Privacy Policy

Last Updated: March 26, 2026

1. Introduction

At Catalyst Education & Research Inc. ("Catalyst Education", "we", "us"), we are committed to protecting your personal information. This Privacy Policy explains what personal data we collect when you visit our website, apply for our services, or enrol in our programs, how we use it, with whom we share it, and what rights you have.

This Privacy Policy has been prepared in compliance with our obligations under Turkey's Personal Data Protection Law No. 6698 (KVKK) for users in Türkiye, the General Data Protection Regulation (GDPR) for users in the European Union, and the Personal Information Protection and Electronic Documents Act (PIPEDA) for Canadian users.

2. Personal Data We Collect

2.1 Information You Provide Directly

2.2 Automatically Collected Information

• IP address and browser type
• Operating system and device information
• Pages visited and access durations
• Data collected via cookies and similar technologies

For detailed information on cookies, please refer to our Cookie Notice.

2.3 Information from Third Parties

• From schools or counsellors you have listed as references
• From payment processing partners (transaction confirmation only)
• From advertising platforms such as Google/Meta (anonymised demographic data only)

3. Purposes of Processing Personal Data

Service Delivery

• Managing OSSD programme applications and enrolment
• Monitoring student progress and providing academic support
• Maintaining communication with parents/guardians

Communication and Marketing

• Sending informational emails about programmes and services
• Marketing communications based on your explicit consent
• Providing customer support

Legal Obligations

• Meeting tax, accounting, and regulatory requirements
• Responding to requests from competent authorities

Website Improvement

• Analysing and enhancing the user experience
• Identifying and resolving technical issues

4. Legal Basis for Processing

For users under KVKK:

• Explicit consent (Article 5/1)
• Necessity for the establishment or performance of a contract (Article 5/2-c)
• Legitimate interest (Article 5/2-f)
• Fulfilment of a legal obligation (Article 5/2-ç)

For users under GDPR:

• Consent (Article 6/1-a)
• Performance of a contract (Article 6/1-b)
• Legal obligation (Article 6/1-c)
• Legitimate interests (Article 6/1-f)

5. Sharing of Personal Data

Service Providers: Technical service providers such as email platforms, payment infrastructure, CRM, and student management systems (pursuant to data processing agreements).

Ontario Education Authorities: Where legally required in connection with the administration and accreditation of the OSSD programme.

Legal Requirement: In response to a court order, legal regulation, or competent authority request.

Corporate Change: In the event of a company merger, transfer, or asset sale (subject to this Policy remaining in effect).

We do not sell or rent your personal data to third parties for commercial purposes.

6. International Data Transfers

• Under KVKK Article 9, based on your explicit consent or the list of countries with adequate protection as determined by the Personal Data Protection Authority.
• Canada is considered a country with an adequacy decision under GDPR.

Where our service providers are located outside Canada or the European Economic Area (EEA), appropriate safeguards (such as Standard Contractual Clauses) are applied.

7. Data Retention Periods

Data that has exceeded its retention period is securely deleted or anonymised.

8. Data Security

• SSL/TLS encryption for secure data transmission
• Access restrictions and authorisation controls
• Regular security testing and updates
• Staff privacy training
• Data breach response plan

However, we note that no data transmission over the internet is 100% secure.

9. Your Rights

Your Rights under KVKK (Article 11)

• To learn whether your personal data has been processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is being used in accordance with that purpose
• To know the third parties to whom data is transferred, domestically or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction of data under KVKK Article 7
• To request notification of correction and deletion to third parties
• To object to a result arising from automated analysis of processed data
• To claim compensation for losses arising from unlawful processing of data

Additional Rights under GDPR

• Right to data portability
• Right to restriction of processing
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with a supervisory authority

How to Exercise Your Rights

You may submit your requests by emailing info@catalysteducation.ca. Requests will be responded to within 30 days. Identity verification may be requested.

10. Cookies

We use cookies and similar technologies on our website. For information about cookie types, their purposes, and how to manage your preferences, please refer to our Cookie Notice.

11. Children's Privacy

Our services are not directed at individuals under the age of 18. We only process data relating to minors with parental or guardian consent and within the scope of the OSSD programme.

12. Policy Changes

This Privacy Policy may be updated from time to time. Significant changes will be announced on the website and notified to your registered email address.

13. Contact and Complaints

Users in Türkiye may also submit requests and complaints to the Personal Data Protection Authority (KVKK): kvkk.gov.tr

EU users may lodge a complaint with the Data Protection Authority (DPA) in their country of residence.

Canadian users may contact the Office of the Privacy Commissioner of Canada: priv.gc.ca