🇬🇧
Book Now
Data Protection

Privacy Policy

Your privacy is important to us. This policy explains what data we collect, how we use it, and your rights.

Last updated: October 2026
What We Collect How We Use It Data Sharing Infrastructure International Transfers Your Rights Contact

1. Introduction

Royal Turkish Schools ("RTS") respects your privacy and is committed to protecting your personal data in accordance with Turkish Data Protection Law (KVKK — Law No. 6698) and applicable international data protection standards, including the UK GDPR where relevant.

RTS Plus (self-study lessons and the RTS Plus app): the controller for personal data processed in RTS Plus is Royal Daniel Ă–zer, a sole proprietorship registered in Zurich, Switzerland (CHE-221.627.654, DĂĽbendorfstrasse 4, 8051 ZĂĽrich), which processes it under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR. The categories of data, purposes and your rights described on this page apply accordingly. See also the RTS Plus Terms.

What the RTS Plus app processes (updated 23 October 2026):
• Account: e-mail address, name, optional profile photo, sign-in method (password, passkey or Sign in with Apple).
• Learning data: lessons and quizzes completed, scores, streaks, level, certificates.
• AI teacher Eda: your conversations with Eda and a short summary of your level, so that Eda remembers you. The text is processed by Anthropic (AI provider) to generate the answers.
• Messages: messages, photos, videos and documents you send to our school team or, if you switch messaging on, to other learners you add. They are stored on our servers (Google Cloud) and checked automatically by Anthropic's AI for harmful content before delivery; help features ("fix with Eda", "translate") also send the message text to Anthropic. Reports you make are reviewed by our staff.
• Voice: speaking practice uses your device's built-in speech recognition (Apple/Google); we do not record or store your voice.
• Notifications: a device notification token, so that we can deliver message and reminder notifications.
• Purchases: App Store and Google Play subscriptions are processed by Apple or Google; RevenueCat manages the subscription status for us using your account e-mail as identifier. We never receive your card details.
• Technical data: app version, device type and error reports needed to fix crashes, and an app-integrity check (Apple App Attest / Firebase App Check) that protects our servers from abuse.
The app contains no advertising and no tracking across other companies' apps or websites. Data is kept while your account exists; you can delete your account at any time in the app (Profile → Delete account), which deletes the data above except records we must keep by law. Messages you sent are removed; messages other people sent to you stay in their copy of the conversation.

RTS Ekip (internal staff app, updated 28 October 2026): RTS Ekip is used only by employees and teachers of Royal Turkish Schools, with accounts created by the school. The controller is RTS Royal Schools Dil Okulları Eğitim Danışmanlık Turizm Ticaret Ltd. Şti. (Istanbul, Türkiye), processing under KVKK (Law No. 6698).
• Account: work e-mail address, name, role and city, optional profile photo.
• Work data: the student and booking information a user's role requires, attendance, lesson logs, class materials, leave requests and their attachments.
• Messages: team messages and messages with students, including photos, videos and documents, stored on our servers (Google Cloud).
• Camera, microphone and photos: used only when the user starts an action (scanning a QR code, sending a photo or video, adding a passport image to a student booking).
• AI features: where a user asks the app to draft, correct or translate text, that text is processed by Anthropic (AI provider).
• Notifications: a device notification token (Apple Push Notification service or Firebase Cloud Messaging).
The app contains no advertising and no tracking. Accounts are closed by the school when employment ends; staff can request deletion of their personal data at [email protected], except records we must keep by law.

2. What Data We Collect

Full name
Nationality
Date of birth
Email & phone
Passport info (visa support)
Payment details (via provider)
Course attendance records
Placement test results
AI practice chats (Eda)
IP address and browser type (booking security, 90 days)
We do not store full credit card details.
When you use our AI practice assistant (“Eda”), your messages and Eda's responses — including grammar corrections — are stored and may be reviewed by our team to improve the service and our teaching quality. You can practice anonymously, and you may request deletion of your practice data at any time.

3. How We Use Your Data

  • Course enrolment and administration
  • Visa support documentation
  • Attendance tracking and certification
  • Accommodation or transfer arrangements (if applicable)
  • Communication regarding your booking
  • Legal compliance
  • Protecting our booking and payment forms against fake bookings and misuse (legitimate interest)

4. Legal Basis for Processing

Contractual Necessity
Legal Obligations
Legitimate Interest
Explicit Consent

5. Data Sharing

We may share data with the following parties, only to the extent necessary:

Payment Providers — Iyzico, PayPal
Accommodation Providers — where applicable
Insurance Companies — upon request
Government Authorities — where legally required
Ascentis (UK) — Accredited awarding body for ICE (International Certificate of English)

Where a learner is enrolled in an Ascentis-accredited qualification, we share the minimum data required for registration and certification: full name, date of birth, nationality, and contact email. This transfer is made on the basis of contractual necessity and the learner's explicit informed consent obtained at enrolment.

We do not sell personal data.

6. Data Infrastructure

Google Firebase Firestore

All learner and enquiry data is stored in Google Cloud Firestore — ISO 27001 certified, SOC 2 compliant, encrypted at rest and in transit.

Google Analytics

Anonymised website usage analytics. Does not collect personal data entered into forms.

Microsoft Clarity

Anonymised session behaviour analytics. Does not collect personal data entered into forms.

7. Data Retention

Data is retained only as long as necessary for educational records, legal obligations, and financial documentation. Once the retention period has passed, data is securely deleted or anonymised. The IP address and browser type recorded when a booking form is submitted are used only to prevent fake bookings and misuse, are never shared for marketing, and are deleted automatically after 90 days.

8. International Data Transfers

Where personal data is transferred outside of Turkey (for example, to Ascentis in the United Kingdom), such transfers are made on the basis of the data subject's explicit consent and in accordance with KVKK Article 9. We take appropriate safeguards to ensure transferred data receives an equivalent level of protection.

As a small-scale data controller (fewer than 50 employees, below the annual balance threshold), Royal Turkish Schools is exempt from mandatory VERBIS registration under KVKK Article 16. We remain fully bound by all KVKK data protection obligations.

9. Security Measures

Role-based access controls
HTTPS encryption in transit
Google Cloud enterprise security
No card data stored

10. Your Rights

Access your data
Request correction
Request deletion
Object to processing
Withdraw consent

To exercise any of these rights, email us at [email protected]

11. Cookies

Our website uses cookies for analytics and user experience improvement. You may disable cookies via your browser settings. See our Cookie Policy for details.

12. Contact & Governing Law

Data Protection Contact

Data Protection Officer

Royal Turkish Schools

[email protected]

General Enquiries

For data access, correction, or deletion requests:

[email protected]

Governing Law

This policy is governed by Turkish law — KVKK, Law No. 6698.
Last updated: October 2026.