1. Data controller
Pursuant to Personal Data Protection Law No. 6698 ("KVKK"), the data controller in respect of your personal data processed at platform level within the scope of the SixBloom Course Design Studio service (the "Service") is SixBloom (the "Company"), whose contact details are set out below.
- Address: [Address not entered]
- E-mail: [Email not entered]
- Registered e-mail (KEP) address: [KEP (registered email) address not entered]
- MERSİS number: [MERSİS number not entered]
2. Scope of this notice
This notice covers persons who complete the application form, authorised representatives and administrators of subscribing institutions, users who log in to the platform and visitors to sixbloom.com.
In respect of data that subscribing institutions enter into their own workspaces (academic staff accounts, course designs, assessment results, student numbers and grades), the relevant institution is the data controller. The Company processes such data solely on behalf of the institution, on its instructions and in its capacity as data processor. You may exercise your rights concerning such data primarily against your institution.
3. Personal data processed
- Identity: first name, surname, title.
- Contact: institutional e-mail address, telephone number, institution name and address.
- Customer transaction: content of applications and requests, selected plan, subscription, invoice and payment details.
- Transaction security: IP address, session information, login times, activity logs.
- Marketing: commercial electronic message preferences, only where explicit consent has been given.
The Service does not require the entry of Turkish identity numbers, health data or any other special categories of personal data. Such data must not be entered into the Service.
4. Purposes of processing
- Assessing applications, opening institution accounts and designating the institution administrator,
- Concluding and performing the subscription agreement, invoicing and collection,
- Sending login details, subscription expiry reminders and service notifications,
- Responding to support requests,
- Ensuring information security, preventing unauthorised access, performing backups and keeping records,
- Fulfilling legal obligations and responding to requests from competent authorities,
- Sending product and service announcements, where explicit consent has been given.
5. Legal grounds
Your personal data are processed pursuant to Article 5(2) of the KVKK on the following legal grounds: (c) processing is directly related to the conclusion or performance of a contract; (ç) processing is necessary for the data controller to comply with its legal obligations; (e) processing is necessary for the establishment, exercise or protection of a right; and (f) processing is necessary for the legitimate interests of the Company, provided that it does not harm your fundamental rights and freedoms. The sending of commercial electronic messages is based on your explicit consent pursuant to Article 5(1) of the KVKK and Law No. 6563 on the Regulation of Electronic Commerce; you may withdraw your consent at any time.
6. Method of collection
Your personal data are collected electronically, partly by automated means, through the application form, the platform and institution management screens, e-mail correspondence and system logs.
7. Transfers
- To suppliers providing hosting, e-mail and backup services, only to the extent necessary to provide the Service,
- To service providers such as accountants and legal advisers, within the scope of legal obligations,
- To competent public authorities and bodies, upon request and to the extent permitted by law.
If the institution enables the artificial intelligence feature, only course description texts (such as course content and draft learning outcomes) are sent to the artificial intelligence provider chosen by the institution. Grades, student numbers or personal names are not sent. Where the provider is located abroad, the transfer is made at the institution's choice and within the framework of Article 9 of the KVKK. Artificial intelligence suggestions are not added to the course information package (CIP) unless approved by the user.
8. Retention period
Your personal data are retained for the duration of the subscription and, after it ends, for the limitation and retention periods set out in the applicable legislation; at the end of that period they are erased, destroyed or anonymised. Unapproved applications are retained for no more than 2 years; transaction security logs are retained for 2 years. On termination of the agreement, institution data are erased within 90 days at the latest after being handed over to the institution; copies held in backups are erased automatically at the end of the retention cycle.
9. Your rights
Under Article 11 of the KVKK, by applying to the Company you have the right to:
- learn whether your personal data are being processed,
- request information about such processing, if they have been processed,
- learn the purpose of processing and whether the data are used in accordance with that purpose,
- know the third parties to whom your data are transferred in Turkey or abroad,
- request rectification if the data have been processed incompletely or inaccurately,
- request erasure or destruction of the data under the conditions set out in Article 7 of the KVKK,
- request that the rectification, erasure or destruction be notified to the third parties to whom the data have been transferred,
- object to any outcome detrimental to you arising from analysis carried out exclusively by automated systems,
- claim compensation if you suffer loss as a result of unlawful processing
of your personal data.
10. How to apply
You may submit your requests in writing, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, to [Address not entered], to the registered e-mail (KEP) address [KEP (registered email) address not entered] or to [Email not entered] from an e-mail address you have previously notified to the Company and which is held in our records. Applications are concluded free of charge within 30 days at the latest; where the process entails an additional cost, the fee schedule set by the Personal Data Protection Board may apply.
Last updated: 28.09.2026 · Version 1