Privacy Policy
This policy explains what personal data Rootie processes, why, and the choices you have. It covers the Rootie web and mobile apps, the Rootie app for Microsoft Teams, our notification channels and this website.
Effective date: 1 October 2026
1. Who we are
Rootie is a microlearning service provided by Verim Atölyesi Eğitim ve Bilişim Teknolojileri A.Ş. (“Rootie”, “we”, “us”), Üniversiteler Mah. İhsan Doğramacı Bulvarı No: 21, Çankaya, 06800 Ankara, Türkiye. You can reach us about privacy at support@rootielearning.com.
Rootie is used by organisations (our “customers”) to train their employees. For the learner and account data a customer puts into Rootie, the customer is the data controller and Rootie processes that data on the customer’s behalf and on its instructions. For data you send us through this website, such as a demo request, Rootie is the controller.
2. Data we process
Account data
Name, work e-mail address, mobile phone number, organisation, team or department, role and language, as provided by your employer or by you.
Learning activity
Programs assigned to you, your answers, how confident you said you were, scores, progress, league standings and timestamps.
Notification data
The details needed to reach you on the channels your organisation enabled: phone number for WhatsApp and SMS, e-mail address, mobile push tokens, and the Microsoft Teams identifiers described in section 3. We keep a log of which reminders were sent and whether delivery succeeded.
Technical data
IP address, device and browser type, and error logs, used to run and secure the service.
Website enquiries
What you enter in the demo or contact form: name, organisation, e-mail, phone number, team size and your message.
3. Rootie app for Microsoft Teams
The Rootie app for Microsoft Teams is a notification-only bot. It sends you personal messages with your learning reminders and a button that opens the program in Rootie. It does not read your chats, channel messages, files, meetings or calendar.
When the app is installed for you, Microsoft sends Rootie an installation event. From it we store:
| Data | Why we keep it |
|---|---|
| Microsoft Entra tenant ID | To know which organisation the installation belongs to. |
| Microsoft Entra user object ID and user principal name (work e-mail) | To match your Teams account to your Rootie learner account. |
| Teams conversation ID and service URL | To deliver messages into your personal chat with the Rootie bot. |
| Installation and removal dates, last delivery error | To stop sending after you remove the app and to troubleshoot delivery. |
If your organisation’s administrator grants consent in Rootie’s admin panel, Rootie may also use these Microsoft Graph application permissions for that organisation only:
- User.Read.All, to read basic profile information (name, e-mail) and match employees to Rootie learner accounts.
- TeamsAppInstallation.ReadWriteSelfForUser.All, to install the Rootie app for employees so they can receive reminders without installing it themselves.
- GroupMember.Read.All, to read group and team membership so administrators can map Microsoft 365 groups to Rootie teams.
Administrators can revoke this consent at any time in Microsoft Entra ID. When you uninstall the app, Microsoft notifies Rootie, we mark the link as removed and send no further Teams messages.
4. How we use data
- To provide the service: deliver programs and questions, calculate scores, and show results to you and to your organisation’s administrators.
- To send the reminders and notifications your organisation configured, on the channels it enabled.
- To keep the service secure, prevent abuse, and fix errors.
- To answer your enquiries and, for website contacts, to follow up on your demo request.
We do not sell personal data and we do not use learner data for advertising.
5. Legal basis
Where Rootie is the controller, we rely on taking steps at your request before a contract (demo requests), our legitimate interest in running and securing the service, and compliance with legal obligations. Where Rootie acts for a customer, the customer determines the legal basis, typically its legitimate interest in training employees or its employment obligations. This policy is intended to meet the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).
7. International transfers
Some providers, including Microsoft and messaging providers, may process data outside Türkiye or your country. Where this happens we rely on the safeguards required by applicable law, such as standard contractual clauses or the explicit consent mechanisms provided for under KVKK.
8. Retention
We keep learner and account data for as long as your organisation’s contract with Rootie is active, and delete or anonymise it within 90 days after the contract ends unless the organisation asks for earlier deletion or the law requires longer retention. Teams link data is kept while the app is installed for you and deleted with your Rootie account. Website enquiries are kept for up to two years.
9. Security
Data is encrypted in transit. Access is limited to staff who need it. Sign-in links sent in notifications are personal and time-limited; do not forward them.
10. Your rights
Depending on where you are, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and complain to a supervisory authority (in Türkiye, the Personal Data Protection Authority). If your employer provides your Rootie account, we will usually pass your request to them, because they decide how that data is used. Send requests to support@rootielearning.com.
12. Children
Rootie is a workplace service and is not directed to children under 16.
13. Changes
We may update this policy. We will change the effective date above and, for material changes, tell customers in advance. See also our Terms of Use.