Privacy Policy and KVKK Notice (outline)
Facts for counsel
Section titled “Facts for counsel”Data controller: TODO legal entity, address, contact (e.g. kvkk@demostatics.com).
Personal data processed today by demostatics-web
| Category | Data | Purpose |
|---|---|---|
| Identity / contact | Name, email address | Account, sign-in, service emails |
| Security | Password hash, session and app tokens, IP addresses in logs | Authentication, abuse prevention |
| User content | Posts, comments, polls | Forum service |
| Poll votes | Which option a user chose | Poll results — potentially reveals opinions; counsel to assess whether any poll topic makes this special-category data (KVKK Art. 6) |
| Moderation | Bans and ban reasons, staff roles | Enforcing the rules |
| Later: billing | Invoice details; card data held only by the payment provider | Payment, tax law |
Processors and recipients
| Recipient | Role | Location |
|---|---|---|
| Amazon Web Services (EMEA SARL / AWS Turkey) | Hosting, storage, email sending (planned: SES) | EU — Frankfurt |
| Natro (teamblue) | Domain DNS and company email | Türkiye |
| Payment provider | TODO: iyzico / PayTR / Paddle … | TODO |
| Public authorities | When legally required | Türkiye |
Cross-border transfer: hosting in the EU means transfer abroad under KVKK Article 9 (as amended in 2024). TODO counsel: adequacy decision or standard contractual clauses with AWS, and the required notification to the KVKK Authority.
Sections the notice needs
Section titled “Sections the notice needs”- Identity of the data controller
- Which personal data is processed
- Purposes of processing
- Legal bases (KVKK Art. 5 / GDPR Art. 6) for each purpose
- Who it is transferred to, including abroad, and why
- How it is collected (forms, the apps, cookies, logs)
- How long it is kept — TODO per category
- Rights under KVKK Art. 11 (and GDPR for EU users) and how to use them
- Cookies — refer to the Cookie Policy
- Security measures (summary)
- Changes to this notice and its date