Buu Mobile Application Privacy Policy

BUÜ Mobile Application Privacy Policy

Last Updated: July 25, 2026

Bursa Uludağ University ("BUÜ") values the privacy and security of its users' personal data. This Privacy Policy explains what information is processed while using the BUÜ Mobile Application, the purposes for which it is processed, how it is protected, and the rights of users regarding their personal data.

By using the BUÜ Mobile Application, you are deemed to have accepted the terms set forth in this Privacy Policy.

1. Data Controller

Pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is:

Bursa Uludağ University

Department of Information Technologies

2. Purpose of the Application

The BUÜ Mobile Application provides all users with access to:

University announcements
News
Events
Dining hall menus

Users who sign in with their institutional accounts may also access only their own student or personnel information available in the University's information systems, within the scope of their authorization.

3. Information We Process

3.1 Use Without Signing In

The application can be used without signing in.

In this case, users may access publicly available content such as:

News
Announcements
Events
Dining hall menus

No personal data requiring user authentication is processed during this type of use.

3.2 Use After Signing In

When users sign in using their institutional accounts, the following information may be processed.

For Students

Student ID number
Full name
Faculty or academic unit
Academic program
Course information
Examination information
Grades
Grade Point Average (GPA)
Tuition information
Other academic information available through the student information system

For Personnel

Personnel ID number
Full name
Academic or administrative title
Personnel type
Assigned department
Employment start date
Leave information
Remaining leave balance
Leave history
Institutional position information

This information is securely retrieved from the relevant University information systems solely for display to the authenticated user.

4. Authentication

Users sign in through:

Bursa Uludağ University institutional account
The University's authentication system

The application does not store users' passwords.

After successful authentication, a JWT Access Token generated by the server is used.

This token:

is unique to the authenticated user,
remains valid for a maximum of seven (7) days,
automatically expires when its validity period ends.

Users must sign in again after the token expires.

5. Push Notification Service

Users may choose to receive mobile notifications.

For this purpose:

Firebase Cloud Messaging (FCM) or equivalent notification services provided by the mobile platform may be used.
Notification tokens are used solely for delivering official University notifications to users.

Notification tokens are not used for advertising, marketing, or third-party analytics.

6. Purposes of Processing Personal Data

Personal data is processed for the following purposes:

Authenticating users
Providing student information services
Providing personnel information services
Delivering University announcements and notifications
Ensuring system security
Preventing unauthorized access
Maintaining service continuity
Managing information security processes
Complying with legal obligations

7. Sharing of Personal Data

Personal data processed through the BUÜ Mobile Application:

is not used for commercial purposes,
is not sold to third parties,
is not shared with advertising companies,
is not used for marketing activities.

Personal data may only be disclosed:

where required by applicable legislation,
upon lawful requests from authorized public authorities,
for the fulfillment of legal obligations.

8. Data Security

Bursa Uludağ University implements appropriate technical and administrative measures to ensure the:

confidentiality,
integrity,
availability

of personal data.

These measures include:

Secure communication via HTTPS
Authentication mechanisms
Authorization controls
JWT-based access management
Server-side access logging
Compliance with the University's Information Security Policies

9. Rights Under the Turkish Personal Data Protection Law (KVKK)

Pursuant to Article 11 of the Turkish Personal Data Protection Law No. 6698, users have the right to:

Learn whether their personal data is being processed
Request information regarding processed personal data
Request correction of incomplete or inaccurate personal data
Request deletion or destruction of personal data where the legal conditions are met
Object to the processing of their personal data
Claim compensation for damages arising from unlawful processing of personal data

10. Cookies and Tracking Technologies

The BUÜ Mobile Application:

does not perform advertising tracking,
does not analyze user behavior for marketing purposes,
does not use third-party advertising SDKs.

Secure authentication tokens are used solely for maintaining authenticated user sessions.

11. Children's Privacy

The BUÜ Mobile Application is intended for use by Bursa Uludağ University students and personnel.

The application does not knowingly collect personal data from children who are not affiliated with the University.

12. Information Security Policies

The BUÜ Mobile Application operates in accordance with:

Turkish Personal Data Protection Law No. 6698 (KVKK)
Other applicable legislation
Bursa Uludağ University Information Security Policies
Bursa Uludağ University Information Resources Usage Policy

13. Changes to This Privacy Policy

This Privacy Policy may be updated when necessary.

Any updated version becomes effective as of the date it is published.

14. Contact

If you have any questions regarding this Privacy Policy, you may contact us using the following information: