Privacy Policy

UniMatch TR is a digital guidance platform at www.unimatch.tr that matches high-school students and graduates in Türkiye with university programs in Germany. In this document, 'UniMatch TR', 'we' and 'the platform' mean the business that operates this service and acts as the data controller for your personal data.

For any privacy question, data request or complaint, our single contact address is destek@unimatch.tr.

We collect data directly from you: the sign-up form, your profile page, the matching wizard, the document upload screen and the booking steps. We receive the outcome of payments from our payment provider, and technical records are generated automatically in our infrastructure providers' systems. If you use the matching wizard without an account, your answers and the files you pick stay in your own browser until you sign in.

Depending on how you use the service, the following data is processed:

• Account data: your first and last name, e-mail address, optional phone number, account type (student, advisor, administrator) and the dates the account was created or updated. Your password is passed only to our authentication infrastructure, where it is stored in an irreversible (hashed) form; we cannot see it.
• Sign-in and security data: the 6-digit code sent to verify your e-mail, password reset links, your active session and, for administrator accounts, two-factor authentication records.
• Optional profile details: profile photo, date of birth, city, country, address, a short bio, your high school and graduation year. You do not have to fill these in.
• Education and matching data: your diploma grade and the estimated German grade (NC) calculated from it, your YKS score type, the Turkish program you were placed in, your German and English levels, your target intake, your saved programs and their match scores.
• Documents you upload: your YKS result, high-school diploma, transcript and an optional language certificate, together with the file name, size, type, upload time, review status and the advisor's note.
• Application data: the university and program you chose, the intake, the application status, the advisor handling your file, decision notes, your application timeline and the eligibility report number.
• Payment data: what the payment was for, its amount, currency, status and date; the transaction id at the payment provider; our internal payment reference number; and, if the payment provider returns it, only the last four digits of your card. Your card number, expiry date and security code never reach us.
• Appointment data: advisor, date, time, duration, status, fee, meeting room code and the booking note (for example the university and program you are interested in).
• Video meeting data: your camera, microphone and screen share when you turn them on; the name shown in the meeting; and the messages you type during the meeting. Meetings are not recorded and chat messages are not written to the database.
• Technical records: IP address, browser and device information, the addresses requested and error logs. These are generated in our hosting and infrastructure providers' systems.
• For advisors and administrators: title, bio, areas of expertise, languages, session price, weekly availability and blocked slots, plus activity records of changes made by administrators.

We do not ask for special categories of data such as health, belief or biometric data. Please do not include such information in your documents or in free-text fields.

Every processing activity has a purpose and a legal basis listed in Article 5 of the KVKK (Article 6 of the GDPR):

• Creating your account, verifying your sign-in and e-mail address, resetting your password — necessary to enter into and perform our contract with you.
• Producing program suggestions from your grade, field and language levels, and calculating your estimated German grade (NC) — performance of the contract.
• Letting our advisors review your application and documents, write notes and feedback, and prepare your eligibility report — performance of the contract.
• Charging the report and consultation fees, verifying payment and keeping payment records — performance of the contract and our legal obligations under tax and accounting rules.
• Creating your appointment, sending the invitation e-mail and running the video meeting — performance of the contract.
• Keeping the service running, fixing errors, preventing misuse and unauthorised access, and logging administrator actions — our legitimate interests.
• Establishing, exercising or defending legal claims in case of a dispute — our legitimate interests and the applicable legal provisions.

We do not send marketing or newsletter e-mails, we do not sell your data and we do not share it with third parties for advertising. The e-mails we send are a necessary part of the service: the verification code, the password reset link and the consultation invitation.

If we ever add processing that requires your explicit consent (for example analytics cookies), we will ask for it separately and in advance. Reading this page is not itself consent.

The match score and the estimated NC are calculated automatically by a formula, and they are suggestions only. No automated decision with legal effect is made about you: an advisor reviews your application, and only the university decides on admission.

Inside UniMatch TR: to review applications, check documents and run consultations, UniMatch advisors and administrators can see your profile, application, documents and appointments. Other students cannot see this information.

If you work as an advisor, your name, photo, title, bio, areas of expertise, languages and session price are shown to students on the platform.

To provide the service we use the following providers. They process the data on our behalf and only as far as the service requires:

• Supabase — database, authentication (accounts, verification and password reset e-mails), file storage and real-time messaging. Your account, profile, education, application, appointment and payment records, and the documents you upload, are kept here.
• Vercel — hosting of the website and the server-side operations (payment verification, meeting access, appointment e-mail). All requests pass through this infrastructure and technical records are generated here.
• Stripe — payment processing. Stripe receives your e-mail address, your user id, the amount and what the payment is for (for example the advisor's name, the date and time of the appointment, and the note naming the university/program). You enter your card details directly on Stripe's page.
• LiveKit — relaying audio, video and screen sharing during consultations. Your user id, the name shown in the meeting, your role and connection information (including your IP address) pass through this service.
• E-mail delivery service — sending verification, password reset and appointment invitation e-mails. These e-mails contain your name, e-mail address, appointment details and the meeting link.

Beyond this, we share data with public authorities only where we are legally required to do so and upon a valid request. We never sell your data.

Your profile photo is kept in a public storage area, which means anyone who knows the link can open it. Please do not upload an image you do not want to be publicly accessible.

All of the providers we use are based abroad, so your personal data is transferred outside Türkiye and processed on servers in other countries.

• Database, authentication and file storage: servers in the Japan (Tokyo) region.
• Website and server-side operations: servers in the United States. Pages may be delivered from the edge location closest to you.
• Payments, video meetings and e-mail delivery: the countries where the relevant provider's own infrastructure is located.

These transfers are necessary to provide the service; without these providers we cannot run your account, application, payment or consultation. Transfers abroad are governed by Article 9 of the KVKK. If you would like to know which data goes to which provider, write to destek@unimatch.tr.

We keep the data connected to your account for as long as the account is open, because your application, documents and report have to remain available in your dashboard. We do not run an automatic deletion schedule. Our criteria are:

• If you ask us to close your account, we delete your data except for records we are required to keep.
• We have to keep payment records for the period required by tax and accounting rules; those records may be kept for that period even after an account is closed.
• If there is a dispute or a legal claim, the relevant data may be kept for the applicable limitation periods.
• If you withdraw your application, the application record and its timeline are deleted; the documents you uploaded stay in your account.
• When you remove a document or replace it with a new one, the older version of the file may remain in storage. Write to us if you want it deleted completely and we will delete it.
• In-meeting chat messages are never stored. Meeting access keys expire after 2 hours, and the links advisors use to open your documents expire after 15 minutes.
• Technical records kept by our providers (such as server and access logs) are subject to their own retention periods.

We use no analytics, advertising or tracking tools. Our pages load no third-party tracking scripts, and fonts are served from our own site. We only use the following, which the service needs in order to work:

• Language cookie (NEXT_LOCALE): remembers the language you chose (Turkish, English, German); it is deleted when the browser session ends.
• Session key (localStorage): created when you sign in and keeps you signed in; it is removed when you sign out.
• Preferences (localStorage): your light/dark theme choice and the step you reached in the matching wizard. It contains no personal data.
• Cookie choice (localStorage): stores your answer to the cookie notice so it does not appear on every visit.
• Pending verification e-mail (sessionStorage): keeps you on the verification step if you reload the page during sign-up; it is removed once verification is complete.
• During payment, Stripe's own cookies are used on Stripe's page; these are subject to Stripe's privacy policy.

Because these are strictly necessary to provide the service, they do not require separate consent. You can reopen your preferences through the 'Cookie preferences' link in the footer. If we ever add analytics or a similar tool, we will only enable it with your permission and will update this page.

Paid one-to-one consultations run over a live audio and video service (LiveKit). Only the student and advisor of that appointment, and our administrators, can join the meeting room.

Your camera and microphone are off when the meeting starts; turning them on is your choice. Audio and video are protected in transit by standard WebRTC encryption and are relayed through the provider's servers. We do not use end-to-end encryption, so we do not claim it either.

UniMatch TR does not record meetings; there is no recording feature on the platform. Messages you type during a meeting are not written to the database: they stay in your browser for the duration of the meeting and are lost when you reload the page. When your advisor calls you, the call notification reaches your browser through our real-time messaging infrastructure.

Please do not record a meeting on your own device without the other side's explicit consent; doing so breaches our Terms of Use.

The measures we currently have in place to protect your data:

• The site and all data transfers are encrypted with HTTPS/TLS.
• The database enforces row-level access rules: students can only see their own profile, applications, documents, appointments and payments.
• Your documents are kept in a private storage area; advisors and administrators open them only through links that expire after 15 minutes.
• Your password is stored in an irreversible form by our authentication infrastructure, and your e-mail address is verified with a 6-digit code.
• Two-factor authentication (TOTP) is available for administrator accounts.
• Payment amounts are calculated on the server and a payment counts only after server-side verification. Card details are entered only at Stripe and are not stored by us.

No system is 100% secure, and we make no claims such as 'the highest security standards'. If we learn that your personal data has been accessed unlawfully, we will inform you and the Turkish Data Protection Authority as the law requires. Never share your password, and write to us if something looks wrong.

Article 11 of the KVKK gives you the right to: learn whether your personal data is being processed; request information if it is; learn the purpose of processing and whether the data is used accordingly; know the third parties to whom your data is transferred in Türkiye or abroad; request correction if the data is incomplete or inaccurate; request deletion or destruction under the conditions set out in the law; request that corrections and deletions be notified to the third parties the data was transferred to; object to an outcome against you produced solely by automated analysis; and claim compensation if you suffer damage because of unlawful processing.

If you are in the European Union and the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw any consent you have given, and the right to lodge a complaint with the supervisory authority in your country.

Some things you can do yourself in your account: update your profile details, remove your profile photo, replace a document with a new one, delete saved programs, withdraw an application that has not yet been approved, and reset your password.

Deleting your account entirely, changing your e-mail address and requesting a copy of your data cannot be done from the dashboard at the moment; send these requests to destek@unimatch.tr.

Send your request from the e-mail address registered in our system to destek@unimatch.tr; we may ask for further details to verify your identity. We answer within 30 days at the latest and, as a rule, free of charge. If your request is refused, you find our answer insufficient or you receive no answer in time, you can file a complaint with the Turkish Data Protection Authority.

UniMatch TR is designed for high-school students and recent graduates, so some of our users may be under 18. The platform does not verify age.

If you are under 18, we recommend that you read this page together with your parent or legal guardian and that you upload documents, book appointments and make payments with their knowledge and approval. Your parent or legal guardian can also write to destek@unimatch.tr to exercise these rights on your behalf.

We update this page when the service, our providers or the applicable law change. The current version is always published here and the date at the top shows the last change. We announce significant changes on the site.

Questions, requests and complaints: destek@unimatch.tr