Privacy notice under the Turkish data protection law
How personal data is processed in the Petek Aile app and on petek.family, under Article 10 of Law No. 6698 on the Protection of Personal Data and the Communiqué on the Obligation to Inform.
Last updated: October 15, 2026
The Turkish version of this text is authoritative.
Petek Aile is the app your child's school opens to parents. There are two separate data controllers in the app; below we state which data each one is responsible for.
1. Data controllers
1.1 Your school
Your school is the data controller for the data about your child and you that the school keeps and shares with you in the app, or that you send to the school in the app: your child's school record, class, attendance and day records, end-of-day reports, photos and videos, your messages with the school, form answers, consents, absence notices, the people who may collect your child, and payment and invoice records.
The school's name and contact details are shown on the school's page in the app. Your school also gives you its own privacy notice; for school records, that notice prevails. Onore processes this data on your school's behalf, on its instructions and under its contract with the school; for this data Onore is a data processor (Law Art. 3(1)(ğ)).
1.2 Onore
Onore, the developer of Petek, is the data controller for your Petek Aile account itself and the technical data the app needs to work: your phone number, optional recovery e-mail, name and language, verification codes, session and device records, push notification tokens, which schools your account is linked to, security logs, support requests and the petek.family contact form.
Onore's details:
| Company name | ⟨being updated⟩ |
| Address | ⟨being updated⟩ |
| MERSİS no | ⟨being updated⟩ |
| Tax office and no | ⟨being updated⟩, ⟨being updated⟩ |
| KEP (registered e-mail) | ⟨being updated⟩ |
| ⟨being updated⟩ | |
| Websites | onore.io, petek.family |
2. What personal data we process
| Category | Data | Controller | How it is collected |
|---|---|---|---|
| Identity | Your name; your child's name, date of birth and class | Your name: Onore (account) and the school. Child data: the school | From the school's records; from the account details you enter |
| Contact | Your phone number (verified), optional recovery e-mail | Onore (account); school (guardian record) | From you, in the app |
| Education and care records about the child | Attendance, arrival and departure times, meals, sleep, activities and teacher notes, end-of-day report, announcements, calendar | School | Entered by school staff |
| Images | Photos and videos the school shares; photos you send (for example a payment receipt) | School | From school staff and from you |
| Health | Allergy and regular medication information | School | Only with your explicit consent (Law Art. 6) |
| Messages and statements | Your messages with the school, form and permission answers, consents, absence notices, people who may collect your child | School | From you, in the app |
| Finance | Balance, instalments, payments and invoices | School | From the school's accounting records |
| Transaction security | Session records (date and time, IP address, device name, operating system, app version), verification code records (a hash, never the code itself), audit logs | Onore; the school for actions in the school | Automatically, while you use the app |
| Device | Push notification token, platform (iOS or Android), language | Onore | Automatically, when you allow notifications |
| Support | Your support request and correspondence | Onore | From you |
Card details never enter Petek; they are processed on the page of the payment institution or bank your school uses.
Petek Aile does not collect your phone's location. If an optional location feature is added later, you will be asked first and this notice will be updated.
Petek Aile shows no ads and has no ad measurement, advertising identifier or user-tracking tool. Your data is not sold and is not used for profiling or marketing. There is no AI face recognition in photos; school staff tag children by hand.
3. Purposes
3.1 Your school's purposes (Onore processes on its behalf)
- Communication between you and the school; sharing your child's day, photos and reports.
- Running permission, consent and form processes.
- Handing your child over safely: people who may collect, hand-over records at the door.
- Showing your payments and invoices and taking payments.
- Meeting the school's legal duties (for example attendance and enrolment records).
3.2 Onore's purposes
- Creating your account, verifying your phone number, secure sign-in.
- Linking your account to your schools.
- Sending push notifications and SMS.
- Keeping the app secure; preventing and detecting unauthorised access and misuse.
- Answering support requests.
- Meeting our legal obligations and protecting our rights in a dispute.
4. Legal grounds
4.1 Onore
- Art. 5(2)(c), performance of a contract: account data, verification, sessions, push tokens and school links, needed to provide the service under the Terms of Use.
- Art. 5(2)(f), legitimate interest: security logs, misuse prevention, support, provided your fundamental rights are not harmed.
- Art. 5(2)(ç), legal obligation: requests from authorities.
- Art. 5(2)(e), establishing, exercising or protecting a right: in disputes.
4.2 Your school (usually; your school's own notice prevails)
- Performing the enrolment contract (Art. 5(2)(c)), duties under Ministry of National Education and Ministry of Family rules (Art. 5(2)(ç)), legitimate interest (Art. 5(2)(f)).
- Explicit consent for sharing your child's photos and videos.
- Explicit consent for health data such as allergies and medication (Art. 6(3)(a)).
You give consent for your child as the child's legal representative under parental authority (Turkish Civil Code Art. 342). The consent texts are on the Consent texts page.
5. Recipients
5.1 School data
School data may be transferred to the school's authorised staff (only as much as their role needs), to public authorities where the law requires, and to the payment institution and e-invoice integrator the school uses.
Other parents never see your or your child's details. A photo showing several children is shown to those children's parents only if every child's parent has separately allowed it.
5.2 Onore's service providers
As far as needed to provide the service, processors acting for Onore and your school on instructions:
| Service | Provider | Country | What is sent |
|---|---|---|---|
| App and website hosting | Vercel Inc. | USA | Data the app processes, over encrypted connections |
| Database and backups | Hetzner Online GmbH | Germany | App data, encrypted |
| File storage (photos, documents) | Cloudflare Inc. (R2) | ⟨being updated⟩ | Photos and documents |
| SMS (codes, notices) | Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Türkiye | Phone number and message text |
| Push notifications | Expo (650 Industries Inc.), Apple Inc. (APNs), Google LLC (FCM) | USA | Push token and notification text |
| ⟨being updated⟩ | ⟨being updated⟩ | E-mail address and message |
Notification and SMS texts carry no more personal data than needed; for example the content of the day report is not put in the notification, it only says the report is ready. Personal data may also be disclosed to courts and competent authorities where the law requires.
5.3 Transfers abroad
Some of the providers above have servers outside Türkiye. These transfers follow Article 9 of the Law: where there is no adequacy decision, the standard contract announced by the Personal Data Protection Board is signed and notified to the Authority within five business days of signature (Art. 9(4)(c) and 9(5)).
Status of the standard contracts: ⟨being updated⟩
6. Retention
| Data (Onore) | Period |
|---|---|
| Account data | While your account is open. Deleted at once when you delete the account; removed from backups within 30 days |
| Verification code records | 30 days. Codes are never stored, only a hash |
| Session and security logs | 1 year(s) after the session ends |
| Push token | Deleted at once on sign-out or account deletion |
| Support correspondence | 2 years after the request is closed |
School data is kept for the period your school sets and the law requires; for example payment and invoice records follow tax-law periods. Your school sets how long photos are kept. Deleting your Petek Aile account does not delete the school's records. Data whose period has ended is deleted, destroyed or anonymised.
7. Your rights (Law Art. 11)
You may apply to the data controller to:
- learn whether your personal data is processed,
- request information about it,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad it is transferred to,
- have incomplete or inaccurate data corrected,
- have it erased or destroyed under Art. 7,
- have corrections and erasures notified to the third parties it was transferred to,
- object to an adverse result arising solely from automated analysis,
- claim compensation for damage caused by unlawful processing.
You can withdraw consent at any time inside the app.
8. How to apply
Apply to your school for the data it keeps (your child's school record, photos, payments) and to Onore for your account and the app's technical data. If you apply to Onore about school data, we forward your request to the school and tell you.
Under Article 5 of the Communiqué on Applications to the Data Controller, you can apply to Onore:
- by signed letter to ⟨being updated⟩
- by registered e-mail (KEP) to ⟨being updated⟩
- by e-mail signed with a secure electronic signature or mobile signature to ⟨being updated⟩
- by e-mail from the address registered in your Petek Aile account to ⟨being updated⟩
- in the app under Profile › Support, or through the contact form. For these channels we send a code to your registered phone to confirm it is you.
Your application must include your name (and signature for a letter), your Turkish ID number (for foreign nationals, nationality and passport or ID number), your address for notices, your e-mail and phone if any, and your request.
We answer free of charge within thirty days (Law Art. 13); a fee under the Board's tariff may apply only if the action has a separate cost. We answer in writing or electronically. If your application is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board (Law Art. 14).
9. Changes
When we update this notice we publish it on the site and in the app, and we announce significant changes in the app.