KVKK Privacy Notice

1. Data Controller

Your personal data is processed by GM Arge Bilişim Danışmanlık Reklamcılık Ticaret Ltd. Şti. (“GM Teknoloji”) as data controller within its flagship product GeniusMethods. For educational use run for schools, GM Teknoloji may act as a data processor on the school’s instructions; for TÜBİTAK-supported research and product development purposes it is a separate (independent) data controller.

Address: Pınarbaşı Mah. Hürriyet Cad. Akdeniz Üniversitesi Antalya Teknokent Ar-Ge 2 Uluğbey Binası No:3A/Z13 Konyaaltı/Antalya · MERSİS: 0396159639500001 · KEP: [email protected] · Email: [email protected]

2. Personal Data Processed

• Student identity/profile information (name, age/class, institution)
• In-game behaviour indicators (decision time, preference, attempts, strategy, etc.)
• Skill and interest (RIASEC) indicators
• Parent contact and consent records
• Teacher/institution panel user information
• Technical data (session, device, logs)

3. Purposes of Processing

• Supporting game-based observation and educational evaluation processes
• Providing clear insights and reporting to institutions
• Product development and TÜBİTAK-supported research (with separate explicit consent)
• Security, prevention of misuse and legal obligations

4. Legal Bases

Data is processed based on explicit consent, the establishment/performance of a contract, legal obligation and legitimate interest. Parental explicit consent is the basis for behavioural/cognitive observation and research use.

5. Children’s Data

Users may be minors. Therefore children’s data is processed with enhanced protection within the framework of parental explicit consent and the child’s age-appropriate assent. The measurement is a developmental and probabilistic observation, not a definitive diagnosis/screening; no clinical or health inference is made.

6. Transfers

Personal data is hosted in Türkiye, on Hosting Dünyam infrastructure (Başakşehir / İstanbul data centre). Children’s data is not transferred abroad; real user data is not sent to overseas AI/asset services. Contracts with security commitments are made with sub-processors.

7. Retention

Data is retained for the period required by the processing purpose and prescribed by legislation; it is deleted or anonymised at the end of this period.

8. Data Subject Rights (Art. 11)

You have the right to learn whether your data is processed, request information, correction, deletion, object to automated inference and withdraw consent. Your requests are answered through the parent and within the period prescribed by legislation.

9. Applications

You can submit requests regarding your rights via [email protected], via the registered e-mail (KEP) address [email protected], or in writing to the postal address above. Requests are concluded in line with the Communiqué on Application Procedures to the Data Controller, within 30 days at the latest.