KVKK privacy notice (Türkiye)

Your personal data is processed by Omnibus, Ltd. (the “Company”) as data controller.

Full details are in the privacy policy. This notice brings together the information the KVKK requires.

If the Company is not established in Türkiye, it appoints a data controller's representative resident in Türkiye under Art. 16 KVKK and the Regulation on the Data Controllers' Registry. The representative's identity and contact details will be published here once appointed. Until then you can send your requests directly to the Company.

We do not process: microphone audio or conversations, what is played (song or video titles), contacts, photos or messages, advertising identifiers. Raw motion data is processed on the phone and never sent to our servers.

• Running membership, sign-in and pairing of family members.
• Measuring listening level, sound dose, posture and earbud events and showing them to the person and their linked parents.
• Preparing and sending alerts, the weekly report and its PDF.
• Helping to find a dropped or left-behind earbud.
• Running goals, stars, streaks, rewards, the wardrobe, friends and the league.
• Running subscriptions (payment is taken by Apple).
• Producing anonymous class averages in a school programme a parent chooses to join (at least 10 reporting students).
• Information security, abuse prevention and fixing errors.
• Answering requests and complaints; meeting requests from authorities and legal obligations.

Data is never sold and never used for advertising, marketing or profiling. Earbunny is not a medical device and does not process data to diagnose or treat.

We take the cautious view that listening exposure and posture are health data. The explicit consent texts are kept separate from this notice, in the explicit consent text. Saying no only turns off the feature concerned; the rest of the app keeps working.

Data is collected electronically, by automated or partly automated means: the iOS app, the Apple Watch app and widgets, the parent web dashboard, the contact form on this website, Apple Health (HealthKit) and iOS Location Services if you allow them, and the App Store for subscription status. A child's name and birth year are entered by the parent.

• Linked parent accounts: a person's data is visible only to them and their linked parents.
• Schools: only if a parent opts in, only as anonymous class averages and only when at least 10 students report.
• Processors: our hosting provider in the EU; website and web dashboard infrastructure (Cloudflare, Vercel); Apple (App Store payments, Sign in with Apple, push notifications); Google (Firebase Cloud Messaging for web notifications, optional Google sign-in); an email delivery provider; crash and server log monitoring. Current list: subprocessors.
• Public authorities: only where the law requires.

Transfers abroad (Art. 9)

Our servers are in the EU and some processors are in the United States, so your data is transferred abroad. Under Art. 9 as amended by Law No. 7499 and the Regulation on transfers of personal data abroad, we transfer:

• on the basis of an adequacy decision of the Board, where one exists for the destination;
• otherwise under an appropriate safeguard: the Board's standard contract (notified to the Board within 5 business days of signature), binding corporate rules approved by the Board, or a written undertaking authorised by the Board;
• and only where none of these is possible, in incidental, non-recurring cases under the exceptions of Art. 9(6), including explicit consent. We do not base regular transfers on consent.

Account deletion is irreversible; data is erased no later than 30 days after the request and also drops out of backups. When a parent deletes a member, that member's data is deleted too. Expired data is deleted, destroyed or anonymised.

By applying to the data controller, you have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties in Türkiye or abroad to whom it is transferred;
• request correction if it is incomplete or inaccurate;
• request erasure or destruction under the conditions of Art. 7;
• request that correction, erasure or destruction be notified to the third parties it was transferred to;
• object to a result against you arising from analysis exclusively by automated systems;
• claim compensation if you suffer damage from unlawful processing.

A parent or guardian applies on behalf of a minor.

The application methods, required information and form are in the data subject application form. In short: email privacy [at] earbunny.app from the address registered with us, or apply by KEP, secure electronic or mobile signature, in writing, or through the contact form. The app also offers Settings → Download my data and Delete account. We conclude applications free of charge within 30 days at the latest. If you are not satisfied with our answer you can complain to the Personal Data Protection Board (Art. 14).

When we update this notice we publish the new version here and announce material changes in the app and by email. If we add a new purpose or type of data, we ask for your explicit consent again. The effective date is at the top of the page.