Privacy and Personal Data Notice

1. Data controller

The data controller for platform operations is the provider identified below.

• Legal name: Tümer Altaş Eğt.Bil.Yay.Dan. A.Ş.
• Registered office: Ostim Teknopark
  OSTİM OSB MAH. 100.YIL BLV. NO: 55 E İÇ KAPI NO: 14
  YENİMAHALLE / ANKARA
• Tax number: 0730712912
• Tax office: Ostim
• MERSIS number: 0874018642900001
• Trade registry: 372135
• Professional chamber: Ankara
• E-mail: eposta@mylangprep.com
• Telephone: 0530 238 05 85
• Website: https://exambank.mylangprep.com
• Brand: Tümer Altaş Eğt.Bil.Yay.Dan. A.Ş.

2. Data categories

• Identity and contact data submitted during registration, support and billing.
• Account, authentication, consent, transaction, invoice, access and usage records.
• Exam answers, written/audio submissions, scores, feedback and appeal records where the relevant feature is used.
• Technical logs such as IP address, browser/device information, security events and essential cookies.

3. Purposes and legal grounds

Data is processed to establish and perform membership and sales contracts, deliver access, process payments and invoices, provide support, secure the platform, prevent abuse, meet legal retention/notification duties, resolve disputes and—where enabled—measure service performance.

• Performance of a contract and steps requested before entering into a contract.
• Compliance with legal obligations and establishment/exercise/protection of rights.
• Legitimate interests that do not override fundamental rights, such as security and fraud prevention.
• Explicit consent only where the law specifically requires it; consent is not bundled with the general privacy notice.

4. Recipients and service providers

Data is shared only to the extent necessary with payment institutions such as iyzico, invoice/e-document providers, hosting and infrastructure providers, e-mail/support services, authorized public bodies, professional advisers and—when an AI-supported evaluation feature is used—configured AI service providers.

• Full card number and card security code are entered in the payment provider environment and are not intentionally stored by the platform.
• Cross-border transfer, if any, is handled under the applicable data-protection transfer mechanism and provider configuration.

5. Collection method and retention

Data is collected electronically through forms, account activity, payment/invoice integrations, cookies, logs and communications. It is retained for the period necessary for the relevant purpose and mandatory legal limitation/retention periods, then deleted, destroyed or anonymized according to applicable requirements.

6. Rights and application

Data subjects may submit applicable requests concerning access, correction, deletion/destruction, information on processing and transfers, objection to certain automated outcomes, compensation and other statutory rights through eposta@mylangprep.com / 0530 238 05 85 or the registered e-mail address shown above.

7. Security

Administrative and technical measures are used to limit access, protect credentials, log critical actions, encrypt configured secrets and respond to incidents. No internet service can guarantee absolute security; users must protect their passwords and report suspected account compromise promptly.