STUUDY PRIVACY POLICY

Effective Date: 25 June 2026
Last Updated: 25 June 2026

This Privacy Policy explains how Stuudy collects, uses, stores, shares and protects personal data when you visit our website, create an account, contact us, use our education services, submit an application or otherwise interact with the Stuudy platform.

1. Data Controller

The data controller responsible for the processing of your personal data is:

STUUDY EĞİTİM HİZMETLERİ TİCARET ANONİM ŞİRKETİ

Registered address:

Mimar Sinan Mahallesi, Üsküdar Caddesi, Yedpa Sitesi No: 1H/2, İç Kapı No: 51, Ataşehir, İstanbul, Türkiye

MERSIS Number: 0781108918600001
Istanbul Trade Registry Number: 1012735
Tax Office: Kozyatağı
Tax Identification Number: 7811089186

Trade name and brand: Stuudy

Privacy contact: privacy@stuudy.com

In this Privacy Policy, the company is referred to as “Stuudy”, “we”, “us” or “our”.

For the purposes of Turkish Personal Data Protection Law No. 6698, Stuudy acts as the “data controller”.

Where the European Union General Data Protection Regulation, the United Kingdom GDPR or another applicable data protection law applies, Stuudy acts as the “controller” unless otherwise stated.

2. Scope of This Policy

This Privacy Policy applies to personal data processed through:

the Stuudy website;
Stuudy user accounts;
mobile applications, if available;
university and programme search services;
eligibility assessment tools;
personality, preference and matching tests;
university application services;
language course services;
accommodation services;
insurance, blocked-account, money-transfer and telecommunications referrals;
student community and communication features;
contact, consultation and partnership forms;
email, telephone, WhatsApp and similar communication channels;
newsletters and marketing communications;
events, webinars and consultation meetings; and
other services operated under the Stuudy brand.

A separate privacy notice may be provided where a specific service requires additional or different processing.

3. Personal Data We Collect

Depending on how you use Stuudy, we may collect the following categories of personal data.

3.1 Identity information

name and surname;
date and place of birth;
nationality;
gender, where required for an application;
passport or identity document information;
photograph;
national identity number, where legally required;
signature; and
parent or legal guardian information.

3.2 Contact information

email address;
telephone number;
postal address;
country and city of residence;
preferred communication channel;
WhatsApp or messaging account details; and
emergency contact information, where necessary.

3.3 Account and profile information

username;
encrypted password;
account preferences;
saved programmes;
wishlist information;
search history;
selected countries, cities and subjects;
notification settings; and
account activity.

We do not have access to your plain-text password.

3.4 Academic and educational information

current and previous schools or universities;
diplomas and graduation certificates;
academic transcripts;
grades and grade-point averages;
university entrance examination results;
course information;
areas of study;
academic qualifications;
language levels and certificates;
employment and internship history;
CV information;
motivation letters;
recommendation letters;
portfolio materials; and
preferred programmes, institutions and countries.

3.5 Application and service information

university and programme applications;
application status;
conditional and unconditional admission documents;
visa-related application information;
accommodation preferences;
language course preferences;
desired start dates;
budget information;
scholarship preferences;
insurance and blocked-account service requests;
appointment details;
documents submitted for application or enrolment; and
correspondence with universities, Partners and service providers.

3.6 Financial and transaction information

billing name and address;
invoice information;
payment status;
transaction amount;
currency;
bank transfer information;
refund information;
payment reference numbers; and
limited payment-related information received from payment providers.

Where card payments are available, full payment card information is generally processed directly by authorised payment service providers and is not intended to be stored by Stuudy.

3.7 Communication information

emails;
contact form submissions;
telephone call notes;
consultation records;
WhatsApp and similar messages;
support requests;
complaint records;
survey responses;
feedback;
reviews; and
correspondence with our employees, consultants and Partners.

Telephone or video calls will only be recorded where users have been appropriately informed and a lawful basis exists.

3.8 Technical and usage information

IP address;
device type;
browser type and version;
operating system;
language settings;
approximate location derived from IP address;
login date and time;
session information;
pages viewed;
links clicked;
search queries;
referral source;
cookie identifiers;
advertising identifiers;
crash and error logs; and
security and fraud-prevention records.

3.9 Preference and matching information

When you use our eligibility, personality or programme-matching tools, we may process:

academic interests;
career goals;
preferred learning environment;
preferred destination;
language ability;
financial preferences;
study format preferences;
answers submitted in questionnaires; and
recommendations generated from your responses.

3.10 Partner and business-user information

Where you represent a university, language school, accommodation provider or another organisation, we may process:

name and surname;
job title;
business email address;
business telephone number;
institution information;
contract and commission information;
authorised representative information;
bank and payment information;
communication records;
user permissions; and
account activity.

3.11 Public content

Where you choose to publish or submit content, we may process:

profile information;
reviews;
ratings;
comments;
photographs;
videos;
student stories;
testimonials; and
public questions and answers.

Names, photographs, videos and testimonials will only be used for marketing purposes where a valid legal basis or appropriate permission exists.

4. Special Categories of Personal Data

Some documents submitted during an education, visa, insurance or accommodation process may contain special categories of personal data, including:

health information;
disability information;
biometric information contained in identity documents;
criminal conviction information, where legally required;
religious information appearing in an official document; or
other sensitive information protected by applicable law.

Please do not provide sensitive personal data unless it is specifically requested and necessary for the relevant service.

Stuudy processes sensitive personal data only where:

the processing is necessary for the requested service;
a valid legal condition exists;
explicit consent has been obtained where required;
the processing is required to establish, exercise or protect a legal right; or
another lawful exception applies.

Access to such data is restricted to authorised persons.

5. How We Collect Personal Data

We may collect personal data:

5.1 Directly from you

For example, when you:

create an account;
complete a form;
use a matching or eligibility tool;
upload a document;
contact our team;
book a consultation;
purchase a service;
submit an application;
subscribe to a newsletter;
attend an event or webinar; or
communicate through email, telephone or WhatsApp.

5.2 From parents or legal guardians

Where a student is under the age of 18 or a parent manages the education process, we may receive information from a parent or legal guardian.

5.3 From universities and Partners

We may receive application updates, admission decisions, enrolment information, service confirmations and other relevant information from:

universities;
language schools;
accommodation providers;
insurers;
payment providers;
application platforms; and
other Partners.

5.4 From service providers

We may receive limited information from providers supporting:

payments;
identity verification;
website hosting;
customer relationship management;
email delivery;
analytics;
security;
advertising;
appointment scheduling; and
customer support.

5.5 Automatically

Technical and usage information may be collected automatically through cookies, server logs and similar technologies when you use the Platform.

5.6 From public sources

We may collect professional or institutional information from publicly available sources, including:

university websites;
public programme databases;
official registers;
institutional directories;
professional networking websites; and
Partner websites.

6. Why We Process Personal Data

We may process personal data for the following purposes.

6.1 Providing and operating the Platform

creating and managing accounts;
authenticating users;
maintaining wishlists and preferences;
providing search and comparison functions;
responding to enquiries;
providing customer support; and
maintaining Platform functionality.

6.2 Education matching and eligibility assessment

recommending institutions and programmes;
assessing preliminary admission eligibility;
matching users with language courses or accommodation;
identifying relevant scholarships;
personalising search results; and
creating education plans.

6.3 Processing applications and bookings

preparing university applications;
organising application documents;
submitting authorised applications;
communicating with universities and Partners;
tracking application status;
arranging language courses;
supporting accommodation bookings;
assisting with insurance and blocked-account referrals; and
providing related education consultancy services.

6.4 Fulfilling contractual obligations

providing purchased services;
managing payments;
issuing invoices;
processing refunds;
managing contracts;
verifying service performance; and
handling disputes.

6.5 Communication

responding to messages;
sending appointment reminders;
providing application updates;
requesting missing documents;
sending operational notifications;
communicating deadlines; and
managing complaints.

6.6 Marketing and personalisation

Where permitted, we may:

send newsletters;
provide programme and scholarship updates;
send event invitations;
recommend services;
measure campaign performance;
personalise marketing content; and
create audience segments.

Users may withdraw marketing consent or unsubscribe at any time.

6.7 Security and fraud prevention

protecting accounts;
preventing unauthorised access;
detecting fraudulent documents or applications;
monitoring suspicious activity;
maintaining technical security;
preventing misuse; and
protecting the rights of Stuudy, users and Partners.

6.8 Legal and regulatory compliance

maintaining accounting and commercial records;
responding to public authorities;
complying with tax obligations;
handling data-subject requests;
complying with court orders;
establishing or defending legal claims; and
complying with applicable consumer, education and data protection laws.

6.9 Improving our services

analysing Platform performance;
identifying technical problems;
improving search and recommendation systems;
conducting statistical analysis;
developing new services;
measuring user satisfaction; and
improving customer experience.

Where possible, data used for analytics and statistical purposes is aggregated or anonymised.

7. Legal Bases for Processing

Depending on the processing activity and applicable law, Stuudy relies on one or more of the following legal bases:

your explicit consent;
the necessity of processing for the establishment or performance of a contract;
compliance with a legal obligation;
the establishment, exercise or protection of a legal right;
Stuudy’s legitimate interests, provided that your fundamental rights and freedoms are not overridden;
information made public by the data subject;
protection of life or physical integrity where consent cannot be obtained;
a legal basis applicable to sensitive personal data; and
another legal basis permitted under applicable law.

Where the GDPR applies, the relevant legal bases may include:

consent;
performance of a contract or steps requested before entering a contract;
compliance with a legal obligation;
protection of vital interests;
legitimate interests; and
the applicable conditions for processing special categories of personal data.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

8. Providing Personal Data

Some information is necessary to:

create an account;
provide a requested service;
process an application;
conclude or perform a contract;
comply with legal requirements; or
communicate with a university or Partner.

Where required information is not provided, we may be unable to:

create or maintain your account;
assess eligibility;
submit an application;
process a booking;
provide consultancy;
complete a payment; or
deliver the requested service.

Optional fields will be identified where reasonably possible.

9. Artificial Intelligence, Profiling and Recommendations

Stuudy may use artificial intelligence and automated systems to:

recommend programmes and institutions;
assess preliminary eligibility;
organise submitted information;
generate or improve draft documents;
personalise search results;
respond to general questions;
identify relevant services;
support customer service; and
detect potentially fraudulent or inconsistent activity.

These systems may analyse information such as:

academic qualifications;
grades;
language level;
preferred country;
preferred programme;
budget;
study goals;
Platform activity; and
Partner information.

Automated recommendations are intended to assist users and Stuudy employees. They do not constitute an official university admission decision.

Stuudy does not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects without appropriate safeguards.

Final admission, visa, scholarship, accommodation and service decisions are made by the relevant universities, authorities or Partners.

Where applicable, you may request:

information about the use of automated processing;
human review;
an opportunity to express your views; and
the correction of inaccurate information.

Information submitted to AI service providers will be limited to what is reasonably necessary, subject to contractual, security and data protection safeguards.

10. Who We Share Personal Data With

We may share personal data with the following recipient categories where necessary.

10.1 Universities and educational institutions

We may share application and academic information with universities, colleges, language schools and other educational institutions selected by or recommended to you.

10.2 Education-related Partners

Depending on your request, information may be shared with:

accommodation providers;
insurance providers;
blocked-account providers;
banks and financial service providers;
telecommunications providers;
visa and relocation service providers;
examination providers;
translation and certification providers; and
other relevant service providers.

Only information reasonably necessary for the requested service will be shared.

10.3 Technology service providers

We may use providers supporting:

website and cloud hosting;
database services;
email delivery;
customer relationship management;
document storage;
analytics;
cybersecurity;
communications;
appointment scheduling;
artificial intelligence;
customer support; and
software development.

These providers may process personal data on our behalf and are subject to appropriate contractual obligations.

10.4 Payment providers and banks

Payment and transaction information may be shared with:

banks;
payment institutions;
card processors;
accounting providers; and
refund-processing providers.

10.5 Professional advisers

Where necessary, information may be shared with:

lawyers;
accountants;
auditors;
insurers;
tax advisers; and
other professional consultants.

10.6 Public authorities

We may disclose personal data where legally required to:

courts;
law-enforcement authorities;
tax authorities;
regulatory bodies;
data protection authorities;
embassies;
consulates;
immigration authorities; and
other competent public institutions.

10.7 Corporate transactions

If Stuudy is involved in a merger, investment, restructuring, acquisition or sale of assets, relevant personal data may be disclosed to potential investors, purchasers and advisers subject to confidentiality and legal safeguards.

Stuudy does not sell personal data to third parties in exchange for money.

11. University and Partner Applications

When you request an application, booking or referral, you authorise Stuudy to transmit the information and documents necessary for that process to the selected university or Partner.

After receiving your information, a university or Partner may act as an independent data controller and process your information under its own privacy policy.

Stuudy does not control every processing activity independently carried out by a university, public authority or Partner.

You should review the privacy information supplied by the relevant organisation.

12. International Data Transfers

Stuudy operates in the international education sector. Your personal data may therefore be transferred to universities, Partners and technology providers located outside Türkiye or outside your country of residence.

International transfers may occur where:

you apply to a foreign university;
you request an overseas language course;
you request accommodation abroad;
you use an international insurance or financial service;
our technology provider stores data in another country; or
international communication is required to provide the requested service.

Stuudy carries out international transfers using an applicable legal mechanism, which may include:

an adequacy decision;
standard contractual clauses;
standard contracts approved under Turkish data protection law;
binding corporate rules;
another legally recognised safeguard;
your explicit consent where legally permitted; or
a statutory exception applicable to the requested service.

Where appropriate, Stuudy assesses the protection available in the recipient country and applies supplementary security measures.

13. Cookies and Similar Technologies

Stuudy uses cookies and similar technologies to:

operate essential website functions;
keep users signed in;
remember preferences;
maintain security;
analyse website performance;
measure engagement;
personalise content; and
support advertising and marketing.

Non-essential cookies will only be used where a valid legal basis exists and consent has been obtained where required.

Detailed information about cookie categories, providers and retention periods is provided in the separate Cookie Policy.

Users may manage non-essential cookie preferences through the cookie settings tool.

Rejecting non-essential cookies will not prevent access to the basic functions of the Platform, although some personalised functions may be limited.

14. Marketing Communications

Where permitted by law, Stuudy may send:

newsletters;
programme recommendations;
scholarship information;
course announcements;
accommodation opportunities;
event invitations;
promotional offers; and
education-related updates.

Marketing may be sent by:

email;
SMS;
telephone;
WhatsApp;
push notification; or
another selected communication channel.

You may withdraw marketing consent at any time by:

using the unsubscribe option in the communication;
changing account preferences; or
contacting privacy@stuudy.com.

Withdrawing marketing consent will not stop necessary operational communications relating to an active application, contract, payment or service.

Where legally required, commercial communication permissions may also be recorded through an authorised consent-management system.

15. Community, Chat and Public Features

Stuudy may provide features through which users can communicate with other students, alumni, Partners or community members.

Information you choose to share through a public or group feature may be visible to other participants.

You should not publicly share:

passport information;
identity numbers;
financial details;
passwords;
health information;
confidential application documents; or
another person’s personal information.

Stuudy may moderate, restrict or remove content to protect users and comply with applicable law.

Private communications may be reviewed where necessary to investigate abuse, fraud, security incidents or complaints.

16. Social Media and External Platforms

Stuudy may operate pages or accounts on social media and third-party communication services.

When you interact with Stuudy through an external platform, both Stuudy and the relevant platform may process personal data.

The external platform’s own privacy policy and settings will apply to its independent processing activities.

Stuudy is not responsible for privacy practices independently determined by third-party platforms.

17. Data Retention

Stuudy retains personal data only for as long as necessary for the purposes described in this Privacy Policy and to comply with legal obligations.

Unless a longer period is legally required or justified by a dispute, fraud investigation or legal claim, the following general retention criteria apply:

Account data: for the duration of the account and ordinarily up to three years after account closure or last activity;
Application and consultancy files: for the duration of the service and ordinarily up to three years after the service ends;
Contract, invoice and accounting records: for the period required under applicable commercial, accounting and tax laws, which may be up to ten years;
Payment records: for the legally required accounting and dispute-management period;
Contact enquiries and support records: ordinarily up to three years after the last communication;
Marketing data: until consent is withdrawn, the user unsubscribes or the data is no longer necessary, together with legally required consent records;
Cookie and analytics data: for the period stated in the Cookie Policy;
Technical and security logs: ordinarily up to twelve months, unless longer retention is required for a security investigation;
Complaint and legal-dispute records: until the matter is concluded and the applicable limitation periods expire; and
Partner records: for the duration of the business relationship and the applicable contractual and legal retention period.

Personal data may be deleted, destroyed or anonymised after the relevant retention period expires.

Deletion from secured backups may occur gradually according to the applicable backup cycle.

18. Data Security

Stuudy uses appropriate administrative, organisational and technical safeguards designed to protect personal data against:

unauthorised access;
accidental loss;
unlawful disclosure;
alteration;
destruction;
misuse; and
cyber threats.

Measures may include:

access controls;
role-based permissions;
encryption in transit;
password hashing;
secure backups;
logging and monitoring;
employee confidentiality obligations;
vendor security assessments;
incident-response procedures; and
regular system maintenance.

No electronic transmission or storage system can be guaranteed to be completely secure.

Users are responsible for protecting their passwords and devices and should promptly notify Stuudy of suspected account misuse.

19. Personal Data Breaches

Where a personal data breach occurs, Stuudy will:

investigate the incident;
take reasonable containment measures;
assess the potential risk;
maintain appropriate incident records; and
notify affected individuals and competent authorities where required by law.

20. Children and Minors

Stuudy’s services may be used by students under the age of 18 only with the involvement of a parent or legal guardian.

Where a minor’s information is submitted, the parent or guardian must ensure that:

the information is accurate;
they are authorised to provide it;
the minor has been appropriately informed; and
any legally required consent has been obtained.

Stuudy may request evidence of parental authority or consent.

If we become aware that a minor’s personal data has been provided without appropriate authority, we may restrict the account and delete the information where legally appropriate.

21. Your Rights Under Turkish Data Protection Law

Under Article 11 of Turkish Personal Data Protection Law No. 6698, you may have the right to:

learn whether your personal data is processed;
request information about processing;
learn the purposes of processing;
learn whether your data is used in accordance with those purposes;
learn the third parties to whom your data has been transferred in Türkiye or abroad;
request correction of incomplete or inaccurate data;
request deletion or destruction where the legal conditions are met;
request notification of correction, deletion or destruction to relevant third parties;
object to a result arising against you through the analysis of data exclusively by automated systems; and
claim compensation where you suffer damage because of unlawful processing.

These rights are subject to the conditions and exceptions established under applicable law.

22. Additional Rights for EEA and UK Users

Where the GDPR or UK GDPR applies, you may also have the right to:

access your personal data;
correct inaccurate data;
request deletion;
restrict processing;
object to processing based on legitimate interests;
receive certain data in a structured, commonly used and machine-readable format;
withdraw consent;
object to direct marketing;
request safeguards concerning solely automated decision-making; and
lodge a complaint with the competent data protection authority.

The exercise of these rights may be subject to legal conditions, exceptions and identity verification.

23. Exercising Your Rights

You may submit a data protection request by:

emailing privacy@stuudy.com from an email address associated with your account; or
sending a written request to Stuudy’s registered address.

Your request should include:

your name and surname;
sufficient information to identify your account or relationship with Stuudy;
the right you wish to exercise;
details of the relevant processing activity;
your preferred response method; and
supporting documents where necessary.

Stuudy may request additional information to confirm your identity and prevent unauthorised disclosure.

Requests will be handled within the period required by applicable law.

Where permitted by law, Stuudy may refuse or charge a reasonable fee for requests that are manifestly unfounded, excessive or repetitive.

24. Complaints

You may first contact Stuudy at privacy@stuudy.com regarding a privacy concern.

You may also submit a complaint to the Turkish Personal Data Protection Authority where the applicable legal conditions are met.

Where the GDPR or UK GDPR applies, you may lodge a complaint with the data protection authority of your habitual residence, place of work or the location of the alleged infringement.

25. Third-Party Links

The Platform may contain links to university websites, Partner websites, social media services and other external platforms.

Stuudy is not responsible for the privacy practices, security or content of independent third-party websites.

You should review the privacy policy of the relevant third party before submitting personal data.

26. Changes to This Privacy Policy

Stuudy may update this Privacy Policy to reflect:

changes in law;
new Platform functions;
changes in processing activities;
changes in Partners or technology providers;
security developments; or
operational requirements.

The updated version will be published with a revised “Last Updated” date.

Where a change materially affects your rights or how your personal data is used, Stuudy will provide additional notice where required.

27. Language

This Privacy Policy may be provided in Turkish, English and other languages.

Where legally permitted and a discrepancy exists between language versions, the Turkish version will prevail.

Mandatory rights available to users under the law applicable to them remain unaffected.

28. Contact Us

For privacy-related questions, requests or complaints, please contact: