GDPR & KVKK — Your Data Rights
This page summarises how BandUp handles personal data under the EU/UK General Data Protection Regulation (GDPR) and Türkiye’s Personal Data Protection Law (KVKK, Law No. 6698), and how you can exercise your rights. It is a summary — the full detail is in our Privacy Policy.
Data controller. BandUp determines how and why your personal data is processed. To exercise any right below, email privacy@band-up.app.
What we process and why
We process your account details, the voice recordings and transcripts from your mock exams, your scores and progress, and basic usage and device data — in order to provide the Service, manage your subscription, keep the Service secure, and meet our legal obligations. The legal bases we rely on (contract, consent, legitimate interests and legal obligation) are described in Privacy Policy §4. Details of the providers that process data on our behalf are in §6, and international transfers in §7.
Your rights
Subject to the conditions in the GDPR and KVKK, you have the right to:
- Access — obtain confirmation of whether we process your data, and a copy of it;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — have your data deleted (“right to be forgotten”);
- Restriction — limit how we process your data in certain cases;
- Objection — object to processing based on our legitimate interests;
- Portability — receive the data you gave us in a portable, machine-readable format;
- Withdraw consent — at any time, where processing is based on consent (for example, microphone access or notifications);
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our band scores are practice estimates and are not used to make such decisions about you.
How to exercise your rights
You can exercise erasure and portability yourself, instantly, in the app: Settings → Delete account deletes your account and can first email you a copy of your band reports and transcripts as a machine-readable archive — see Account & Data Deletion. For everything else, email privacy@band-up.app from the address linked to your account. We will respond within the timeframe required by law (generally one month under the GDPR; 30 days under the KVKK).
Complaints
If you believe we have not handled your data properly, you may lodge a complaint with your supervisory authority. In the EEA/UK this is your national data protection authority; in Türkiye it is the Personal Data Protection Authority (KVKK / KVKK Kurumu). We would appreciate the chance to address your concern first.