GDPR Information

This notice supplements our Privacy Policy and describes how Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi processes personal data of individuals in the EEA, UK, and Switzerland when they use Learn with Odi, under GDPR (Regulation (EU) 2016/679). For Türkiye see our KVKK Aydınlatma Metni.

Learn with Odi is consent-first: Firebase Analytics (GA4) Consent Mode defaults to denied and analytics only runs after opt-in via the cookie banner. Withdraw anytime via “Cookie preferences” in the footer.

1. Controller and processor roles

Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi
Dikilitaş Mah. Barış Sok. Fulya Sitesi A Blok 9/A, Beşiktaş-İstanbul-Türkiye
Email: destek@macenta.com.tr · KEP: macenta@h01.kep.tr

Public site: we act as controller. School accounts: we act as processor on the school's documented instructions; the school is the controller.

2. Data categories, purposes, and legal bases

• Identity & contact (name, username, email, school/class) — account, auth, membership, communications — Contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f));
• Learning & performance (scores, completion, progress, reports) — teaching, reporting, recommendations — Contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f));
• Technical & usage (IP, device/browser, coarse location, opt-in analytics ≤ 14 months) — security, debugging, analytics — legitimate interests (Art. 6(1)(f)), consent for analytics (Art. 6(1)(a));
• Visual & audio, special category (assignment audio, project uploads, video where offered) — assignment workflow, teacher review, opt-in leaderboard — explicit consent (Art. 9(2)(a)), optional and withdrawable.

Student assignment content: audio, project uploads, and video input

Some assignments ask the student for input in the form of audio recordings, project or file uploads, and (where offered) video recordings. The student provides this content voluntarily as part of completing the assignment. Microphone and camera access is used only when the student chooses to record or submit a spoken or video answer; we do not listen in the background or record outside of an assignment submission the student actively makes.

• Retention: assignment audio, project uploads, and video recordings are kept until the end of membership access and deleted afterwards.
• Access: each submission is accessible only by the submitting student and their own teacher, strictly for review and grading purposes.
• No external processing or sharing: assignment content is not processed externally, not shared with third parties, and not accessible by anyone else — it is never used for advertising, analytics, or model training.

3. Recipients (Art. 28) and transfers (Ch. V)

Google Firebase, AWS S3, Vimeo (playback only — never student submissions), Sentry, Resend/MailerLite, Stripe/RevenueCat. US transfers under SCCs 2021/914 (Module 2/3) plus UK Addendum where applicable. Assignment media is never used by sub-processors for their own purposes.

4. Collection methods (Art. 5)

• Web/app forms, login, settings, cookie banner (opt-in);
• School/teacher-provided rosters (processor role);
• Student-initiated assignment submission (mic/camera/file picker, after explicit consent);
• Automated technical collection (IP, device, error reports).

5. School leaderboards

Signed-in users see only their own school. Campus groups (e.g. Greenfield Academy) are shown together (e.g. Greenfield Academy (Greenfield North Campus, Greenfield South Campus, Greenfield Central)); a campus view stays campus-scoped (e.g. Greenfield North Campus (Greenfield Academy)). Names are shortened to FirstName L. (e.g. Emma T.). No public boards; worldwide view is system-admin only.

Explicit Art. 9(2)(a) consent is required before name/avatar/Jupas display tied to visual/audio uploads. Without consent students are anonymised or excluded. Withdraw via Cookie preferences.

6. Retention

• Assignment media → membership end, then deleted (backups ≤ 90d);
• Account/learning → term + up to 2 years, then deleted/anonymised;
• Analytics → ≤ 14 months, pseudonymous, opt-in only.

7. Security (Art. 32), breach (Art. 33–34)

TLS 1.2+, AES-256, Firebase Auth + MFA-ready, RBAC least privilege, VPC/WAF/DDoS, Sentry + audit logging, daily backups. Breach: notify controller ≤ 48h; support ≤ 72h authority notification and data-subject communication.

8. Rights, DPIA, DPA

Access, rectification, erasure, restriction, portability, objection, withdrawal. Email destek@macenta.com.tr from your registered address — we respond within one month. DPIA (Art. 35) support on request. Schools: countersigned DPA via our DPA template (Art. 28) — fill, sign, email us + KEP, we countersign.

9. Children

Designed for grades 1–4 in school-supervised accounts with parental involvement where local law requires it. No ads; no analytics on signed-in learning pages without applicable consent; visual/audio only after explicit parent-involved consent.

10. Cookies, contact, complaints

See Cookie Policy. Contact: destek@macenta.com.tr / macenta@h01.kep.tr. You may also complain to your local supervisory authority (EU/UK) or KVK Kurumu (kvkk.gov.tr) for Türkiye matters.