KVKK disclosure notice

Last updated 18 September 2026

This is the disclosure notice required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and by the Communiqué on the procedures and principles to be followed in fulfilling the disclosure obligation. It also describes, in advance, what would be processed if you signed in or took out a membership, neither of which exists yet. The Turkish text is the binding one; this is a translation for readers outside Turkey.

Data controller

The data controller is Odun Games Limited Şirketi, which publishes gazete.tv, at Kireçburnu Mah., Sarıyer, İstanbul, Türkiye. Requests under this notice go to [email protected].

What is processed and why

Transaction security data — IP address, request time, requested page, referring page, browser and device string. Processed to keep the site available and secure and to detect abuse. Ground: Art. 5(2)(f), legitimate interest of the controller, provided the data subject’s fundamental rights are not harmed.

Communication data — the e-mail address you give for the daily brief, and the content of any message you send us. Processed to send the brief you asked for, and to answer you. Grounds: Art. 5(1) explicit consent for the newsletter; Art. 5(2)(c) and 5(2)(f) for correspondence and for keeping a record of a published correction.

Marketing and audience data — none today. The adverts on the site are our own images served from our own domain, and audience measurement is cookieless and aggregate, on the ground in Art. 5(2)(f). If an advertising partner is ever switched on, it sets identifiers only where you have pressed “Accept all” in the consent bar that appears with it. Ground for that: Art. 5(1) explicit consent, which you can withdraw at any time.

Account and membership data — none today. There is no sign-in and no payment on gazete.tv yet. From the day they open, the categories below are processed, and not before:

Identity and contact data — the name, e-mail address and provider user id that Google or Apple pass to us when you choose to sign in with them. We never receive the password you use with either of them. Purpose: opening and running your account. Ground: Art. 5(2)(c), processing necessary for the performance of a contract to which you are a party.
Preference data — the sections you choose, your home page layout, your saved stories and your theme. Purpose: delivering the service you asked for. Ground: Art. 5(2)(c), and Art. 5(1) explicit consent for anything beyond it.
Membership state — whether the account is currently a member, and until when. It reaches us from Apple’s App Store or Google Play, which is where a membership is bought; nothing else comes with it. Purpose: giving you the member features you paid the store for. Ground: Art. 5(2)(c), processing necessary for the performance of a contract to which you are a party.
Payment data — none. A membership is an in-app purchase and Apple or Google is the seller. They take the money and hold the card details as independent data controllers under their own notices. We never see your card number, your billing address or your payment history, we issue no invoice for a membership, and we therefore hold no payment record that any retention period could reach.
Member advertising status — a member is shown no adverts, so no advertising identifier is set for a member at all.

We do not process special categories of personal data, and we ask for no identity document, no address and no phone number.

How it is collected

Automatically, by the web server, when your browser requests a page; and directly from you, when you type an e-mail address into the newsletter box or send us a message. If advertising identifiers are ever collected, it is by a partner’s own script and only after your explicit consent.

To whom it is transferred

To our hosting and content-delivery provider and to the provider that sends the newsletter. There is no advertising partner today; if one is added, it is named in this notice and in the cookie policy before it is switched on. Transfers are limited to what each supplier needs to do its job, under Art. 8 and Art. 9.

Some of these suppliers keep data outside Turkey. Transfers abroad are made on one of the grounds in Art. 9: an adequacy decision, an appropriate undertaking or standard contract notified to the Board, or your explicit consent. Where the European rules also apply, the Commission’s standard contractual clauses are used.

When sign-in and membership open, Google and Apple also process data abroad, on the same Art. 9 grounds: for the sign-in, and for the purchase itself. For the purchase they act as controllers in their own right, not as our processors, because the sale is theirs and not something they do on our instruction. What crosses to us from them is the account identity you chose to share and the membership state, and nothing more.

Retention

Log data is kept for a short period and then deleted. A newsletter address is kept until you unsubscribe. Correspondence is kept for as long as it takes to answer it, and a published correction is kept as part of the public record of the story. After that, data is deleted, destroyed or anonymised under the controller’s retention and destruction policy.

From the day accounts exist: account data and the membership state beside it are kept for as long as the account exists, and after deletion they are destroyed within thirty days. There is no ten-year exception here, because we hold no invoice and no payment record: what the store keeps about a purchase is the store’s, under its own notice. You can ask us to delete your account at any time, from the account page or by writing to [email protected]; deletion removes your name, your e-mail address, the provider user id, the membership state, your preferences, your home page layout and your saved stories. It does not cancel a subscription: turn renewal off in your App Store or Google Play account first.

Your rights under Article 11

You may: learn whether your personal data is processed; request information if it has been; learn the purpose and whether it is used accordingly; know the third parties at home or abroad to whom it is transferred; request correction if it is incomplete or wrong, and ask that anyone it was transferred to be told; request erasure or destruction under Article 7, and ask that anyone it was transferred to be told; object to a result reached solely by automated analysis that works against you; and claim compensation for damage caused by unlawful processing.

Send your request in writing, or by any method the Board allows, to the postal address above or to [email protected]. It is answered within thirty days at the latest, free of charge unless the Board has set a fee for that kind of request. If you are not satisfied with the answer, you may complain to the Personal Data Protection Authority.