General Data Protection Regulation (GDPR) Compliance
Last updated: 13 October 2026
Everything you need to know about The Globals' GDPR compliance.
Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi is committed to privacy, security, compliance and transparency. This approach includes supporting our customers' compliance with EU data protection requirements, including those set out in the General Data Protection Regulation ("GDPR"), in force since 25 May 2018.
What is GDPR?
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU).
Is The Globals GDPR compliant?
The Globals is compliant with the GDPR. Website analytics (Firebase Analytics / Google Analytics 4, measurement ID G-0PWTEC5K46) is consent-first: Consent Mode defaults to denied and analytics only runs after the visitor opts in via the cookie banner. Consent can be withdrawn at any time through the “Cookie preferences” footer link.
For school accounts, Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi acts as a data processor on behalf of the school (the controller); for the public marketing site, we act as controller. Our legal bases are contract performance (Art. 6(1)(b)) for providing the service, legitimate interests (Art. 6(1)(f)) for security and strictly necessary operations, and consent (Art. 6(1)(a)) for analytics and other non-essential cookies.
Information We Hold
Data categories, purposes and legal bases
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Identity & contact (name, username, email, school/class) | Account creation, authentication, membership management, service delivery, communications | Contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)) |
| Learning & performance (scores, completion, progress, teacher/school reports) | Learning tracking, teacher/school reporting, personalised recommendations | Contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)) |
| Technical & usage (IP, device/browser, coarse location, analytics — opt-in) | Security, debugging, performance monitoring, website analytics (consent-first) | Legitimate interests (Art. 6(1)(f)), consent — analytics only (Art. 6(1)(a)) |
| Visual & audio (special category) Assignment videos, project uploads, microphone recordings | Assignment/assessment workflow, teacher review, (opt-in) leaderboard display | Explicit consent (Art. 9(2)(a)) — optional, freely withdrawable |
Registration and Contact Information
We collect information about you when you (a) register to use the Services and (b) otherwise provide contact information to us via email, mail, or through our Service. This information you provide may include your username, first and last name, email address.
Technical, Usage and Location Information
We automatically collect information on how you interact with the Service, such as the IP address from which you access the Service, date and time, and referrer / campaign information ("utm" fields). We may also collect coarse location information derived from your connection. If you consent to Analytics, Firebase Analytics (Google Analytics 4) records pseudonymous usage events such as pages visited, session duration, and device/browser type; IP addresses are not stored in a form that identifies you, and analytics data is retained for up to 14 months. We use cookies and similar technologies to collect some of this information. For more information, please see The Globals' Cookie Policy.
School leaderboards
We process ranking data so a school can see its own standings on the website and in the mobile app. Students, parents, teachers, and school admins see only their own school. Campus groups (e.g., Greenfield Academy with campuses like Greenfield North Campus</code>, <code>Greenfield South Campus</code>, <code>Greenfield Central) are shown together as a single group (e.g., Greenfield Academy (Greenfield North Campus, Greenfield South Campus, Greenfield Central)). A campus board stays limited to that campus within the same school (e.g., Greenfield North Campus (Greenfield Academy)). A parent's view follows the linked child. System administrators can see a worldwide board to operate the service.
Leaderboard names are shortened to first name + first letter of surname (e.g., Emma T.). Full names stay on class lists, profiles, and reports the school may access. Public pages do not show these boards.
Explicit consent (Art. 9(2)(a)) for visual/audio content: If a student (or parent) consents to video/voice/project uploads, their name, avatar, and Jupas score may appear in school-level leaderboards. This is entirely optional and can be withdrawn anytime via "Cookie preferences" in the footer. Without consent, students are anonymised or excluded from leaderboards.
Student assignment content: video, project uploads, and microphone input
Some assignments ask the student for input in the form of video recordings, project or file uploads, and audio recorded via microphone access. The student provides this content voluntarily as part of completing the assignment. Microphone and camera access is used only when the student chooses to record or submit a spoken or video answer; we do not listen in the background or record outside of an assignment submission the student actively makes.
- Retention: assignment videos, project uploads, and microphone recordings are kept until the end of membership access and deleted afterwards.
- Access: each submission is accessible only by the submitting student and their own teacher, strictly for review and grading purposes.
- No external processing or sharing: assignment content is not processed externally, not shared with third parties, and not accessible by anyone else — it is never used for advertising, analytics, or model training.
Legal basis for assignment content is contract performance (Art. 6(1)(b)) — providing the teaching service — and, for students, the school's instruction as controller. Unlike general account data (retained up to 2 years after trial expiry or cancellation for administration), assignment videos, project uploads, and microphone recordings are kept only until the end of membership access and deleted afterwards, and are never shared with sub-processors for external processing.
Third Party Platforms
We may collect information when you interact with our service on third-party sites or platforms, such as analytics providers. This may include information such as actions or the fact that you viewed or interacted with our content.
Personal data is shared with the following categories of recipients under data processing agreements (Art. 28 GDPR). Transfers outside the EEA (e.g., US) are protected by Standard Contractual Clauses:
| Recipient category | Purpose | Legal basis |
|---|---|---|
| Cloud infrastructure & hosting (Google Firebase, AWS S3) | Authentication, database, file storage, analytics (opt-in) | Contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)) |
| Video/CDN provider (Vimeo) | Educational video playback (student submissions not uploaded to Vimeo) | Contract performance (Art. 6(1)(b)) |
| Error monitoring & performance (Sentry) | Error reporting, performance measurement | Legitimate interests (Art. 6(1)(f)) |
| Email & communications (Resend, MailerLite) | Transactional and product-update emails | Contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)) |
| Payment processors (Stripe, RevenueCat) | Subscription payment processing | Contract performance (Art. 6(1)(b)) |
| Public authorities (where legally required) | Legal obligations, regulatory requests | Legal obligation (Art. 6(1)(c)) |
| Public leaderboards (opt-in) | Name, avatar, Jupas score, school/class in leaderboard display | Explicit consent (Art. 9(2)(a)) — optional, withdrawable |
Assignment videos, project uploads, and microphone recordings are never shared with sub-processors for their own purposes.
Data collection methods
Personal data is collected through appropriate, proportionate methods for the stated purposes (Art. 5(1)(b) GDPR):
| Method | Description | Data categories |
|---|---|---|
| Web/mobile app (electronic) | Registration forms, login, settings panels, cookie consent banner, analytics (opt-in) | Identity, contact, technical, usage data |
| Provided by school/teacher | Class rosters, student profiles, assignment mappings (processor role) | Identity, learning data |
| Student-initiated assignment submission Camera / microphone / file picker | Student voluntarily records video, audio, or uploads files (after explicit consent) | Visual & audio (special category, Art. 9) |
| Automated technical collection | IP address, device/browser fingerprints, error reports, performance metrics | Technical & security data |
Data security measures (Art. 32 GDPR)
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:
| Measure | Description |
|---|---|
| Encryption in transit | All communications use HTTPS/TLS 1.2+; Firebase and API traffic encrypted end-to-end |
| Encryption at rest | Firestore, Cloud Storage, S3 data encrypted with AES-256 |
| Access control | RBAC, least privilege; teachers see only their class, students only their own data |
| Authentication | Firebase Auth (email/password, Google, Apple); MFA ready; session management |
| Network security | VPC isolation, WAF, DDoS protection, security groups, private subnets |
| Monitoring & logging | Sentry (errors), Cloud Logging (access), audit trails; anomaly detection |
| Backup & recovery | Automated daily backups, multi-regional replication, RPO < 24s, RTO < 1h |
| Personnel security | Confidentiality agreements, training, authorised personnel list, offboarding procedures |
| Sub-processor management | DPAs (Art. 28), security assessments, SOC 2 / ISO 27001 / PCI DSS where applicable |
| Incident response | 72-hour supervisory authority notification, affected user communication, root cause analysis, corrective actions |
Data security and data breaches
We take data protection and security very seriously at The Globals. We constantly monitor for security flaws and unauthorized access and we will take action immediately if something suspicious is detected. In the unlikely case of a personal data breach, we will notify the competent supervisory authority within 72 hours where required and inform affected customers without undue delay.
Some of the preventive measures we take include:
- Encrypted HTTPS communication layers for all data transfers
- Isolated data containers and data network
- Multiple encrypted backups at database and disk level, stored for one week
- Data retention for expired trial and cancelled users of 2 years
Data subject rights
All individual rights regarding GDPR are handled by our The Globals team. To exercise your rights, email us at destek@macenta.com.tr from the address associated with your account and describe your request. We respond within one month.
Those rights include:
- Right To Be Informed: where we act as a controller, we inform our users what we do with their data.
- Right To Access: we can show all data stored.
- Right To Object: you can object to how The Globals processes your personal data, including withdrawing analytics consent at any time via “Cookie preferences”.
- Right To Restriction: you can ask us to limit processing in certain cases while a request is reviewed.
- Right To Be Forgotten: we can erase data we hold about any individual.
- Right To Data Portability: we can export data held about an individual as a CSV on request.
- Right To Rectification: a person's data can be updated either by API, from the user account or manually by us on request.
You also have the right to lodge a complaint with your local data protection supervisory authority.
Data Processing Agreements
We act as a data processor for schools (controller) and provide a template Data Processing Agreement (GDPR Art. 28 / KVKK) with details of processing, sub-processors, transfers (SCCs), security measures (Art. 32 / KVKK m. 12), breach notification (48h to controller), audit, and deletion / return terms. Fill in Annex 1 – Table A, sign, and email a copy to us — we countersign and return.
If you are a customer (paid user) of The Globals and you need a countersigned DPA, please contact us via email and we'll send it to you ASAP. We also requested and signed DPAs from our sub-processors and made sure they are GDPR compliant.
Additional security measures
HTTPS Encryption
All The Globals hosted accounts run over a secure connection using the HTTPS protocol. Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. It means all communication between your browser and The Globals is encrypted.
Secure credential storage
We follow latest best practices to store and protect user login credentials and passwords in the cloud.
Do you have questions?
You can exercise your rights or contact our Data Protection Officer via:
- E-mail: destek@macenta.com.tr (from your registered account e-mail)
- KEP: macenta@hs01.kep.tr
- Post: Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi, Istanbul, Türkiye
We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority.
All school names, campus names, and student names used in this document are fictional examples for illustrative purposes only. They do not represent any real educational institutions or individuals.
© 2026 Macenta Publishing & Digital Solutions