Privacy Notice
Last updated: 6 October 2026
This notice explains how your personal data is processed when you visit mervetufekci.com, use the contact forms, write to me through the WhatsApp link, or open pages that contain the map or the Spotify player. It is the information notice under the Turkish Personal Data Protection Law No. 6698 (KVKK).
Data controller
Merve Tüfekçi, Çengilli Caddesi No: 7, Değirmençayırı, Şile, İstanbul, Türkiye. Email: [email protected]
What data do I process?
- Identity and contact details: the name, surname, email address, phone number and, if given, company name you share in a form.
- Request and message details: your message, the service you ask about and, where the form has them, choices such as date, number of people or programme format.
- Security details: access times and server security logs created while the form and the site run. Depending on the server configuration, these logs may include your IP address and browser or device information.
- Site usage details: page and interaction data measured with Google Analytics, according to your cookie choices.
- Map and media details: the Google Maps map on the contact page, the Spotify player on the Healing Conversations page and the YouTube cover images on video pages load when the page opens; in doing so, technical connection data such as your IP address and browser information is sent to the relevant provider and may be processed by it. If you start playback on Spotify, listening data is also processed by Spotify.
- WhatsApp messages: if you choose to send a message through the WhatsApp link, the information you share in it.
The forms do not ask for special categories of personal data such as your health. Please do not write such information in a form.
Why and on what legal grounds do I process it?
| Data category | Data processed | Purpose | Legal ground (KVKK art. 5) |
|---|---|---|---|
| Identity and contact | Name, surname, phone, email and, if given, company name | Replying to your request, giving information or a proposal about a service, planning appointments and programmes | art. 5/2-c (formation or performance of a contract) |
| Customer transactions and requests | Message content, the service asked about and, where the form has them, date, number of people and programme format | Following up requests and support | art. 5/2-c and art. 5/2-f (legitimate interest) |
| Transaction security | IP address, access time, server logs, device and browser information | Information security, preventing spam and misuse, obligations under the law | art. 5/2-ç (legal obligation) and art. 5/2-f (legitimate interest) |
| Legal affairs | Correspondence and notices to official bodies | Evidence in possible disputes | art. 5/2-e (establishment, exercise or protection of a right) |
| Map and media | Technical connection data such as IP address and browser information, and listening data if playback is started on Spotify | Providing the map on the contact page and the player on the Healing Conversations page | art. 5/2-f (legitimate interest) |
| WhatsApp messages | The information you share in your message | Carrying the conversation you start | art. 5/2-c (formation or performance of a contract) |
| Marketing communication | Name, surname, email, phone | If you tick the consent box in a form, sending commercial electronic messages (email or SMS) about workshops, events and news | art. 5/1 (explicit consent) and Law No. 6563. You can withdraw your consent at any time. |
| Marketing and analytics | Visitor interaction data, cookie records | Site analysis and improving the experience | art. 5/1 (explicit consent). Consent is given through the cookie notice and can be withdrawn at any time from the “Cookie preferences” link at the bottom of the page. |
Your personal data is obtained by fully or partly automated means through the website, the contact forms, the server’s technical logs, cookies, WhatsApp and third-party embeds (Google Maps, Spotify).
Who receives the data and why?
I do not sell your data or share it with third parties for their own marketing. The service providers below may process data within their own services so that the site, forms, email and embedded services work:
| Recipient group | Recipient | Purpose of transfer | Location |
|---|---|---|---|
| Suppliers: infrastructure and hosting providers | Hetzner Online GmbH | Hosting the site and form records on VPS infrastructure | Germany |
| Suppliers: network security and content delivery providers | Cloudflare, Inc. | Secure and fast delivery of site traffic, content delivery and attack protection | USA and global network |
| Suppliers: email service providers | Google LLC (Gmail) | Forwarding contact form notifications by email | USA and global network |
| Suppliers: analytics service providers | Google LLC (Analytics and Tag Manager) | Managing site tags and the analytics measurement you allow | USA and global network |
| Third-party embed providers | Google LLC (Maps) | Providing the map on the contact page | USA and global network |
| Third-party embed providers | Google LLC (YouTube) | Showing video cover images and, when you click, providing the video player | USA and global network |
| Third-party embed providers | Spotify AB | Providing the podcast player on the Healing Conversations page | Sweden and global network |
| Communication service providers | WhatsApp (Meta Platforms) | Carrying the conversation you start on WhatsApp | Global network |
| Suppliers: technical support providers | Technical infrastructure provider in Türkiye | Maintenance of the site and server, technical support | Türkiye |
| Authorised public institutions and bodies | Legally authorised bodies | Providing information where and as far as the law requires | Türkiye |
Transfers abroad
The information you share in a contact form is processed on servers in Germany, because the site is hosted on VPS infrastructure there. When form notifications are forwarded with Gmail, their content is also transferred to Google.
When Cloudflare, Google, Spotify and WhatsApp services are used, the related technical data may be sent to these providers’ servers or global networks abroad. Google Analytics data is processed according to your analytics cookie choices. The map and the Spotify player load when you open the page; Spotify listening data is processed when you start playback, and WhatsApp messages when you start the conversation.
How long do I keep it?
I keep contact form records and correspondence for 10 years, taking into account the general limitation period in the Turkish Code of Obligations for possible legal disputes.
Server access and technical security logs are kept for 2 years under Law No. 5651. When the period ends, the data is deleted, destroyed or anonymised.
Your rights
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used for that purpose; to know the third parties it is transferred to; and to ask for incomplete or incorrect data to be corrected and, when the legal conditions are met, erased or destroyed. You also have the right to ask for these actions to be notified to the third parties the data was transferred to, to object to a result against you arising solely from automated analysis, and to claim compensation if you suffer damage from unlawful processing.
How to apply
You can send your requests under the KVKK, with information that allows your identity to be verified, in writing to Çengilli Caddesi No: 7, Değirmençayırı, Şile, İstanbul, Türkiye, or by email to [email protected]. I conclude applications within 30 days at the latest. Applications are free of charge as a rule; if an additional cost arises, the fee schedule in the regulation may apply.
