Everyone
Privacy Notice
What personal data we process, why, who can see it, how long we keep it, and your rights.
Effective · Last updated
1. Who is responsible
ITSPracticing is operated by ITSPracticing, Yıldız, Çırağan Cd., 34349 Beşiktaş/İstanbul, Türkiye (“we”). This notice explains how we handle personal data under the EU/UK General Data Protection Regulation (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). A Turkish-language notice under KVKK is at KVKK Aydınlatma Metni.
| Data | Who decides why and how (controller) | Our role |
|---|---|---|
| Your courses, attempts, decisions, evaluations, recordings and messages inside missions | Your university or company (the Institution) | Processor — we act on the Institution's documented instructions under our Data Processing Agreement |
| Your account, sign-in security, fraud and abuse prevention, support you ask us for, and legal compliance | Us | Controller |
For data your Institution controls, its own privacy notice also applies, and requests about it are best sent to the Institution; we will help it answer them. Our contact for privacy matters is privacy@itspracticing.com; our data protection officer is Khaireddine Arbouch.
2. What we process
| Category | Examples | Source |
|---|---|---|
| Identity and account | Name, email address, password (stored only as a hash by our authentication provider), Google profile name and email if you sign in with Google | You, your Institution's invitation, Google |
| Institutional | Organisation, department, course, cohort, role, enrolment, invitations | Your Institution |
| Work product | Findings, evidence cited, decision briefs and rationale, notes, emails you write to fictional colleagues | You |
| Practice activity | Which documents and tools you opened, parameters you changed, calculations you ran, hints you asked for, decisions you changed and committed, timestamps | Generated as you use a mission |
| Assessment | Evaluations, competency levels, instructor annotations, integrity indicators | Generated by the Service and your instructors |
| Session recordings (learners only) | A replayable record of the pages you saw and what you did on them, with inputs masked — see the Session Recording Notice | Your browser, while you practise |
| AI interactions | Messages sent to AI-played characters or the coach, and their replies, when your Institution has enabled AI | You and the AI provider |
| Security and technical | IP address, browser and device type, sign-in times, error reports, and network request metadata (never bodies or headers) | Your browser and our providers |
| Pilot requests | Name, work email, organisation, country, role, the answers you give on the pilot request form, and how you reached it (the page or campaign link and referring site) | You, on the public /pilot page |
Simulated business data is not personal data. Customers, suppliers, staff, orders and incidents inside a mission are invented. Please do not type real personal data into a simulation.
We do not ask for, and you should not provide, special categories of data (health, religion, ethnicity, and so on) or national identity numbers.
3. Why we process it, and on what legal basis
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Providing missions, tools and feedback; letting instructors review and assess work (on the Institution's instructions) | The Institution's basis — usually performance of a task in the public interest, contract, or legitimate interests (Art. 6(1)(b), (e) or (f)) | The Institution's basis — usually Art. 5(2)(c) or (f) |
| Creating and securing your account, signing you in, preventing abuse | Contract (Art. 6(1)(b)) and legitimate interests in a secure service (Art. 6(1)(f)) | Art. 5(2)(c) and (f) |
| Recording learner practice sessions for review and debrief | The Institution's basis for assessment; our legitimate interest in diagnosing faults | Art. 5(2)(c) and (f) |
| AI-played characters and coaching, when enabled by the Institution | The Institution's basis | Art. 5(2)(c) and (f); transfers abroad under Art. 9 |
| Answering your requests and support | Contract or legitimate interests | Art. 5(2)(c) and (f) |
| Answering a pilot request and preparing the conversation (we are the controller) | Steps taken at your request before entering into a contract, and legitimate interests (Art. 6(1)(b) and (f)); you consent to being contacted when you submit | Art. 5(2)(c) and (f) |
| Complying with law, responding to lawful requests, defending legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) | Art. 5(2)(ç) and (e) |
We do not use your data for advertising, sell it, or use it to train AI models — ours or anyone else's. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects: the Service computes indicators and evidence, and people at your Institution decide grades.
Pilot requests are sorted by a fit score calculated from the answers you give (for example, subject area, timing and your role in the decision). A person reads every request; the score is never used on its own to reject one.
4. Who can see your data
| Who | Can see | Limits |
|---|---|---|
| You | Your own attempts, decisions, evaluations and recordings | Not other learners' work |
| Other learners | Nothing of yours | Enforced by the database, not only by the interface |
| Your instructors and teaching assistants | Attempts, evaluations and recordings of learners in the classes they teach | Teaching assistants cannot change evaluations |
| Course coordinators and organisation administrators | Learners' work within their part of the Institution | Only within their Institution |
| Reviewers appointed by your Institution | Work within their scope, read-only | Cannot change anything |
| Our staff | Organisation structure needed to run the Service | See below |
Every request is checked against your Institution in the database itself (row-level security), so one Institution can never read another's data. Our platform accounts do not include access to learners' attempts. A small number of named engineers hold database administration rights for operating, securing and restoring the Service; they use them only when necessary — for example to fix a fault your Institution reported, to investigate a security incident, or to comply with the law — and never to browse learner work.
We share personal data with the service providers listed at Subprocessors, who process it only on our instructions; with authorities where the law requires it; and with a successor if our business is transferred, under the same protections.
5. Session recordings
When your Institution has recording switched on, a learner's practice session is recorded so that the learner and their instructors can replay it. Staff accounts are never recorded. Passwords and every typed input are masked before anything leaves your browser; request and response bodies, headers and cookies are never captured. Details: Session Recording Notice.
6. AI features
AI generation is off by default. If your Institution enables it, the text of what you write to an AI-played character or the coach, together with the fictional mission context it needs, is sent to our AI provider to produce a reply. Institutions that require data to stay in a particular region only receive AI replies when the provider's declared region matches; otherwise the Service uses pre-written replies and sends nothing. Details: AI Use and Transparency.
7. Where your data is stored and international transfers
Our database and the storage holding session recordings are located in the European Union (Frankfurt, Germany). Some of our providers — for hosting, sign-in and bot protection — are based in the United States, and our AI provider, when an Institution enables AI, may process data outside the EU and Türkiye. Where personal data leaves the EU/EEA or Türkiye, we rely on an adequacy decision, the EU Standard Contractual Clauses, the EU–US Data Privacy Framework where the recipient is certified, or the standard contracts and other safeguards required by Article 9 of KVKK, as applicable. You can ask us for a copy of the relevant safeguards at privacy@itspracticing.com.
8. How long we keep it
| Data | How long |
|---|---|
| Account | While your account exists. Deleted within 30 days after you or your Institution ask us to delete it, unless the law requires us to keep part of it. |
| Attempts, decisions, evaluations, activity and AI conversations | For the period your Institution sets. If it sets none, until 24 months after the course offering ends (to support accreditation and appeals), then deleted or irreversibly anonymised. |
| Session recordings | Kept for as long as your Institution uses ITSPracticing; they are not deleted on a schedule. Removed when an administrator at your Institution deletes them, after a valid erasure request, or when the Institution leaves and asks for its data to be deleted. |
| Administrative audit log (who invited, removed or changed whom) | For as long as the Institution's account is active, plus 12 months. |
| Pilot requests | Up to 24 months after our last exchange with you, unless they become part of a customer relationship. Deleted sooner if you ask. |
| When an Institution leaves | Its data is returned on request and then deleted within 90 days, as set out in the Data Processing Agreement. |
| Backups | Our database keeps a short point-in-time restore history (currently 6 hours); deleted data leaves it automatically. |
When a learner's identity is deleted while their Institution still needs the assessment record, the work and evaluation can be kept in anonymised form, without anything that identifies the learner.
9. Security
Data is encrypted in transit (TLS) and at rest by our hosting and database providers; access is limited by role and isolated per Institution in the database; recordings mask inputs at the source. More at Security and Vulnerability Disclosure. If a personal-data breach affects you, we will notify your Institution and, where the law requires, the competent authority and you.
10. Your rights
Depending on the law that applies to you, you have the right to:
- know whether we process your data and get a copy of it;
- have inaccurate data corrected;
- have data deleted, or processing restricted, where the law allows (assessment records your Institution must keep for accreditation or appeals may be kept, anonymised where possible);
- receive data you provided in a portable, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent where processing relies on it, without affecting earlier processing;
- under KVKK Article 11, also: learn the purpose of processing and whether data is used accordingly, know the third parties in Türkiye or abroad to whom data is transferred, request notification of corrections and deletions to those third parties, object to a result against you arising exclusively from automated analysis, and claim compensation for damage from unlawful processing.
How to exercise them
If you have an account, you can download a copy of your data yourself at any time from Your data. For anything else, use the contacts below.
For data held for your Institution, contact your Institution, or write to us at privacy@itspracticing.com and we will pass the request on and help. For data we control, write to privacy@itspracticing.com. We may need to confirm your identity. We answer within one month under GDPR and within 30 days under KVKK, free of charge unless a request is manifestly unfounded or excessive.
You can also complain to a supervisory authority: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr); in the EU/EEA, the authority where you live or work; in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
11. Children
The Service is meant for university students and working professionals. It is not directed to children under 16. If an Institution admits younger learners, it is responsible for obtaining any parental consent the law requires.
13. Changes to this notice
We will update this notice when our processing changes, show the new date above, and tell Institutions in advance of material changes.