This notice explains how the personal data of parents, teachers, institution admins, students and visitors using classbuff.com and the Classbuff applications is processed under Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. Data controller
The data controller is Pixbuff Bilişim Teknolojileri Ltd. Şti. (the "Company", "we"), located at İhsan Doğramacı Bulvarı, Üniversiteler Mahallesi, ODTÜ Teknokent ETKİM Binası, No:31, 06800 Çankaya/Ankara, Türkiye and registered with the [TRADE REGISTRY OFFICE] Trade Registry under number [REGISTRY NO].
When a school or institution uses Classbuff under an institutional licence, the institution is the data controller for its own students' data, and the Company is the data processor, processing this data on the institution's behalf and under its instructions. In this case, you can first direct requests about your rights to the institution.
2. Our commitments regarding children's data
Most people who use Classbuff are primary school children. That is why we always follow these rules for student data:
- We do not sell or rent student data.
- We do not use student data for advertising, behavioural advertising or targeting; we show no ads or calls to purchase on student screens.
- We use student data only to provide the game experience, record progress and prepare reports for the parent, teacher or institution.
- We never ask students for an email address, phone number, photo, voice recording, location or biometric data. A surname and school number are requested only when a teacher or institution creates a class list, to tell apart students with the same name, and are not shown on the student's login screen.
- We do not use student data to train artificial intelligence models and do not allow third parties to do so.
- We do not use deceptive design techniques that push children to share more information or play for longer.
- There are no public leaderboards and no messaging between students.
- At the request of the parent or institution, we delete the student profile and all data linked to it.
3. Personal data we process
| Group | Data category | Examples |
|---|---|---|
| Parent, teacher, institution admin | Identity and contact | Full name, email, phone (optional) |
| Account | Encrypted password; name and email shared by Google, Microsoft or Apple when signing in with them | |
| Professional | School name, province and grade level entered by the teacher when creating a class; institution name and job title | |
| Customer transactions | Orders, purchased packs, invoice details, support requests. Card details never reach the Company. | |
| Marketing | Your consent to commercial messages and your preferences (only if you have given consent) | |
| Student | Profile | First name or nickname, grade level, class, encrypted picture password; surname and school number if added by a teacher or institution |
| Learning data | Levels played, number of attempts, correct and incorrect moves, time, in-game items collected, homework status | |
| Device and session | App version, device type, session time (for debugging and security) | |
| Visitor | Transaction security | IP address, browser information, essential cookies. No game data is saved in the web demo. |
We do not process special categories of personal data (health, religion, ethnic origin, etc.); please do not write such information in profile names or support requests.
4. Purposes of processing
- Creating accounts, signing in and managing accounts,
- Running the games, recording progress and syncing it across devices,
- Providing learning reports to parents, teachers and institutions; enabling teachers to assign homework,
- Managing purchases and licences, and issuing invoices,
- Responding to support requests and sending mandatory service notifications,
- Keeping the service secure, preventing misuse and fixing errors,
- Producing anonymised, aggregate statistics to improve the games,
- Sending you campaign and news announcements if you have given consent,
- Fulfilling legal obligations and responding to requests from competent authorities.
5. Legal grounds
Your personal data is processed on the following legal grounds under Article 5 of the KVKK:
- Necessity for the formation or performance of a contract (membership, game service, reports, purchases),
- Fulfilment of a legal obligation (invoices, tax and commercial records, requests from public authorities),
- Establishment, exercise or protection of a right,
- Our legitimate interest, provided it does not harm your fundamental rights and freedoms (security, error fixing, anonymous statistics),
- Your explicit consent (sending commercial electronic messages and non-essential cookies). You may withdraw your explicit consent at any time.
6. Collection methods
Your data is collected by automatic or partly automatic means through forms on classbuff.com, the Classbuff mobile and tablet applications, the in-game recording system, sign-in with Google, Microsoft or Apple, App Store and Google Play purchase notifications, the payment institution and cookies.
7. Transfer of personal data
- Reports: A student's learning data is shared only with the parent who added that student, the teacher of their class and the institution they belong to. The report link opened with the in-game QR code is valid for 24 hours.
- Service providers: Hosting (Amazon Web Services), email delivery service [PROVIDER], payment institution [PAYMENT PROVIDER], e-invoice integrator [PROVIDER], sign-in providers (Google, Microsoft, Apple) and app stores (Apple App Store, Google Play). These providers process data only to provide services to us and only as limited by contract.
- Competent authorities: Public institutions and judicial authorities authorised by law, limited to their requests.
Apart from these, your data is never sold to or shared with any third party for marketing purposes.
8. Transfers abroad
Classbuff servers are located on Amazon Web Services infrastructure in the Frankfurt, Germany (eu-central-1) region. Some of our service providers (e.g. email and sign-in services) may process data abroad. These transfers are made in accordance with Article 9 of the KVKK, by [signing the standard contracts announced by the Board and notifying the Board].
9. Retention periods
- Account and student data: for as long as the account is open. When an account is deleted, the data is deleted or anonymised within [30] days.
- Student data under institutional licences: for the term of the institutional agreement and according to the institution's instructions.
- Invoices and commercial records: for the statutory periods under the Turkish Commercial Code and the Tax Procedure Law (up to 10 years).
- Commercial message consent records: 3 years from the end of the consent.
- QR report links: 24 hours.
- Security and system logs: [PERIOD].
10. Security
Your data is encrypted in transit (HTTPS); passwords are stored in irreversible form; only authorised people can access student data, and access is logged. In the event of a data breach, we inform the people concerned and the Personal Data Protection Board within the period set by law.
11. Your rights under Article 11 of the KVKK
- To learn whether your personal data is processed and, if so, to request information about it,
- To learn the purpose of processing and whether it is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom it is transferred,
- To request correction if it is incomplete or inaccurate, deletion or destruction if the reasons for processing no longer exist, and notification of these actions to the third parties to whom it was transferred,
- To object to a result against you arising from analysis exclusively by automated systems,
- To claim compensation if you suffer damage due to unlawful processing.
Parents may exercise these rights on behalf of their children for their children's data. You can send your request from your registered email address to classbuff@gmail.com, to our KEP address pixbuffbilisim@hs01.kep.tr, or in writing to our company address. Requests are resolved free of charge within 30 days at the latest; if the action involves an additional cost, the fee set by the Board may be charged.
12. Cookies
classbuff.com uses essential cookies to keep you signed in and remember your language preference. Non-essential cookies, such as visit statistics, only run if you give consent. For details, see the [Cookie Policy] page. No advertising or tracking cookies are used in the student area.
13. Changes and contact
We may update this notice in line with legal or service changes. We announce material changes by email and a notice on the site; the current version is always on this page.
- Company name: Pixbuff Bilişim Teknolojileri Ltd. Şti.
- Address: İhsan Doğramacı Bulvarı, Üniversiteler Mahallesi, ODTÜ Teknokent ETKİM Binası, No:31, 06800 Çankaya/Ankara, Türkiye
- Phone: +90 505 262 08 11
- Email: classbuff@gmail.com
- KEP: pixbuffbilisim@hs01.kep.tr