Data Protection Notice

1. Categories of personal data processed

• Identity and contact data: first name, last name, email address, grade/ education level information.
• Customer transaction data: purchase records, order references, premium access status.
• Assessment and profile data: career assessment answers, dimension scores, work-style and motivation analyses, career and field matches.
• Education data: GPA, IB/SAT/ACT/AP/A-Level scores, language exam results, social and academic activities, and an optionally uploaded CV.
• Transaction security data: IP address, device and browser information, session and usage logs.
• Support data: requests and messages you send to us.

Payment card details are not collected or stored by Unirivo; payment data is processed by our merchant of record, Paddle.

2. Purposes of processing personal data

• Providing the career assessment and generating free analysis results.
• Preparing and delivering the premium Full Analysis report by email.
• Building a university roadmap based on the academic profile.
• Membership and account management, authentication and session security.
• Carrying out purchase, billing and refund processes.
• Handling support requests and carrying out communication activities.
• Where you have given explicit consent, providing information about career and university content.
• Measuring and improving service quality and ensuring security.

3. Legal grounds (KVKK Art. 5)

• Establishment or performance of a contract (Art. 5/2-c): generating assessment results, preparing and delivering the premium report, account management.
• Compliance with a legal obligation (Art. 5/2-ç): keeping records required under accounting, tax and consumer protection legislation.
• Legitimate interest (Art. 5/2-f): service security, fraud prevention, service improvement.
• Explicit consent (Art. 5/1): marketing information emails and the optional CV upload.

4. Transfer of personal data

Personal data may be transferred, strictly limited to the purposes above, to the following categories of recipients:

• Merchant of record: Paddle.com, for payment, subscription, tax compliance and billing purposes.
• Infrastructure and hosting providers: application hosting, database and file storage services.
• Email delivery infrastructure: for sending result and report emails.
• Legal and financial advisers, and, upon request, competent public authorities and institutions.

As some of the infrastructure providers we use are located abroad, personal data may be transferred abroad within the scope of your explicit consent or other conditions set out in KVKK Article 9. Appropriate safeguards, including standard contractual clauses, are applied to such transfers.

5. Method of collection

Personal data is collected electronically, through automatic and partly automatic means, via the assessment, registration, academic profile and support forms on the website, cookies and similar technologies, and transaction notifications received from the payment provider.

6. Retention period

Personal data is retained for as long as necessary for the purpose for which it is processed, taking into account the statute-of-limitations periods set out in applicable legislation. Account and assessment data is retained until a request for account deletion; commercial and financial records are retained for up to 10 years as required by applicable legislation. Once the period expires, the data is deleted, destroyed or anonymised.

7. Your rights as a data subject (KVKK Art. 11)

• To learn whether your personal data is being processed and, if so, to request information about it.
• To learn the purpose of processing and whether it is used in line with that purpose.
• To know the third parties, domestic or abroad, to whom the data is transferred.
• To request correction of incomplete or inaccurate data.
• To request deletion or destruction of data within the conditions set out by law.
• To request that correction, deletion and destruction actions be notified to third parties.
• To object to a result that is to your detriment arising from the analysis of data exclusively through automated systems.
• To claim compensation for damages arising from unlawful processing.

You can submit your requests to destek@unirivo.live. Requests are concluded within 30 days at the latest. If your request is not answered, you retain the right to lodge a complaint with the Turkish Personal Data Protection Board.

8. Data security

Appropriate technical and administrative measures are applied to prevent the unlawful processing of, and access to, personal data, including encryption in transit, row-level access controls, authorisation, logging and regular security reviews.

9. Related documents

For more information, please see our Privacy Notice, Terms of Use and Refund Policy pages.