This Privacy Policy explains how Labor Bilişim Medikal İnş. Yay. Tic. Ltd. Şti. (the “Company”, “we”) processes personal data in connection with the Career Ladders platform (https://careerladders.org). It is provided as the information notice required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and it also reflects our obligations under Turkish Law No. 6698 on the Protection of Personal Data.
1. Controller and contact details
| Controller | Labor Bilişim Medikal İnş. Yay. Tic. Ltd. Şti. |
|---|---|
| Address | Üniversiteler Mah. 1596. Cad. No:95 A İç Kapı No:36 Çankaya/Ankara, Türkiye |
| [email protected] | |
| Website | https://careerladders.org |
Where Career Ladders is used through a school or organisation, that organisation determines which students are enrolled, which staff may see their data and for how long the account is used. In that arrangement the organisation acts as controller for the guidance activity and we act as processor on its instructions; we remain controller for account administration, billing, security and service improvement.
1.1 Representative in the Union
We are established outside the European Union. Where Article 27 GDPR requires us to designate a representative in the Union, the representative’s identity and contact details are published in this section and communicated to data subjects on request. Until then, and in all cases, you may address any request to the controller using the contact details above; we will not refuse a request on the ground that it was not addressed to a representative.
2. Categories of personal data
| Category | Examples |
|---|---|
| Identity data | Name, surname, date of birth, gender, national identifier where required for invoicing. |
| Contact data | E-mail address, telephone number, billing address. |
| Account data | Username, hashed password, role, language and interface preferences, two-factor settings. |
| Educational data | School, class, grade level, academic year, curriculum profile, assignments, goals, study records. |
| Assessment data | Inventory responses, scores, reports, match rates, attempt history. |
| Transaction data | Orders, packages, entitlements, invoices, discount and activation codes. |
| Technical data | IP address, device and browser information, session records, security and audit logs. |
| Correspondence | Support requests, contact-form submissions, notes recorded by guidance staff. |
We do not ask you for special categories of personal data within the meaning of Article 9 GDPR. Where an organisation records health or similar information about a student in a free-text note, it does so as controller and under its own legal basis.
3. Purposes and legal bases
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Creating and administering your account; providing the modules included in your package. | (b) performance of a contract |
| Delivering inventories and producing guidance reports. | (b) performance of a contract; for organisation use, (f) legitimate interests of the organisation in providing guidance, or consent where national law requires it |
| Processing orders, payments, refunds and invoices. | (b) performance of a contract; (c) legal obligation for tax and accounting records |
| Securing the service: authentication, fraud prevention, audit logging, abuse detection. | (f) legitimate interests in the security of the service |
| Responding to support requests and complaints. | (b) performance of a contract; (f) legitimate interests |
| Sending service messages about your account, orders or entitlements. | (b) performance of a contract |
| Sending commercial communications, where you have asked for them. | (a) consent |
| Establishing, exercising or defending legal claims; complying with requests from competent authorities. | (c) legal obligation; (f) legitimate interests |
Where we rely on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it. Where we rely on legitimate interests, you may object under Article 21 GDPR (see Section 8).
4. Automated processing
Inventory scoring, match rates and module recommendations are produced by automated calculation. These outputs are guidance material presented to you and, where applicable, to your guidance counsellor; they are not decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) GDPR. No admission, enrolment or employment decision is taken by the Platform.
You can always ask us how a particular result was calculated, and you may contest a result you believe to be inaccurate.
5. Sources of data
We obtain personal data from you directly, from the school or organisation that enrolled you, and from the systems that an organisation has connected to the Platform (for example a school information system). Occupation, programme and admission data comes from official public sources and is not personal data about you.
6. Recipients
We do not sell personal data. We disclose it only to:
- Processors acting on our instructions — hosting and infrastructure providers, e-mail and SMS delivery providers, error-monitoring and backup services, each bound by a written data processing agreement under Article 28 GDPR.
- Payment institutions — the payment provider processing your card transaction as a separate controller. We never receive or store your full card number.
- The e-invoicing provider — where an invoice must be issued for your order.
- Your school or organisation — where your account was created through one, limited to the roles it has assigned.
- Competent authorities and courts — where disclosure is required by law or necessary to establish or defend legal claims.
7. International transfers
The Platform is operated from Türkiye, and personal data is stored on servers located in Türkiye and, for some infrastructure services, in the European Union.
Türkiye is not the subject of an adequacy decision of the European Commission under Article 45 GDPR. Transfers of personal data from the European Economic Area to us therefore take place on the basis of the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment. You may request a copy of the clauses by writing to [email protected].
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- obtain confirmation of whether we process your personal data, and access to it (Article 15);
- have inaccurate data rectified and incomplete data completed (Article 16);
- have your data erased in the cases listed in Article 17;
- obtain restriction of processing (Article 18);
- receive the data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller (Article 20);
- object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and to object at any time and without justification to processing for direct marketing (Article 21);
- withdraw consent at any time where processing is based on consent.
Send requests to [email protected] or to the postal address above. We reply without undue delay and at the latest within one month, which may be extended by two further months for complex requests; we will tell you if that happens. We may ask for information needed to verify your identity.
If you consider that our processing infringes the GDPR, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement (Article 77). If your account was created by a school or organisation, a request concerning your guidance data may need to be directed to that organisation; we will tell you if that is the case and forward your request.
9. Retention
| Data | Retention period |
|---|---|
| Account and profile data | For as long as the account is open, then 6 months after closure. |
| Assessment responses and reports | For as long as the account is open, or the period the organisation has set, whichever is shorter. |
| Order, invoice and payment records | 10 years, as required by tax and commercial legislation. |
| Security and audit logs | Up to 2 years. |
| Support correspondence | 3 years from the close of the request. |
| Data processed on the basis of consent | Until consent is withdrawn. |
At the end of the applicable period, data is deleted or irreversibly anonymised.
10. Security
In accordance with Article 32 GDPR we apply technical and organisational measures appropriate to the risk, including encryption of traffic in transit, encryption at rest of designated sensitive fields, hashed passwords, optional two-factor authentication, role-based access control, audit logging, segregated environments, regular backups and restricted administrative access.
Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours in accordance with Article 33 and, where the risk is high, inform you directly in accordance with Article 34.
11. Cookies
Cookies and similar technologies are described in the separate Cookie Policy.
12. Changes to this policy
We update this policy when our processing changes. Material changes are announced through the Platform or by e-mail before they take effect. The date of the current version is shown at the top of this page.