KVKK Notice

Effective date: October 11, 2026 · Version 1.0

1. Introduction

1.1 Who is this policy for?

This policy applies to all natural persons whose personal data is processed because they visit or register on www.edebiyatla.com.

1.2 Data Controller

Data Controller: Serkan Bektaş ("Edebiyatla")
Address: Istanbul, Türkiye
Email: [email protected]

1.3 Purpose

Edebiyatla treats personal data protection as a core priority. This policy explains how the rules of Personal Data Protection Law No. 6698 (the "Law" or "KVKK") are applied in the platform's day-to-day operation and provides data subjects with the necessary transparency.

1.4 Scope

The policy covers all personal data obtained by automated means, or by non-automated means provided that it forms part of a data filing system.

1.5 Legal basis

The policy is based on KVKK and related legislation. Personal data is also processed to fulfil obligations under Law No. 5651 on Internet Publications, Consumer Protection Law No. 6502 and the Turkish Code of Obligations No. 6098. In case of conflict, the legislation prevails.

1.6 Definitions

Explicit consent: Freely given, informed consent on a specific matter.
Anonymization: Rendering data impossible to associate with an identified or identifiable person, even when matched with other data.
Application: A request by a data subject to the Data Controller to exercise rights under the Law.
Destruction (imha): Deletion, destruction or anonymization of personal data.
Personal data: Any information relating to an identified or identifiable natural person.
Processing: Any operation performed on data, such as collection, recording, storage, alteration, transfer or classification.
Board / Authority: Personal Data Protection Board / Personal Data Protection Authority.
Special category data: Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Periodic destruction: Deletion, destruction or anonymization carried out automatically at regular intervals once all processing conditions cease to exist.
Deletion / Destruction: Making data inaccessible to relevant users / making it inaccessible and irretrievable for anyone.
Data processor: A natural or legal person processing data on behalf of the Data Controller (e.g. hosting and email providers).
Data subject: The natural person whose data is processed.
Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data dated October 28, 2017.

2. How We Protect Data

2.1 Data security

We take the measures required by Article 12 of the Law, according to the nature of the data, to prevent unlawful disclosure, access or transfer, following the guidelines published by the Authority.

2.2 Special category data

Edebiyatla does not knowingly or intentionally collect special category data. Users may choose to share such information in their own content (poems, stories, essays, comments). If processing such data becomes necessary, it is done only under the conditions of Article 6 of the Law and with the additional measures set by the Board.

2.3 Awareness

We ensure that everyone with access to data (developers, moderators, service providers) knows the data protection rules, seek advice from consultants where needed and update our processes as legislation changes.

3. Processing of Personal Data

3.1 Core principles

Lawfulness and fairness: Only as much as needed, without harming fundamental rights and freedoms.
Accuracy: Necessary measures are taken to keep data accurate and up to date.
Specified, explicit and legitimate purposes: Data is processed for purposes determined and disclosed in advance.
Relevance, limitation and proportionality: Only data necessary for the purpose is collected.
Retention only as long as necessary: For the period set by legislation or, if none, as long as the purpose requires.

3.2 Processing conditions

Personal data is processed based on your explicit consent or at least one of the following:

It is expressly provided for by law
It is necessary to protect the life or physical integrity of a person unable to give consent due to actual impossibility
It is necessary to establish or perform a contract to which you are a party (e.g. membership)
It is necessary to fulfil a legal obligation
You have made the data public (limited to that purpose)
It is necessary to establish, exercise or protect a right
It is necessary for Edebiyatla's legitimate interests, provided your fundamental rights and freedoms are not harmed

3.3 Processing special category data

Under Article 6 of the Law, special category data may only be processed with your explicit consent or in the exceptional cases listed in that article (e.g. expressly provided by law, made public, necessary to protect a right), with adequate measures set by the Board.

3.4 Information

We explain which data is processed, for what purpose, by which method and on what legal basis, who it is shared with and your rights in our Privacy Policy, Terms of Service and Cookie Policy.

3.5 Domestic transfers

Data may be transferred in line with processing purposes and with necessary security measures, based on your explicit consent or one of the conditions in 3.2, in accordance with Article 8 of the Law. Main recipients:

Hosting, storage, email and analytics providers (as data processors)
Competent public authorities where required by law or official request

3.6 International transfers

Some of our providers (e.g. cloud storage and web analytics) have servers abroad. International transfers are made under Article 9 of the Law through one of the following:

To countries or organizations with an adequacy decision by the Board, where one of the conditions in 3.2 exists
Without an adequacy decision, through an appropriate safeguard: the Board's standard contract (notified to the Authority within 5 business days of signing), binding corporate rules or a Board-authorized written undertaking
Where none of these exist, only on an occasional basis in the exceptional cases listed in the Law (e.g. your explicit consent)

4. Data Categories

Category	Examples
Identity and contact	Name, surname, username, email address
Profile and content	Biography, profile photo, poems/stories/essays, comments
Interaction	Follows, likes, bookmarks, private messages
Transaction security	Hashed password, session logs, IP address
Technical and analytics	Browser/device information, cookies (analytics cookies only with your consent)

5. Measures Taken

We take technical and administrative measures and carry out regular checks, including TLS-encrypted transmission, one-way hashed password storage, role-based access and logging.

If, despite all measures, data is obtained unlawfully by third parties, we notify the Board and affected persons as soon as possible under Article 12 of the Law (within 72 hours at the latest, per Board decision).

6. Retention and Destruction

We retain data for the period set by legislation or, if none, as long as the processing purpose requires. When the period ends, data is deleted, destroyed or anonymized under periodic destruction or upon your application. Traffic logs under Law No. 5651 are retained for the period required by law.

7. Your Rights and Applications

7.1 Your rights (KVKK Art. 11)

Learn whether your personal data is processed
Request information if it has been processed
Learn the purpose of processing and whether it is used accordingly
Know the third parties in Türkiye or abroad to whom data is transferred
Request correction of incomplete or inaccurate data and notification to recipients
Request deletion or destruction once the reasons for processing cease, and notification to recipients
Object to a result against you arising solely from automated analysis
Claim compensation for damage caused by unlawful processing

7.2 How to apply

You may submit your requests in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, from your registered email address to [email protected]. Please include your full name, contact details and a clear summary of your request.

7.3 Response time

Properly submitted applications are concluded as soon as possible and free of charge within 30 days at the latest. If the process involves an additional cost, a fee may be charged according to the Board's tariff.

7.4 Grounds for refusal

Applications may be refused with reasons under the exceptions in Article 28 of the Law, for example:

Processing for official statistics or, once anonymized, for research, planning and statistics
Processing for artistic, historical, literary or scientific purposes or within freedom of expression, provided it does not violate national defence, national security, public safety, public order, economic security, privacy or personal rights, or constitute a crime
Preventive, protective and intelligence activities by authorized public bodies, and judicial or enforcement proceedings
Where necessary for crime prevention or investigation
Where you have made the data public yourself
Where necessary for supervisory, regulatory or disciplinary duties of authorized bodies, or to protect the State's economic and financial interests
Where the request may hinder others' rights and freedoms, requires disproportionate effort, or concerns publicly available information

7.5 Right to complain to the Board

If your application is refused, you find the response insufficient or no response is given in time, you may complain to the Board within 30 days of learning the response and in any case within 60 days of the application date (KVKK Art. 14).

7.6 Identity verification

We may ask for additional information to verify that the application belongs to the data subject and to clarify the request.

8. Implementation

This policy has been approved and put into effect by the Data Controller. It is applied together with our Privacy Policy, Cookie Policy and Terms of Service. The Data Controller is responsible for keeping it up to date.

9. Effective Date and Publication

The policy takes effect on the date it is published on www.edebiyatla.com. Changes are published on this page and apply from the date of announcement.