Unicadde Privacy Notice
This notice explains processing of personal data in the Unicadde app and website under Turkish Law No. 6698 on the Protection of Personal Data (KVKK). The controller and contact channels appear in section 5 below. The Privacy Policy provides a simpler explanation of visibility and user choices.
1. Data categories and collection methods
Account, profile, education selection, student verification, sharing, messaging and preference information is collected electronically by wholly or partly automated means when you use those features. For manual student verification, current enrollment information may be shown to an authorized operator at the time of review; only minimal decision/audit information is recorded and no copy of the evidence is taken. Other users' interactions/reports about you and your support correspondence are also sources. Legal-application documents may also be processed by non-automated means when part of a filing system.
Connection, device-notification and limited error/security records arise while the service operates. Approximate region may be derived from IP address. University and program selections are generally self-declared. A student badge may follow verification of .edu.tr mailbox access or an authorized operator's manual decision based on current enrollment information matching the selected university; it is not official identity or university certification. Ordinary account and verification operations do not request a date of birth or Turkish national identity number; no copy of a document, card, photo or screen shown in manual review is retained.
If you choose Google/Apple, account information needed for sign-in is received from that provider; access to Gmail or iCloud content is not requested. Apple's private email address may be used. Changing your email in the app does not change the address in your provider account. These sign-in methods do not verify student status or official identity.
2. Processing purposes and legal grounds
The following grounds apply only within the necessary and proportionate scope of the relevant operation: KVKK Article 5(2)(c), establishment/performance of a contract; 5(2)(ç), legal obligation; 5(2)(e), establishment/exercise/protection of a right; 5(2)(f), legitimate interests balanced with fundamental rights and freedoms.
| Data category | Purpose | Legal ground |
|---|---|---|
| Account email, a secure password hash, the chosen Google/Apple provider's account identifier and supplied name/email, authentication, session and account status | Registration, password or chosen-provider sign-in, secure method linking, email confirmation, password recovery and address changes | Article 5(2)(c) |
| Username, display name, biography, profile image, education selection and preferences | Profile and selected community features | Article 5(2)(c) |
| Optional student email/code check, selected university, manual evidence method, authorized operator, closed reason code, decision/outcome and verification/expiry times | Providing/renewing the badge, preventing duplicate use and limited audit of manual decisions; no evidence copy is retained | Article 5(2)(c) for the badge; 5(2)(f) for proportionate abuse prevention and operation audit |
| Posts, comments, listings, images, likes and saves | Sharing and interactions within selected visibility | Article 5(2)(c) |
| Message requests, chats, reactions and personal communication preferences | Applying recipient-approved communication and preferences | Article 5(2)(c) |
| Notification identifiers, operating system, installation and preferences | Delivering and managing device notifications | Article 5(2)(c) |
| Reported content, limited message context, enforcement/appeals and operation records | Safety review, decisions and protection of rights | Article 5(2)(f) for safety; 5(2)(e) for rights; 5(2)(ç) where a concrete legal duty applies |
| Age declaration, contract acceptance, deletion approval and operation result | Age condition and user operations; evidence where needed | Article 5(2)(c) for the operation; 5(2)(e) for rights |
| IP, approximate region and limited device/connection/error/security records | Connection security, fault resolution and abuse prevention | Article 5(2)(f), where necessary and proportionate |
| Transactional-email recipient, messages that may contain links/codes or account information, delivery and error records | Delivering messages and investigating delivery problems; no recipient-linked open/click tracking | Article 5(2)(c) for delivery; 5(2)(f) for proportionate technical fault investigation |
| Support, personal-data applications and legal correspondence | Resolving requests, statutory applications and disputes | Article 5(2)(c) for support; 5(2)(ç) for statutory requests; 5(2)(e) for rights |
Where explicit consent is required, separate, specific and withdrawable consent must be obtained. This notice, contract acceptance and device permissions do not replace it. The service does not use advertising tracking; creating an account is not permission for commercial messages.
Special categories of personal data are not requested for ordinary account services. If such data appears in user content or a legal application, the applicable Article 6 condition and additional safeguards are assessed separately. Article 6(3)(d) applies to data necessary to protect rights in a legal application; 6(3)(b) applies where expressly provided by law.
3. Recipient groups and transfer purposes
- Other users: Profile, content and publicly accessible liker information within visibility rules; recipients see messages sent to them. Anonymous account links, account/student emails and personal history lists are not published through these routes.
- Authorized reviewers: Limited content/context needed for violation and appeal review. Access to private conversations and anonymous account links is restricted by purpose, authorization and operation records.
- Authorized student-verification operators: Only the applicant's selected institution, current enrollment information shown, method and records necessary for the decision; no evidence copy is retained. This authorization is separate from general content review.
- Technical service providers: Data needed for hosting, file storage, transactional email, device notifications, content safety, error diagnosis, network security and support. Notifications do not carry private content text; content-safety review may process relevant text and images.
- Competent public/judicial authorities and legal advisers: Data necessary for a concrete legal duty, verified official request or protection of a particular right, under the relevant Article 5(2)(ç) or 5(2)(e) condition.
Domestic transfers are subject to KVKK Article 8. Recipients receive the scope required for the purpose, rather than every piece of account data.
4. Processing abroad
The primary account and data-hosting region is Germany. Infrastructure or subprocessors for transactional email, device notifications, content safety, error diagnosis, network security and support may operate in other countries.
Article 9 adequacy/appropriate-safeguard conditions and the narrow exceptions for occasional transfers are assessed separately for these transfers. Choosing a European hosting region or accepting the service contract does not by itself establish that those conditions have been met. You can ask kvkk@unicadde.com about recipients and transfer safeguards.
5. Controller and contact
The controller is Yunus Emre Demirbaş, who provides the service under the Unicadde brand.
- Personal-data applications: kvkk@unicadde.com
- Legal notices: legal@unicadde.com
- General support: support@unicadde.com
Application methods are explained in section 7. These contact details do not restrict other application or formal-service methods under applicable law.
6. Retention and deletion
Retention takes account of use of the relevant service, verification security, resolution of an application and concrete rights-protection/statutory-retention needs. Data is deleted, destroyed or anonymized when the purpose and legal ground end. Category-based criteria are in the Privacy Policy's retention section; transactional-email delivery logs are kept for one month at the provider.
Account deletion starts with ownership verification and final approval; an approved request is irreversible. Removal from product views, technical erasure, limited review/legal preservation and backup clearing are separate operations. Removing a message for one participant does not delete the other's history. A deletion request does not restart retention of older records.
7. Your rights and applications
Under KVKK Article 11, you can learn whether your data is processed, its purposes and whether use matches those purposes, and ask about domestic/foreign recipients. You can request correction of incomplete/inaccurate data, deletion/destruction where legal conditions apply, and notification of those operations to recipients. You may also object to an adverse result from solely automated analysis and seek compensation for harm caused by unlawful processing.
Send your request to kvkk@unicadde.com from the email address registered in our system, or use the methods under the Regulation on Procedures and Principles for Applications to Controllers. If you cannot access your account, ask the same address about application methods. State your request, the necessary identity/contact information to verify the rights-holder and relevant documents where applicable; do not send passwords or verification codes. Mandatory application information is assessed under that Regulation.
Requests are resolved as soon as possible and within 30 days; reasons are given for a refusal. Applications are generally free, subject only to charges under the conditions and tariff specified by law. For refusal, an insufficient reply or no reply, Article 14 allows a complaint to the Board within 30 days of learning the response and, in any event, within 60 days of applying. The controller-application procedure precedes a Board complaint; judicial rights remain available.
8. Updates
A change of processing purpose is explained before the relevant operation. This notice is informational; contract acceptance and explicit consent where required are separate operations.