Privacy Policy

This Privacy Policy describes how CTI Academy Bilgisayar Programlama Faaliyetleri Limited Sirketi ("CTI Academy", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from https://ctiacademy.io (the "Site") or otherwise communicate with us (collectively, the "Services"). CTI Academy is the controller of the personal information described in this policy. For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy. Please read this Privacy Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.

To provide the Services, we collect and have collected over the past 12 months personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us. In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

The types of personal information we obtain about you depends on how you interact with our Site and use our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes or can be associated with you. Information We Collect Directly from You: • Account information including your name, username, email address, country and password • Profile information you choose to add, such as a photo, bio and links to your social profiles • Learning activity including your progress, quiz and mission answers, certificates and use of our labs and simulators • Content you publish, such as posts in the NullBase forum • Subscription information including your plan, billing name, billing address and country, payment status and the transaction references we receive from our payment provider • Customer support information including the information you choose to include in communications with us Information from Sign-in Providers: If you sign in with Google or GitHub, we receive the basic profile information that provider shares with us, such as your name, email address and profile picture. Push Notification Data: If you turn on browser notifications, we store the subscription your browser's push service creates for us (an address and encryption keys), your browser and operating system, the time zone your browser reports, your notification preferences, which notifications we sent you, whether you clicked them, and whether you were on a free or paid plan when each one was sent. Information We Collect through Cookies: We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.

Providing Products and Services: We use your personal information to provide you with the Services in order to perform our contract with you, including to create, maintain and otherwise manage your account, to track your learning progress and issue certificates, to provide your subscription and process related payments and refunds, and to send you notifications related to your account and purchases. Marketing: We use your personal information to send you news, product updates and offers by email, and to better tailor the Services. With your consent, we also measure how our marketing campaigns perform (see Cookies). You can unsubscribe from marketing email at any time. Notifications: With your consent, we send browser notifications: streak reminders and news about new missions, learning paths and announcements. We use your time zone so we do not send them at night, and the delivery and click records to measure whether notifications are useful. Notifications are off until you turn them on, and you can turn them off at any time in your profile under Notifications, or in your browser's site settings. Security and Fraud Prevention: We use your personal information to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. Communicating with you: We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you.

Like many websites, we use Cookies on our Site. We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences), to run analytics and better understand user interaction with the Services (in our legitimate interests to administer, improve and optimize the Services). With your consent, we also use analytics and marketing cookies (currently HubSpot) to understand how the Site is used and to measure our campaigns. These are off until you accept them, and you can change your choice at any time from "Cookie preferences" in the site footer. Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.

Premium and Student purchases are processed by our online reseller and Merchant of Record, Polar Software, Inc. ("Polar"). When you buy a subscription, you enter your payment details on Polar's checkout, and Polar receives the information needed to complete and bill the purchase, such as your name, email address, billing address and payment details. Polar processes this information under its own privacy policy. We never receive or store your full card number or security code. From Polar we receive what we need to manage your subscription, such as your plan, billing name and address, payment status and transaction references. For subscriptions bought through our previous payment provider, before we moved our checkout to Polar, we keep the limited card details that provider returned (card brand and type, issuing bank, and the card's first digits and last four digits).

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include: • With Polar, our Merchant of Record, to process purchases, taxes, invoices and refunds • With vendors or other third parties who perform services on our behalf (e.g., IT management, hosting, payment processing, data analytics, email delivery, customer support and cloud storage) • With AI service providers, such as Google, that power our AI features, for example to analyse your learning activity and generate feedback • With the push service run by your browser's maker (Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari), only if you turned on notifications, so that they can be delivered to your device. These services may be located outside your country. The content of each notification is encrypted end to end and they cannot read it; they receive the subscription address and the time of delivery • With HubSpot, which we use to manage our customer communications and, where you have accepted marketing cookies, to measure our campaigns • Publicly, through your public profile at ctiacademy.io/profile/your-username, which anyone can view, including search engines, unless you make your profile private in your account settings. A public profile shows your username, avatar, plan and streak, and your learning achievements such as points, badges and completed missions. Your country appears unless you turn it off, and your name, bio, email and social links appear only if you turn them on. A private profile is hidden from everyone else, though your username and points still appear on leaderboards • With other NullBase members, for posts you write in the NullBase forum • When you direct, request us or otherwise consent to our disclosure of certain information to third parties • With our affiliates or otherwise within our corporate group, in our legitimate interests to run a successful business • In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations, to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others

Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us. How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. Push notification subscriptions are kept until you turn notifications off, sign out, or your browser's push service invalidates them. Records of which notifications were sent and clicked are deleted after 12 months. If you change your username, we keep a record of your previous usernames for security and support. It is deleted together with your account. When you delete your account: You can delete your account at any time from Settings, under Security, Delete account. Deletion takes effect immediately and cannot be undone. We delete your account and profile, your learning progress, points, badges and certificates, your sign-in history (including IP addresses), the messages you sent us through our contact form, and any NullBase or LeakLens account linked to your account, and we ask HubSpot to erase your contact record. Usage statistics are kept only in a form that can no longer be linked to you. Any subscription is set not to renew. After deletion we keep only what the law requires or what protects others from being misled: • The amount, currency, date and payment provider reference of your past payments, without your name, email address or card details, for up to 10 years, as Turkish tax and commercial law requires (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102) • A record that the deletion took place, for at least 3 years, as the Turkish regulation on the erasure of personal data requires. It does not contain your name, email address or username; if you told us why you were leaving, that feedback is kept with it • A one-way fingerprint of your username (not the username itself) for 30 days, so that nobody else can take it while links to your old profile and certificates may still be in circulation Polar, as our Merchant of Record, keeps its own records of your purchases under its privacy policy. If Polar sends us an update about a deleted account's purchase after the deletion, we keep only the reference and the amount, and discard the personal details. Copies of your data in our database backups are removed as the backups rotate out, within 30 days. Our servers' technical logs (for example web server logs, which record IP addresses, and application logs, which can record a username) are kept for security and troubleshooting and are deleted as they rotate, within 60 days. Internal notifications our team received about your account, such as a sign-up or a feedback message, are not removed automatically; we delete them if you ask us to.

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law. • Right to Access / Know: You may have a right to request access to personal information that we hold about you. • Right to Delete: You can delete your account and the personal information linked to it yourself, at any time, from Settings, under Security, Delete account. You can also ask us to delete it by email. What we keep after a deletion is described above. • Right to Correct: You can correct your name, country and profile details in Settings, and change your username there once every 30 days. After a change, links to your old profile address stop working, and your old username stays reserved for 30 days so nobody else can take it. For anything else, you may ask us to correct inaccurate personal information we maintain about you. • Right of Portability: You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party. • Restriction of Processing: You may have the right to ask us to stop or restrict our processing of personal information. • Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent. • Right to Opt out of Marketing: You may have a right to request that we stop sending you marketing communications.

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us at: Email: [email protected] Company: CTI Academy Bilgisayar Programlama Faaliyetleri Limited Sirketi, registered in Turkey Address: Cagis Mah. Cagis 15 Sk. Balikesir Teknokent No:2 Ic Kapi No:11 Bigadic/BALIKESIR, Turkey