Mathverse · MV-EN-2026-11-03g-taslak
Privacy notice — international waitlist
English translation for information; the Turkish text prevails. Read the Turkish text (KVKK Aydınlatma Metni).
This text is awaiting legal review and will be updated before registration and payment open.
This notice explains, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the “Law”), how personal data is processed when you join the Mathverse Olympiad international waitlist. This notice is for information; it is not by itself a declaration of explicit consent.
1. Data controller
Mathverse is a brand of Orijin Dijital Yayıncılık Ltd. Şti. Data controller: Orijin Dijital Yayıncılık Ltd. Şti.
Email: [email protected] · MERSIS: 0647073991400001
2. What data we process
Waitlist: the parent’s full name, email address, the child’s grade, country, a record that you have read this notice, if given, your consent to commercial electronic messages; as proof of consent, the IP address, browser information and time of submission; and, if you arrived through a link, the advertising campaign source (utm tags and referral code).
No identity number is requested. No special category of personal data is processed.
3. Children’s data
Students’ data is provided by the student’s parent or legal guardian. Only the minimum data that is necessary is requested. Students’ data is not used for advertising, is not shared with third parties through profiling and is not sold.
4. Purposes and legal grounds
Your waitlist entry is processed, and you are informed about the registration period, the free practice exam and the season dates, because this is necessary for the steps taken at your request before a contract is concluded (Article 5(2)(c) of the Law).
Ensuring system security and preventing misuse is necessary for our legitimate interest and is carried out to the extent that it does not harm your fundamental rights and freedoms (Article 5(2)(f)).
Commercial electronic messages such as campaigns and announcements, and advertising measurement on the site that runs with cookie consent (Meta and Google cookies, including the processing of this data on servers abroad), rely solely on your explicit consent (Article 5(1), Article 9). Not giving these consents does not affect participation in the exam, and you may withdraw your consent at any time.
5. Who we transfer data to
Data may be transferred, limited to their duties, to our authorised staff; to the infrastructure service providers required for the system to work, namely Cloudflare for network security and form verification, and Amazon Web Services for sending transactional emails (Amazon SES) and for the corporate email service (Amazon WorkMail); and to legally authorised public institutions and judicial authorities upon their request.
If an AI-assisted skills report is offered to registered students, it is produced only with the parent’s explicit consent: to write the report narrative, only the grade level and result summaries are sent to an AI service provider abroad, without the student’s name, school, city, identity details or the parent’s contact details (de-identification). Without consent, the report is provided with a standard narrative prepared by predefined rules, without artificial intelligence, and no data is sent to the AI service provider; exam results and the skills report are not affected.
No data is transferred to AMS Foundation by default. Data is not sold. Only if you give explicit consent on the site are cookie identifiers and browsing information sent to Meta and Google for advertising measurement (see section 11, Cookies).
6. Transfers abroad
The application and database run on servers under our company’s control. However, due to the nature of the Cloudflare and Amazon Web Services services, some data (e.g. IP address, browser information, email address and email content) may be processed on servers abroad. This transfer is limited to the infrastructure services that are necessary for the service to work and is carried out on the basis of the conditions set out in Article 9 of the Law, in particular one of the appropriate safeguards such as the standard contract announced by the Personal Data Protection Board.
If an AI-assisted skills report is offered, de-identified result summaries are processed on servers abroad by the AI service provider; this transfer relies on the parent’s explicit consent (Article 9 of the Law).
7. How we collect data
Data is collected through the waitlist form on the site and through email correspondence, electronically, by automated or partly automated means.
8. Retention periods
The periods below may be updated following legal review. If no order is placed, waitlist data is deleted or anonymised within one year at the latest from the end of the 2026–27 season. Records of consent to commercial messages are kept for three years from the end of the consent; system security records are kept for at most two years. When the period ends, the data is deleted, destroyed or anonymised.
9. Security
Data is transmitted over an encrypted connection; access to the management panel is limited by role-based authorisation and the actions taken are logged.
10. Your rights and how to apply
Under Article 11 of the Law, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties, in Turkey or abroad, to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions in the Law; to request that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing. A parent may also exercise these rights on behalf of their child.
You can send your application, with information sufficient to verify your identity, by email from the email address registered in our system to [email protected], or by a wet-signed written application sent to the data controller’s postal address. Applications are concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.