Everyone
Privacy Notice
What personal data we process, why, who can see it, how long we keep it, and your rights.
Effective · Last updated
1. Who is responsible
ITSPracticing is operated by ITSPracticing, Yıldız, Çırağan Cd., 34349 Beşiktaş/İstanbul, Türkiye (“we”). This notice explains how we handle personal data under the EU/UK General Data Protection Regulation (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). A Turkish-language notice under KVKK is at KVKK Aydınlatma Metni.
| Data | Who decides why and how (controller) | Our role |
|---|---|---|
| Your courses, attempts, decisions, evaluations, recordings and messages inside missions | Your university or company (the Institution) | Processor — we act on the Institution's documented instructions under our Data Processing Agreement |
| Your account, sign-in security, fraud and abuse prevention, support you ask us for, and legal compliance | Us | Controller |
For data your Institution controls, its own privacy notice also applies, and requests about it are best sent to the Institution; we will help it answer them. Our contact for privacy matters is privacy@itspracticing.com.
2. What we process
| Category | Examples | Source |
|---|---|---|
| Identity and account | Name, email address, password (stored only as a hash by our authentication provider), Google profile name and email if you sign in with Google | You, your Institution's invitation, Google |
| Institutional | Organisation, department, course, cohort, role, enrolment, invitations | Your Institution |
| Work product | Findings, evidence cited, decision briefs and rationale, notes, emails you write to fictional colleagues | You |
| Practice activity | Which documents and tools you opened, parameters you changed, calculations you ran, hints you asked for, decisions you changed and committed, timestamps | Generated as you use a mission |
| Assessment | Evaluations, competency levels, instructor annotations, integrity indicators | Generated by the Service and your instructors |
| Session recordings (learners only) | A replayable record of the pages you saw and what you did on them, with inputs masked — see the Session Recording Notice | Your browser, while you practise |
| AI interactions | Messages sent to AI-played characters or the coach, and their replies, when your Institution has enabled AI | You and the AI provider |
| Security and technical | IP address, browser and device type, sign-in times, error reports, and network request metadata (never bodies or headers) | Your browser and our providers |
| Pilot requests | Name, work email, organisation, country, role, the answers you give on the pilot request form, and how you reached it (the page or campaign link and referring site) | You, on the public /pilot page |
Simulated business data is not personal data. Customers, suppliers, staff, orders and incidents inside a mission are invented. Please do not type real personal data into a simulation.
We do not ask for, and you should not provide, special categories of data (health, religion, ethnicity, and so on) or national identity numbers.
3. Why we process it, and on what legal basis
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Providing missions, tools and feedback; letting instructors review and assess work (on the Institution's instructions) | The Institution's basis — usually performance of a task in the public interest, contract, or legitimate interests (Art. 6(1)(b), (e) or (f)) | The Institution's basis — usually Art. 5(2)(c) or (f) |
| Creating and securing your account, signing you in, preventing abuse | Contract (Art. 6(1)(b)) and legitimate interests in a secure service (Art. 6(1)(f)) | Art. 5(2)(c) and (f) |
| Recording learner practice sessions for review and debrief | The Institution's basis for assessment; our legitimate interest in diagnosing faults | Art. 5(2)(c) and (f) |
| AI-played characters and coaching, when enabled by the Institution | The Institution's basis | Art. 5(2)(c) and (f); transfers abroad under Art. 9 |
| Answering your requests and support | Contract or legitimate interests | Art. 5(2)(c) and (f) |
| Answering a pilot request and preparing the conversation (we are the controller) | Steps taken at your request before entering into a contract, and legitimate interests (Art. 6(1)(b) and (f)); you consent to being contacted when you submit | Art. 5(2)(c) and (f) |
| Complying with law, responding to lawful requests, defending legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) | Art. 5(2)(ç) and (e) |
We do not use your data for advertising, sell it, or train AI models on it. Whether our AI providers may use what we send them for their own training is being confirmed. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects: the Service computes indicators and evidence, and people at your Institution decide grades. When your Institution enables AI, an AI model also checks your written report against the rubric; your instructor sees the result. A way to change it is being built.
Pilot requests are sorted by a fit score calculated from the answers you give (for example, subject area, timing and your role in the decision). A person reads every request; the score is never used on its own to reject one.
4. Who can see your data
| Who | Can see | Limits |
|---|---|---|
| You | Your own attempts, decisions, evaluations and recordings | Not other learners' work |
| Other learners | Nothing of yours | Enforced in the application and in the database |
| Your instructors and teaching assistants | Attempts, evaluations and recordings of learners at your Institution; recordings need a separate permission | Teaching assistants cannot change evaluations |
| Course coordinators and organisation administrators | Learners' work within their part of the Institution | Only within their Institution |
| Reviewers appointed by your Institution | Work within their scope, read-only | Cannot change anything |
| Our staff | Organisation structure needed to run the Service | See below |
Each request is scoped to your Institution in the application and in the database. We are moving all queries to a database role that cannot bypass these checks. Our operators can enter an Institution's workspace to give support, and each entry is logged. Our engineers can reach the database to operate, secure and restore the Service; who holds that access is being reviewed.
We share personal data with the service providers listed at Subprocessors, who process it only on our instructions; with authorities where the law requires it; and with a successor if our business is transferred, under the same protections.
5. Session recordings
When your Institution has recording switched on, a learner's practice session is recorded so that the learner and their instructors can replay it. Staff accounts are never recorded. Passwords and every typed input are masked before anything leaves your browser; request and response bodies, headers and cookies are never captured. Details: Session Recording Notice.
6. AI features
AI generation is off by default. If your Institution enables it, the text of what you write to an AI-played character or the coach, together with the fictional mission context it needs, is sent to our AI provider to produce a reply. Institutions that require data to stay in a particular region only receive AI replies when the provider's declared region matches; otherwise the Service uses pre-written replies and sends nothing. Details: AI Use and Transparency.
7. Where your data is stored and international transfers
Our main database is in Frankfurt (AWS eu-central-1). Practice workspaces run in Germany (Hetzner). The provider and region of the session-recording storage are being confirmed. Our hosting, sign-in and email providers are US companies, and our AI providers, when an Institution enables AI, may process data outside the EU and Türkiye. The legal mechanism for each transfer (EU Standard Contractual Clauses, the EU–US Data Privacy Framework, or the standard contracts required by Article 9 of KVKK) is being put in place provider by provider, and we will name it here once it is confirmed. You can ask us about the status at privacy@itspracticing.com.
8. How long we keep it
| Data | How long |
|---|---|
| Account | While your account exists. Deleted within 30 days after you or your Institution ask us to delete it, unless the law requires us to keep part of it. |
| Attempts, decisions, evaluations, activity and AI conversations | Kept until your Institution or you ask for deletion. Automatic retention periods are not yet set. |
| Session recordings | Kept until your Institution deletes them or a valid erasure request is made; they are not deleted on a schedule. The retention setting shown to administrators has no effect yet. |
| Administrative audit log (who invited, removed or changed whom) | For as long as the Institution's account is active, plus 12 months. |
| Pilot requests | Up to 24 months after our last exchange with you, unless they become part of a customer relationship. Deleted sooner if you ask. |
| When an Institution leaves | Its data is returned on request and then deleted within 90 days, as set out in the Data Processing Agreement. |
| Backups | Our database keeps a short point-in-time restore history (currently 6 hours). Other backups exist, including a manual database snapshot and workspace volume backups; their retention is being documented. |
Erasure currently covers account data, attempts and session recordings. It does not yet reach practice workspace volumes, stored files other than recordings, the self-hosted business tools used in missions, sales-tour recordings or backups; we are confirming how each will be handled.
When a learner's identity is deleted while their Institution still needs the assessment record, the work and evaluation can be kept in anonymised form, without anything that identifies the learner.
9. Security
Data is encrypted in transit (TLS); encryption at rest is provided by our database and hosting providers and is being confirmed for practice workspaces. Access is limited by role and scoped per Institution in the application and in the database; recordings mask inputs at the source. More at Security and Vulnerability Disclosure. If a personal-data breach affects you, we will notify your Institution and, where the law requires, the competent authority and you.
10. Your rights
Depending on the law that applies to you, you have the right to:
- know whether we process your data and get a copy of it;
- have inaccurate data corrected;
- have data deleted, or processing restricted, where the law allows (assessment records your Institution must keep for accreditation or appeals may be kept, anonymised where possible);
- receive data you provided in a portable, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent where processing relies on it, without affecting earlier processing;
- under KVKK Article 11, also: learn the purpose of processing and whether data is used accordingly, know the third parties in Türkiye or abroad to whom data is transferred, request notification of corrections and deletions to those third parties, object to a result against you arising exclusively from automated analysis, and claim compensation for damage from unlawful processing.
How to exercise them
If you have an account, you can download a copy of your data yourself at any time from Your data. For anything else, use the contacts below.
For data held for your Institution, contact your Institution, or write to us at privacy@itspracticing.com and we will pass the request on and help. For data we control, write to privacy@itspracticing.com. We may need to confirm your identity. We answer within one month under GDPR and within 30 days under KVKK, free of charge unless a request is manifestly unfounded or excessive.
You can also complain to a supervisory authority: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr); in the EU/EEA, the authority where you live or work; in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
11. Children
The Service is meant for university students and working professionals. It is not directed to children under 16. If an Institution admits younger learners, it is responsible for obtaining any parental consent the law requires.
13. Changes to this notice
We will update this notice when our processing changes, show the new date above, and tell Institutions in advance of material changes.