Privacy Notice (KVKK): How We Use Personal Data

1. Data controller

Data controller: Sevim Oğuztürk
Address: Memurevleri Mah. 208. Sok. No: 14, Muratpaşa/Antalya
Email: iletisim@oyverin.com

2. Data we process, purpose and legal basis

Data	Purpose	Legal basis (KVKK)
IP summary (ip_hash): HMAC-SHA256 of your IP address with a salt that changes daily. The raw IP is not stored.	Limiting repeated votes from the same network, preventing bots and abuse	Art. 5(2)(f) legitimate interest
Cookie ID summary: a random ID in the necessary cookie `oyv_id`, stored in our database only as an HMAC summary	Ensuring one vote per device in each poll	Art. 5(2)(f) legitimate interest
Your vote (which option, when)	Counting and publishing poll results	Art. 5(2)(f) legitimate interest
Contact form: name, email, subject, related poll/option, message, IP summary	Answering your request, handling removal and objection requests, keeping evidence	Art. 5(2)(c) necessary for a contract/request, 5(2)(e) establishing and defending rights
Analytics and advertising cookie data (only with consent)	Visit statistics, showing and measuring ads	Art. 5(1) explicit consent
Server access records	Security and legal obligations under Law No. 5651	Art. 5(2)(a) and (ç) required by law / legal obligation

Data is collected automatically through the website and cookies, and through the forms you fill in. We do not ask for sign-up and we do not process special categories of personal data.

3. Retention periods

Vote records (IP summary and cookie ID summary): deleted 6 months after the poll closes. Anonymous vote totals are kept.
Rate-limit records: deleted within 24 hours.
Contact and removal requests: kept for 2 years after the request is closed, then deleted.
Server access records: kept for the period required by law, at most 2 years.
Cookies: see the durations in the cookie policy.

4. Who we share data with

We do not sell personal data. Data may be shared with our hosting provider for the operation of the service, and with authorised public bodies and courts when legally required.

5. Transfers abroad

Some service providers we use process data on servers outside Turkey:

Cloudflare, Inc. (USA): content delivery, security and the Turnstile bot check.
Google LLC / Google Ireland Ltd.: Google Analytics and Google AdSense, only if you give consent in the cookie banner.

Following the 2024 amendment to KVKK Article 9, these transfers are based on the standard contracts published by the Personal Data Protection Board, signed with the providers and notified to the Board within the legal deadline. Where no appropriate safeguard applies, data is transferred only in the exceptional cases listed in Article 9(6).

6. Your rights (KVKK Article 11)

You have the right to:

learn whether your personal data is processed, and request information about it;
learn the purpose of processing and whether data is used for that purpose;
know the third parties in Turkey or abroad to whom data is transferred;
request correction of incomplete or inaccurate data;
request deletion or destruction of data under Article 7;
request that correction, deletion or destruction be notified to third parties the data was transferred to;
object to a result against you arising solely from automated analysis;
claim compensation for damage caused by unlawful processing.

7. How to apply

You can send your request in writing to the address above, by registered email (KEP), or by email from the address registered with us to iletisim@oyverin.com, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. You can also use the contact form. We answer free of charge within 30 days at the latest. If your request is rejected or not answered, you may complain to the Personal Data Protection Board.

Because we do not store raw IP addresses or ask who you are, we may be unable to link a vote to you; in that case we will tell you so in our reply.

Privacy notice