Privacy Notice on the Protection and Processing of Personal Data

1. IDENTITY OF THE DATA CONTROLLER

The data controller with respect to your personal data is:

Company name: Lornova L.L.C.

Company type: Limited Liability Company

Unique identification number: 812441690

Registered address: Ukshin Hoti, No: 51, Prishtinë, Republic of Kosovo

Email: info@istanbulalgoritma.com

Phone: +90 212 993 01 11

Lornova L.L.C. is a limited liability company established and operating under the legislation of the Republic of Kosovo.

2. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the nature of your relationship with our company, all or some of the following categories of personal data may be processed.

2.1. Identity information
First name, last name, date of birth, age, identity card or passport details, and identity information of students and parents.

2.2. Contact information
Phone number, email address, residential address, billing address and other contact information.

2.3. Education information
Course enrollments, the student’s age and level of education, attendance status, lesson performance, homework, projects, exam and assessment results, teacher feedback and educational preferences.

2.4. Customer transaction information
Course applications, contract information, educational programs purchased, trial lesson enrollments, records of requests and complaints, and customer service conversations.

2.5. Financial information
Invoice information, payment status, transaction date, payment method and accounting records.

Where credit or debit card details are processed directly by the payment service provider, our company may not have access to your full card number or may not store this information in its own systems.

2.6. Digital transaction and security information
IP address, device information, login and logout records, cookie information, website or educational platform usage data, error logs and information security records.

2.7. Visual and audio information
Photographs, videos, online lesson footage, audio recordings, event footage and security camera recordings.

2.8. Employee and job applicant information
Résumés, education and professional experience information, references, application and interview records, and employment, payroll and personnel file information.

2.9. Sensitive personal data
Health information or other sensitive personal data are processed only to the extent necessary for the provision of the service, provided that an appropriate legal basis exists and additional security measures are applied.

3. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data may be processed for the following purposes:

Providing educational and consultancy services,

Creating student and course participant records,

Directing students to educational programs suited to their age and level,

Planning and conducting online or in-person lessons,

Monitoring student progress and lesson attendance,

Ensuring communication between parents, students, instructors and the company,

Organizing trial lessons, training sessions, seminars and events,

Creating user accounts and providing access to educational platforms,

Providing technical support and customer services,

Concluding and performing contracts,

Carrying out payment, invoicing and accounting operations,

Evaluating requests, questions, objections and complaints,

Measuring and improving service quality,

Ensuring the security of the website, mobile application and digital platforms,

Preventing unauthorized access, fraud and misuse,

Establishing, exercising or protecting the company’s legal rights,

Complying with lawful requests from competent public authorities,

Fulfilling obligations arising from tax, accounting, commercial, consumer and education legislation,

Carrying out human resources, recruitment and employee management processes,

Carrying out promotional, campaign and direct marketing activities where explicit consent or another appropriate legal basis exists.

4. LEGAL BASES FOR PROCESSING PERSONAL DATA

Your personal data may be processed on the basis of one or more of the following legal bases under Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo.

4.1. Explicit consent
Where the data subject has given consent that is specific, informed and freely given.

Where processing is based on consent, the data subject may withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.2. Conclusion or performance of a contract
Where the processing of personal data is necessary for the conclusion or performance of an education, membership, consultancy or service contract.

4.3. Legal obligation
Where processing is necessary for our company to fulfill its obligations arising from accounting, tax, employment, commercial, consumer, education and other legislation.

4.4. Protection of vital interests
Where processing is necessary to protect the life or physical integrity of the data subject or of another natural person.

4.5. Public interest and requests from competent authorities
Operations carried out in the public interest in cases provided for by law, or compliance with lawful requests from competent public authorities.

4.6. Legitimate interest
Where processing is necessary for the legitimate commercial, operational, legal or security interests of our company, provided that it does not disproportionately interfere with the fundamental rights and freedoms of the data subject.

5. PERSONAL DATA OF CHILDREN

A significant part of our company’s educational services is intended for children. For this reason, children’s personal data are processed with due regard to the best interests, safety and fundamental rights of the child.

Where necessary, depending on the child’s age and the nature of the service provided, personal data are collected with the knowledge and approval of the parent or legal representative.

Children’s personal data are processed only for the purposes of:

Providing the educational service,

Creating the student record,

Ensuring student safety,

Monitoring the student’s progress and attendance,

Conducting communication with parents,

Providing technical support,

Fulfilling legal obligations

and only to the extent necessary.

Where required, separate permission is obtained from the parent or legal representative for the use of children’s photographs, videos, audio recordings, projects or work for advertising, social media, promotional or reference purposes.

6. METHODS OF COLLECTING PERSONAL DATA

Your personal data may be collected by automated or non-automated means through the following channels:

The website,

Educational and membership platforms,

Mobile applications,

Online application and enrollment forms,

Phone, email and messaging applications,

Social media accounts,

Online or in-person meetings,

Trial lessons and educational activities,

Contracts and printed forms,

Payment and invoicing systems,

Cookies and similar technologies,

Security cameras,

Business partners and service providers,

Competent public authorities and legally accessible databases.

7. TRANSFER OF PERSONAL DATA

Your personal data may be transferred to the following groups of recipients, provided that this is necessary to carry out the relevant operation and that an appropriate legal basis exists:

Educational platform and software service providers,

Cloud storage, server and data center service providers,

Payment institutions and banks,

Accounting and financial service providers,

Law, audit and consultancy firms,

Instructors and educational service providers,

Customer communication and technical support service providers,

Advertising and marketing service providers,

Business partners and suppliers,

Affiliated or related companies,

Competent public authorities,

Courts, law enforcement authorities and other competent bodies.

In every transfer, the principle is to share only the minimum personal data necessary for the purpose of the transfer.

8. TRANSFER OF PERSONAL DATA OUTSIDE KOSOVO

Because of the online educational platforms, cloud services, customer relationship systems, and email, communication, payment, advertising or technical support systems used by our company, your personal data may be processed by service providers located in countries outside Kosovo.

Conditions for transferring personal data outside Kosovo:

The country or international organization to which the data are transferred provides an adequate level of data protection,

Appropriate protection mechanisms accepted by the competent supervisory authority are in place,

Appropriate contractual, technical and organizational safeguards have been established,

One of the exceptions set out in the law applies,

Authorization has been obtained from the competent authority where required

Transfers of personal data outside Kosovo are carried out in compliance with these conditions.

Because of activities carried out with students, parents, instructors and service providers located in Türkiye, personal data may be transferred between Türkiye and Kosovo. When these transfers are carried out, the applicable personal data protection legislation of both countries is taken into account.

9. RETENTION PERIOD OF PERSONAL DATA

Retention periods for your personal data:

The period necessary for the purpose of processing,

The term of the education or service contract,

The retention periods prescribed by accounting, tax, commercial, consumer and labor legislation,

The limitation periods applicable to potential legal disputes,

The periods prescribed by the competent authorities

Your personal data may be retained for these periods.

When the retention period expires or the purpose of processing ceases to exist, personal data are, in accordance with the relevant legislation, erased, destroyed or anonymized, or access to them is restricted.

10. SECURITY OF PERSONAL DATA

Protection of personal data against:

Unauthorized access,

Unlawful use,

Alteration,

Loss,

Disclosure,

Damage,

Destruction

Our company takes appropriate technical and organizational measures for this purpose.

Depending on the nature of the data processed and the risk involved, these measures may include the following:

Authorization and access control,

Strong password and authentication systems,

Data encryption,

Firewall and malware protection,

Keeping system and access logs,

Regular data backups,

Staff confidentiality obligations,

Concluding data protection agreements with service providers,

Implementing data breach response procedures,

Carrying out regular security and authorization checks.

11. RIGHTS OF THE DATA SUBJECT

Under Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo, data subjects have the following rights:

To learn whether their personal data are being processed,

To access the personal data processed,

To request a copy of the personal data,

To request the rectification of inaccurate or incomplete personal data,

To request the erasure of personal data where the legal conditions are met,

To request the restriction of the processing of personal data,

To request that any rectification, erasure or restriction be notified to the persons to whom the data have been transferred,

To object to the processing of personal data in certain situations,

To object at any time to processing carried out for direct marketing purposes,

To request the portability of personal data where applicable,

To withdraw consent for processing based on consent,

To object to decisions based solely on automated processing or profiling that produce significant effects concerning them,

To claim compensation for damage suffered as a result of the unlawful processing of personal data,

To lodge a complaint with the Information and Privacy Agency of Kosovo,

To seek legal remedies before the competent courts.

12. DIRECT MARKETING AND COMMERCIAL COMMUNICATIONS

Where required by the relevant legislation, the processing of your personal data for campaign, advertising, promotional or commercial communication purposes is subject to your consent or to other appropriate legal bases.

You may notify our company at any time that you do not wish to receive electronic messages.

You have the right to object at any time to the processing of personal data carried out for direct marketing purposes. Once your objection has been received, your personal data will not be used for direct marketing purposes.

13. AUTOMATED DECISION-MAKING AND PROFILING

Except where permitted by law, our company does not use decisions taken solely by automated systems that produce legal effects or similarly significant effects concerning the data subject.

Where automated recommendations are provided regarding the educational program, age group or student level, human intervention and assessment are ensured where necessary.

The data subject may request information about automated decision-making processes and may object to such processing under the conditions set out in the relevant legislation.

14. METHOD OF APPLICATION

You may submit your requests concerning access, rectification, erasure, restriction or objection, or other requests relating to your personal data, to our company through the following communication channels.

Address for applications by post or in person — Lornova L.L.C.

Ukshin Hoti, No: 51

Prishtinë, Republic of Kosovo

Electronic applications — Email: info@istanbulalgoritma.com

Phone: +90 212 993 01 11

Your application may be required to include the following information:

Your full name,

Information sufficient to verify your identity,

Your contact details,

A clear and understandable description of your request,

Any information and documents supporting your request.

Our company may request additional information or documents in order to verify the applicant’s identity and to prevent the unauthorized disclosure of personal data belonging to third parties.

Applications are answered in accordance with the time limits and procedures set out in Law No. 06/L-082 of the Republic of Kosovo.

15. COMPLAINT TO THE INFORMATION AND PRIVACY AGENCY

If you believe that your personal data are being processed unlawfully, you may first contact Lornova L.L.C.

The competent personal data protection and supervisory authority of the Republic of Kosovo is:

Agjencia për Informim dhe Privatësi

Information and Privacy Agency – AIP

You also have the right to lodge a complaint with this authority.

16. CHANGES TO THIS PRIVACY NOTICE

Our company may amend this Privacy Notice due to changes in legislation, new developments in its services, changes to the information systems used, or updates to its personal data processing activities.

The current version enters into force on the date it is published on our company’s website or relevant digital platforms.

LORNOVA L.L.C.

Unique Identification Number: 812441690

Address: Ukshin Hoti, No: 51, Prishtinë, Republic of Kosovo

Email: info@istanbulalgoritma.com

Phone: +90 212 993 01 11

ANNEX: COOKIES AND SIMILAR TECHNOLOGIES

This annex describes the cookies used on the istanbulalgoritma.com website and similar records stored in the browser. The digital transaction information in Section 2.6 of the Notice and the “cookies and similar technologies” in Section 6 cover the use described in this annex.

Strictly necessary records. The following are necessary for the operation and security of the site; they do not depend on your consent and are not used for measurement or advertising. Their legal bases are the conclusion of a contract (Section 4.2) and legitimate interest (Section 4.6).

Your cookie preference: Your choice of “Accept” or “Reject” is stored in your browser’s local storage under the name “ia_cerez” and remains there until you or your browser deletes it. This record is not sent to the server.

Delivery of the site: The site is served through Cloudflare’s infrastructure. When pages are requested, your IP address and browser information are processed by Cloudflare in order to deliver the page to you and to protect the site against attacks.

Form security: Cloudflare Turnstile verification runs on the forms to prevent misuse; in the process, your IP address and your browser and device information are processed by Cloudflare. Cloudflare may also process the data it handles for delivering the site and for form security in countries outside Kosovo and Türkiye (including the United States); this transfer is subject to Section 8 of the Notice.

Discovery Program flow: On the Discovery Program pages, your answers, your position in the flow, the group you selected and your order link are kept in the browser’s session storage until the tab is closed, so that they are not lost when the page is refreshed.

Discovery Program measurement. Until the tab is closed, the Discovery pages also keep the following in session storage: a random session identifier specific to the tab, the page version shown to you, the topic of the ad you came from and the campaign information of the link. The steps viewed are recorded, together with this information, only on our own server; if you make a purchase, these records are matched with your order. The purpose is to measure whether the ads and page versions are effective. These records are not among the strictly necessary records; their legal basis is legitimate interest (Section 4.6). Details are set out in the Discovery Program privacy notice (available in Turkish only).

Measurement and advertising cookies (only with your consent). If you select “Accept”, Google Tag Manager is loaded and Google Analytics 4 runs. Using cookies whose names begin with “_ga”, Google Analytics measures the pages visited, the link through which you came to the site, the time spent on the page, the device and browser type, and your approximate location derived from your IP address. The default duration of these cookies, as set by Google, is two years; user-level and event-level measurement data are deleted in Google Analytics after 14 months.

When a form is submitted, Google is notified of the type of form and of selection information such as the chosen subject area and course; the name, phone number and email address you enter in the forms and your child’s age are not sent to Google.

If you have given your consent, the Google tag may also set cookies whose names begin with “_gcl_” (e.g., “_gcl_au”) to measure the effectiveness of ads; their default duration, as set by Google, is 90 days. We do not currently use Google Ads conversion measurement; this annex will be updated when we start doing so. Your consent is not used for personalized advertising or remarketing; this permission is turned off in all cases.

Unless you select “Accept”, these tools are not loaded and the pages do not send requests to Google; not giving your consent does not affect your use of the site. On the payment page, these tools are not loaded even if you have given your consent. The legal basis for measurement and advertising cookies is your explicit consent (Section 4.1). Google may process these data in countries outside Kosovo and Türkiye (including the United States); this transfer is subject to Section 8 of the Notice.

Changing your preference. You can change your decision using the “Cookie preferences” link at the bottom of every page. When you withdraw your consent, the page reloads, measurement stops and the cookies that Google has set on this site are deleted from your browser. You can also delete or block cookies in your browser settings.

Google Tag Manager and Google Analytics do not run on the Discovery Program pages. If a Meta cookie begins to be used on these pages for ad measurement, your permission will be requested there through a separate panel and your preference will be stored in local storage under the name “kesif_cerez”; for details, see the Discovery Program privacy notice (available in Turkish only).

When a new measurement or advertising tool is added, this annex will be updated and, if necessary, your consent will be requested again. Last updated: 30 September 2026.