Bu hukuki metin yalnızca İngilizce olarak mevcuttur.
Last updated: October 2026
The website is hosted by Cloudflare, Inc. (San Francisco, USA). When you visit it, Cloudflare processes technically necessary data such as your IP address, the time and the page requested, in order to deliver the site and protect it against abuse (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or on standard contractual clauses.
The website sets only two cookies, both technically necessary: a login
cookie when you sign in, and a language cookie (pp_lang, kept for one
year) when you choose a language, so that the next page opens in that language.
The language cookie contains only the language code (for example "de") and
nothing that identifies you (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). You can delete
it at any time in your browser. The website uses no analytics. Reading pages
(regions, pathways, guides, exams, study materials, settling in, living, housing,
driving, stories) show advertising from Google AdSense, see section 2a. Other pages
load no fonts or scripts from third-party servers.
Reading pages show ads from Google AdSense, a service of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). On those pages your browser loads a script from Google, which receives your IP address and the page you are reading, and Google may set or read cookies or similar identifiers.
If you are in the EEA, the UK or Switzerland, Google first asks for your consent in a message from Google's own consent tool, with equal buttons to consent or not to consent. Without consent Google shows only non-personalised or limited ads; personalised ads are shown only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice at any time with the privacy and cookie settings link that Google shows on those pages. Transfers to the USA are based on the EU-US Data Privacy Framework.
How Google uses this data: policies.google.com/technologies/partner-sites. Settings for personalised ads: adssettings.google.com. Login, account, community, payment and form pages show no ads.
If you apply as a tutor, we process your name, email, country of residence, profession, the exam you passed and the year, your registration or licence number if you give it, your teaching languages, your hourly rate, how you heard about us and the language of the page you used. We use this to review your application and to contact you (Art. 6(1)(a) and (b) GDPR). Your profile is published on the platform only with your separate, explicit consent.
If you join the waitlist, we process your first name, email, the exam you are preparing for and your preferred language, in order to tell you when tutors for your exam become available (Art. 6(1)(a) GDPR). We send no newsletters or other advertising.
Form submissions are stored in our Cloudflare account (see section 2) and can only be viewed by us. For each new submission we receive a short email alert sent through Resend (Resend, Inc., USA). The alert contains only the type of form, the exam, profession, country, hourly rate or preferred language – never your name or email address. Transfers to the USA are based on standard contractual clauses. If we reply, we use a Google Mail mailbox (Google Ireland Ltd.).
Tutors can create an account with their email address. Instead of a password
we send a one-time login link by email (through Resend, see section 5). After
signing in, a session cookie (pp_session, valid 30 days, strictly
necessary, no tracking) keeps you logged in. Account and profile data are
stored in a Cloudflare D1 database (see section 2).
The profile you create – name, profession, the exam you passed and the year, country, teaching languages, hourly rate, headline, description and, if you enter it, your registration or licence number – is published on this website as long as you keep the profile visible. Your email address and video-call link are never published. You can edit or hide the profile at any time in your dashboard, and ask us by email to delete the account. To limit abuse we store the number of login requests per email address and IP address for one hour.
If you request a session from a tutor's profile, we store your name, email, preferred times and message, and send you a confirmation link. Only after you confirm do we pass these details to the tutor by email. If the tutor accepts, you receive the tutor's video-call link and email address. Requests are deleted twelve months after they were made.
Online payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. If you pay for a session, you enter your card details on Stripe's payment page; we never see them. We store the amount, currency and Stripe's payment reference with your request. Tutors who want to be paid through PassPeers open a Stripe account linked to our platform; the identity and bank details Stripe asks for are entered on Stripe's pages and are held by Stripe, not by us. Stripe's privacy policy: stripe.com/privacy. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
If you list an agency, we store the details you enter (name, country, website, public contact email, phone, description, countries, professions, services and languages), when you accepted the listing terms, and the Stripe customer and subscription reference with its status and paid-until date. While the subscription is paid, the name, country, languages, description, services, website and public contact email are shown publicly on PassPeers. The monthly payment and the billing address are handled by Stripe (see 6b). After the subscription ends the listing is hidden; we delete it on request, keeping only what tax law requires for invoices. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
If you upload a CV, we store the PDF file, its name and the upload date. The CV is private: it is never shown publicly or offered in any search. When you apply for a job, we send your name, email address, message and a copy of your CV to the employer or agency that posted the job, and that business becomes responsible for your data from then on. The copy is deleted twelve months after the application; you can delete your own CV at any time on the CV page. If you post a job, we store the ad and show it publicly until it ends, together with the applications you receive. Paid job ads are processed by Stripe (see 6b). Legal basis: performance of the contract and your consent for each application (Art. 6(1)(a) and (b) GDPR).
Signed-in members can send us a story about their own route abroad. We store the story and the details you enter with it (the name you choose to show, profession, country you trained in, destination, exams, year, how long it took, an optional advice text), your three confirmations with the time you gave them, the status of the story and your account's email address. We use the email address only to tell you whether your story was published or not; it is never shown. When you send a story we receive an email with its headline and route so we can review it.
Nothing is public before we approve it. Once approved, the story is shown publicly on PassPeers with the name you chose, your profession, countries, exams and year, and may be found through search engines. Choose a first name or a nickname if you do not want to be identifiable. Please do not include health data or other sensitive details about yourself that you do not want to be public, and no personal data about other people.
You can delete your story at any time on /stories/share (sign in with the same email address) or by emailing us; it is then removed from PassPeers immediately. Copies that search engines or other sites have already made are outside our control. You can also delete a story we have not published. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the story; for the review emails, our legitimate interest in keeping the site free of unlawful content (Art. 6(1)(f) GDPR).
Signed-in users can join the PassPeers community. For this we store your community profile (display name, profession, the country you trained in or live in, the country you want to work in, the exam you are preparing for, a short text about you), your email and message-request settings and the time you accepted the community rules. We also store the groups you start or join and your role in them, the threads and replies you post, the events you plan and your answers to events (going / maybe), your direct messages and when you last opened each conversation, members you block, reports you send and any moderation decision about your account. Everything is stored in a Cloudflare D1 database (see section 2) together with the time it was created.
Who sees what. Your email address is never shown to other members. Your community profile is visible only to signed-in members. Posts in public groups are visible to everyone, together with your display name and profession, and may be found through search engines; posts in private groups are visible only to their members. The meeting link and the exact place of an event are shown only to members of the group. Choose a first name or a nickname as display name if you do not want to be identifiable, and do not post health data or other sensitive details you do not want others to read.
Chat groups on other apps. Members can list invite links to chat groups they run on Telegram, WhatsApp, Signal, Discord, Facebook, LINE, WeChat, Viber or Slack. We store the link, the app, the group's name, topic, language and the member who listed it. We never open these links, and we do not collect, read or import members, messages or any other data from those apps. Invite links are shown only to signed-in members (and, for a private PassPeers group, only to its members). When you join such a group, you leave PassPeers and the other app's privacy policy applies. That app decides what other members see about you – WhatsApp and Viber groups show your phone number to every member; Telegram, Signal and Discord show your name or username. Listings from accounts younger than seven days are checked by the moderator before they appear; a listing reported as broken by three members is hidden until the person who listed it checks the link.
Direct messages are not end-to-end encrypted. They are stored on our database and readable by the two members of the conversation. We do not read conversations. The moderator sees a message only when one of the two members reports it, or if we are legally required to disclose it.
Emails. We send community emails through Resend (see section 5) when someone writes to you, replies to your thread, asks to join your group, approves your request to join a group, or cancels an event you answered – at most one per conversation or thread every 30 minutes and 20 a day. These emails never contain the message text, only a link. Every email has a one-click link to stop them, and you can switch them off in your community profile. If we remove something you posted or close your community access, we tell you why by email, whatever your email setting. When someone sends a report, we receive an email saying that a report is waiting – without its content.
Safety. To prevent spam and abuse we count how often each
member posts, sends messages, joins groups, reports or blocks; these counters
are kept in Cloudflare KV for at most 24 hours. New accounts can share fewer
links. Reports (who reported what, the reason and an optional note) are seen
only by the moderator; the reported member is not told who reported them.
When you are sent to the login page from the community, a strictly necessary
cookie (pp_cnext, 30 minutes) remembers which community page to
return to.
Legal basis. Providing the community you signed up for (Art. 6(1)(b) GDPR). Moderation, reports, blocks, bans, rate limits and link limits serve our and other members' legitimate interest in a safe platform (Art. 6(1)(f) GDPR).
Deleting your data. You can delete your community data at any time under Community → My profile → Delete my community data. This deletes your profile, replies, events and answers to events, chat-group listings, group memberships and all your direct conversations (for both members). Groups you own pass to the longest-standing other member, or are deleted if nobody else is in them. Threads that other members replied to stay so the replies keep their context, but show "[deleted]" instead of your words and name. Your PassPeers login is not affected; to delete it as well, email us.
Signed-in members can list used study material for sale on /study/market. For each listing we store the details you enter (title, exam, kind of item, condition, price, country and city, pickup or shipping, the name you choose to show, description), an optional photo, the listing's status and dates, and which account created it. Before we store a photo we remove its embedded data such as GPS position, camera model and date; only the orientation is kept. Photos are stored with Cloudflare (Workers KV), listings in its database (D1). The listing is public with the name you chose; your email address is never shown.
A buyer must be signed in to contact a seller. We send the buyer's message to the seller by email (through Resend) with the buyer's email address as the reply address, and we do not store the message. The seller sees the buyer's address in that email; the buyer sees the seller's address only if the seller replies.
Anyone can report a listing. We store the reason, an optional note, the time, and either the reporter's account or – when signed out – a one-way hash of the IP address, only to count each reporter once. A seller's first listing, and listings with certain words, are checked by us before they are published. Listings are online for 60 days and can be renewed. Sold, expired and rejected listings, their photos and their reports are deleted automatically 90 days after their end date; you can delete a listing at any time on /study/market/mine. Legal basis: Art. 6(1)(b) GDPR (providing the market); for reports, moderation and rate limits Art. 6(1)(f) GDPR (our legitimate interest in a safe, lawful market).
Waitlist entries are deleted twelve months after sign-up or as soon as you ask us to. Tutor applications that do not lead to a profile are deleted after six months. Accounts are deleted on request. Statutory retention duties (for example for invoices) remain unaffected.
Published stories stay until you delete them or ask us to.
Community content stays until you delete it or delete your community data. Content removed by moderation and closed reports are deleted twelve months after they were created or closed. Events, with everyone's answers, are deleted twelve months after they ended. If an account is banned from the community, we keep the account reference, the reason and the date for as long as the ban lasts, even if the member deletes their community data, so that a ban cannot be shed by rejoining. Blocks other members set against an account stay, because they protect those members.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw your consent at any time with effect for the future by emailing us. You may also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection of Lower Saxony (Germany).