you apply to — Georgia, Cyprus, Germany, the United Kingdom or the United States — who receive your application file and documents;
• to our infrastructure providers, whose servers are located in Asia, the European Union and the United States. This applies even if you apply to a university in Turkey.

These transfers are made under Article 9 KVKK on the basis of your explicit consent, given on the application form after you have been informed by this notice, and because they are necessary to carry out the application you have asked us to make.

Important: Please be aware of the risk: the Personal Data Protection Board has not declared these countries to provide an adequate level of protection. Your data may therefore be subject to different rules there, you may not have the same rights or the same supervisory authority as in Turkey, and public authorities in those countries may be able to access it under their own laws.

If you do not give this consent we cannot process your application, because it cannot be prepared or submitted without these transfers.

We keep personal data only for as long as the purpose requires or the law obliges us:

Contact messages and enquiries that do not become an application

Up to 2 years after our last contact with you.

Applications that are withdrawn, not pursued or unsuccessful

The file and its documents, up to 2 years after the application is closed.

Applications that end in acceptance or enrolment

The application file, up to 10 years after our service ends (the general limitation period under the Turkish Code of Obligations). Copies of identity documents are deleted within 1 year after enrolment unless a service you have asked for, or a legal claim, still requires them.

Invoices and accounting records

10 years, as required by Turkish commercial and tax law.

Consent records

For as long as the application file they relate to.

Student portal account

Until you ask us to delete it, or until your application file is deleted.

Published testimonials or acceptances

Until you withdraw your consent.

When a period ends, the data is erased, destroyed or anonymised at the next periodic review, which takes place at least every six months, in line with Article 7 KVKK and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

You can ask us to delete your data at any time. We act on the request within 30 days. If a law requires us to keep some records, such as invoices, we keep only those, restrict them to that purpose, and tell you so.

• All traffic between your device and the website is encrypted (HTTPS/TLS).
• Uploaded documents are stored in private storage that is not publicly accessible. A file can be opened only by the student it belongs to and by authorised EduGate staff, through links that expire shortly after they are created.
• Database access rules ensure that a signed-in student can see only their own application, documents, messages and invoices.
• Data is encrypted at rest by our database provider.
• The student portal uses one-time sign-in links sent to your email address; we do not store passwords.
• Administrative keys are kept on the server only and are never sent to browsers.
• Access to student files is limited to the team members who need it to handle applications.

No system is completely secure. If a breach affecting your personal data occurs, we will notify the Personal Data Protection Board and you as required by Article 12 KVKK.

You have the right to:

• learn whether your personal data is processed;
• request information about the processing if it is;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties, in Turkey or abroad, to whom your data is transferred;
• request correction of data that is incomplete or inaccurate;
• request erasure or destruction of your data under the conditions in Article 7 KVKK;
• request that third parties to whom the data was transferred be notified of such correction, erasure or destruction;
• object to a result that arises against you through the analysis of your data exclusively by automated systems;
• claim compensation for damage you suffer because of unlawful processing.

To exercise these rights, write to us by email, WhatsApp or the other contact details in section 1, giving your full name and, if you have one, your application reference. We may ask for information to verify your identity before we act. We answer free of charge and at the latest within 30 days; if a request involves an additional cost, only the fee set by the Personal Data Protection Board may be charged (Article 13 KVKK).

If we reject your request, if you find our answer insufficient, or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within 30 days of learning our answer and in any case within 60 days of your request (Article 14 KVKK).

We may update this policy when our services or the law change. The date and version at the top of the page show the current text. If a change affects how we use data you have already given us in a way that requires your consent, we will ask for it again.