1. Data controller
FİNEST GLOBAL TEKNOLOJİ LTD. ŞTİ. is the data controller in respect of the activities in which it determines the purposes and means of processing personal data. Contact: Yamaçtepe Mah. Burç Yolu Cad. Mahmut Tevfik Atay Bulvarı 4/A Blok No:103, Şahinbey/Gaziantep, Turkey (Address Code: 3480121437, Building Code: 20205645) · E-mail: orhancevik@hotmail.com.tr · Phone: +90 542 484 69 03 · WhatsApp: +90 542 484 69 03 · Web: https://finest-global.com. Platform: https://fibonaccimath.com.
2. Categories of processed data
- Identity and profile data: name, surname, date of birth/age range, grade, school, country/city, preferred language.
- Contact data: e-mail, phone, parent/mentor contact information.
- Account and security data: user ID, password hash, session logs, IP address, device/browser information, login history.
- Exam and education data: exam answers, scores, ranking, duration information, question-based performance, mock exam analyses, objection records.
- Olympiad and application data: applied event, stage, candidate number, participation status, document and certificate records.
- Payment and transaction data: order number, amount, currency, payment result, refund information; the full card number is not stored by the Platform; payment by card is carried out within the Akbank T.A.Ş. virtual POS (3D Secure) infrastructure.
- Mentor relationship data: mentor-student matching, access privileges, performance viewing records.
- Support and communication data: support requests, correspondence, notification preferences.
- Technical/cookie data: records regarding strictly necessary cookies and, upon consent, analytical, functional, or marketing cookies.
- Event visual: photograph/video records solely if an appropriate legal basis and necessary consent exist.
3. Purposes of processing
- Creating memberships and managing accounts.
- Ensuring identity/e-mail verification and account security.
- Conducting mock exams and olympiad exams, recording answers, scoring, and announcing results.
- Managing application, payment, invoicing, and refund processes.
- Providing mentor-student authorization.
- Answering support requests and resolving technical issues.
- Conducting exam security, abuse, and fraud prevention processes.
- Fulfill legal retention, accounting, and dispute obligations.
- Carrying out marketing communication, analytics, or specific media usage activities if explicit consent has been given.
4. Legal grounds
Personal data are processed based on valid legal grounds such as being necessary for the conclusion or performance of a contract, the legal obligations of the data controller, the establishment/exercise/protection of a right, legitimate interest, and explicit consent only where necessary. If an activity can rely on a valid legal ground other than explicit consent, explicit consent shall not be requested.
5. Data transfer
Personal data may be shared with hosting/cloud providers, e-mail and notification services, payment institutions, security and support providers, accounting/legal advisors, authorized public institutions, and legally authorized country representatives to the extent necessary for the execution of the service.
When data transfer abroad is required, an appropriate transfer mechanism (adequacy decision, appropriate safeguards, standard contract, or other methods prescribed by law) shall be applied in accordance with the provisions of the applicable KVKK, and the necessary notification and registration processes shall be completed. Explicit consent shall not be used as the sole basis for routine international transfers.
6. Retention periods
Data are retained for the period necessary for the processing purpose and thereafter for the statute of limitations/retention periods prescribed by the relevant legislation. Example retention policy: account data during the membership period; exam/result records throughout the exam and objection processes and archiving needs; payment/accounting records for the legal period; security logs for a reasonable security period; marketing consent records until the consent is withdrawn and the proof period expires.
7. Data security
Authorization matrix, access logs, password security, encrypted communication, backup, security updates, incident response procedures, and supplier controls are implemented. In case of suspected unauthorized access, the incident is evaluated, and notifications to the relevant person and authorized institutions are made if required by legislation.
8. Rights of the data subject
Data subjects may have the rights under the applicable personal data legislation to learn whether their personal data are processed, request information, learn whether they are used in accordance with their purpose, know the third parties to whom they are transferred, request the correction of incomplete/incorrect data, request deletion/destruction if conditions are met, request that the correction or deletion be notified to third parties to whom the data were transferred, object to unfavorable results arising from automated processing, and request compensation for damages due to unlawful processing.
Applications may be made to the e-mail address orhancevik@hotmail.com.tr, via the "My Data" page (https://fibonaccimath.com/public/my-data.php) while logged in on the Platform, or in writing to Yamaçtepe Mah. Burç Yolu Cad. Mahmut Tevfik Atay Bulvarı 4/A Blok No:103, Şahinbey/Gaziantep, Turkey, with information capable of verifying identity.
9. Children's data
Data belonging to children are processed by observing the proportionality required by the nature of the service and the age group. Parent/legal representative consent and verification are sought when necessary. Unnecessary, excessive, or profiling data for marketing purposes are not collected from children.
10. Update
This text may be updated when data processing activities or legislation change. Important changes are announced through appropriate channels.