Privacy Notice

Scope and method of collection

This notice covers visits to hubedu.com, information requests and the education consultancy and application processes that follow. Data is collected through the website and its forms, e-mail, phone calls and meetings, contracts, the documents you provide, and the institutions and service providers involved in your application, by fully or partly automated means or by non-automated means that form part of a data filing system.

Data, purposes and legal grounds

• Information requests: Name and surname, contact details, country/city, programme/country preference, age where needed, and correspondence are processed to answer your request on the basis of our legitimate interest under Article 5(2)(f) of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), provided this does not harm your fundamental rights and freedoms; and to prepare an offer or contract under Article 5(2)(c).
• Consultancy and applications: The necessary identity, passport, photo, contact, education, occupation, travel, visa/refusal, financial sufficiency, bank, sponsor and application documents are processed to prepare and follow up school, university, programme, scholarship, admission, enrolment, visa, accommodation and insurance applications. Processing that is necessary for a party to the contract relies on Article 5(2)(c). Where the applicant is not a party to the contract, or where family/sponsor data is needed, a separate valid legal ground must exist for that person’s data; if no other processing condition applies, that person’s explicit consent is obtained under Article 5(1).
• Records and security: Payment/invoice, contract, electronic approval and signature verification records are processed under Article 5(2)(ç) for statutory record-keeping obligations and under Article 5(2)(e) for handling disputes and protecting rights. IP address, access time, device and necessary transaction security records are processed under Article 5(2)(f) to ensure security, provided this does not harm your fundamental rights and freedoms.
• Special categories of data: Health, disability, criminal conviction and security measure data required by the application are processed only to the extent of the necessary documents, with separate explicit consent under Article 6(3)(a) KVKK. For the optional biometric signature, features such as movement, speed, direction and pressure are processed with separate explicit consent for signature verification and document/transaction security. A non-biometric signature/approval alternative is offered.
• Optional processing: Audio/video recordings of meetings, made after prior notice, for service quality and to verify what was discussed; and publishing satisfaction reviews and admission/visa results with your first name, the initial of your surname, country and institution on the website or social media for promotional purposes, each rely on separate and independent explicit consents under Article 5(1). The use of photos, audio or video for promotion is not covered by this consent.

Only the data needed for your current stage and the service you choose is processed. Where data belongs to other people, the required notice and consent steps are carried out separately for those persons.

Recipients and transfers abroad

Limited to the necessary information, your data may be transferred:

• to schools, universities, education/programme and scholarship institutions, consulates, embassies, immigration and visa authorities and authorised visa application centres in Türkiye and abroad, for education, admission, enrolment and visa processes;
• to the relevant bank/payment, insurance, health and accommodation providers, and to consultancy/representation service providers involved in the application, to deliver the service you choose;
• to e-mail, hosting, cloud, CRM, software, signature and technical infrastructure providers, for communication, application tracking, storage, backup and security;
• to competent public authorities and to legal and financial advisers, for legal obligations and the protection of rights;
• to the public through the relevant website and social media platforms, only if you consent to promotional sharing.

Requesting information alone does not mean that a school or visa application will be made on your behalf.

Although our corporate e-mail addresses use our own domain names, they run on Google’s e-mail infrastructure. Personal data, content and attachments in correspondence are processed on this infrastructure for transmission, storage, backup and security. Where systems located abroad are used, or data is accessed from abroad, this may involve a transfer abroad.

If our technical service providers change, your personal data may be transferred to the new providers for the same purposes and to the extent needed to continue the service, within the processing and transfer conditions of the KVKK. No separate consent is requested for processing that does not legally require explicit consent.

Article 8 KVKK applies to transfers within Türkiye and Article 9 to transfers abroad. A transfer abroad requires an applicable adequacy decision or an appropriate safeguard such as standard contractual clauses. Without these, data may only be transferred where the conditions of the occasional-transfer exceptions in the law are met. Explicit consent alone is not sufficient for regular transfers abroad.

Retention, cookies and your rights

Data is kept only for the periods set by the relevant legislation and as long as the processing purpose requires; when the reasons for processing end, it is deleted, destroyed or anonymised. Cookies and the management of your preferences are explained in the separate Cookie Notice. Viewing this notice or submitting the contact form does not constitute explicit consent.

Under Article 11 KVKK, you have the right to learn whether your data is processed; to request information if it is; to learn the purpose of processing, whether it is used in line with that purpose, and the recipients in Türkiye or abroad; to have incomplete or inaccurate data corrected; to request deletion or destruction where the legal conditions are met and to have these actions notified to recipients; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

You can submit your requests in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller: in writing to the address above, to our registered electronic mail (KEP) address, with a secure electronic signature or mobile signature, or from the e-mail address you previously notified to the Company and that is registered in our system, to iletisim@hubedu.com.au. Requests are concluded free of charge as soon as possible and within thirty days at the latest; if an additional cost arises, the fee set by the Personal Data Protection Board may apply.