Data Protection Notice (Law no. 6698 — KVKK)

Veli Kürşat Bıçakçı (VN Studio) is the data controller (veri sorumlusu) under Turkish Law no. 6698 on the Protection of Personal Data (“KVKK”). This notice explains for which purposes and on which legal grounds your personal data is processed, and what your rights are.

• Identity and contact details: name and surname, email address, telephone number
• The message content of contact and subscription forms
• Technical data: IP address, browser type, device information, screen resolution, pages visited, referring address, visit and session data
• Cookie and device identifiers: pseudonymous identifiers such as pl_vid, pl_session and pl_uref (full list in our Cookie Policy)
• Advertising click identifiers: fbclid, _fbc, _fbp, gclid, gbraid, wbraid; the Google click identifier is stored for 90 days in the first-party pl_gcl cookie, which is written only after marketing consent
• If you have given marketing consent: SHA-256 hashes of your email address, telephone number and name (see Transfers)
• Order and payment data, and the country/city derived from your IP address

• Providing our services and responding to your requests
• Developing content and services, and analysing performance
• Measuring the effectiveness of our own advertising and campaign links internally (using the source information in our own links; legitimate interest — this source information is not shared with third parties)
• Measuring advertising performance on third-party advertising platforms (Meta, Google) and remarketing — only where you have given explicit consent
• Promotion, newsletters and marketing communication (where you have given explicit consent)
• Meeting our legal obligations and handling any disputes

Your personal data is transferred to the recipients listed below, and to the competent public authorities where the law requires it:

• Payment providers (PayTR; and Paddle as Merchant of Record for sales outside Türkiye) — taking payment and invoicing
• Our hosting and infrastructure provider — running the site and the database
• Our email delivery provider — transactional and informational emails
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (abroad) — only if you have given marketing consent, for advertising measurement and remarketing
• Google (abroad) — advertising measurement; the advertising tag is downloaded only if you give marketing consent; without consent your browser sends no request to Google

Data transferred to Meta: cookie and advertising click identifiers (_fbp, _fbc), your pseudonymous user reference, event information (view, checkout initiation, purchase), your IP address and browser information, and SHA-256 hashes of your email address, telephone number and name. Your raw email address, telephone number and name are not sent to Meta; only the hashes are transmitted. Under the KVKK these hashes are not anonymous data; they are protected as personal data.

Data transferred to Google: the advertising click identifier (gclid/gbraid/wbraid), conversion information (event name, time and amount), your order number, your IP address and browser information while the tag loads, and — only if you have given marketing consent — SHA-256 hashes of your email address and telephone number. Your raw email address and telephone number are not sent to Google; only the hashes are transmitted. Under the KVKK these hashes are not anonymous data; they are protected as personal data.

Legal ground for transfers abroad (article 9 of the KVKK): the advertising measurement transfers to Meta and Google rely on your explicit consent; if you do not give marketing consent, no such transfer is made and the related cookies are not written to your device.

Information about possible risks: the Turkish Personal Data Protection Board has not to date issued an adequacy decision for any country. For that reason the country your data is transferred to may not provide the same level of protection as Türkiye, there may be no data protection supervisory body in that country, and the rights listed in article 11 of the KVKK may not be exercisable there in the same way. When you withdraw your explicit consent, further transfers stop; however there is no technical way to retrieve data that has already been transferred.

Your data is collected by automated or semi-automated means through the forms on our website, cookies, email and similar channels.

• Conclusion and performance of a contract (KVKK art. 5/2-c) — membership, orders, session cookies
• Compliance with a legal obligation (KVKK art. 5/2-ç) — invoicing and accounting records
• Legitimate interest (KVKK art. 5/2-f) — site security, error detection and our own internal advertising measurement (vn_src)
• Explicit consent (KVKK art. 5/1) — analytics cookies, advertising/marketing cookies, marketing messages
• For transfers abroad, article 9 of the KVKK (see Transfers)

Under article 11 of the KVKK you have the right to learn whether your data is processed, to request information about it, to ask for it to be corrected or erased, and to object to or ask for restriction of processing. In addition:

• You have the right to know the third parties in Türkiye and abroad to whom your personal data has been transferred (art. 11/1-ç).
• Where processing relies on explicit consent (analytics and marketing cookies, transfers to Meta/Google, marketing messages) you can withdraw your consent at any time. For cookie preferences the “Cookie Settings” link at the bottom of the page is enough; withdrawal takes effect immediately.

You can send requests relating to your rights through our contact channels. Requests are answered within 30 days at the latest, in accordance with the KVKK and the related communiqué.

Your data is kept for as long as it is needed for the purpose and for the mandatory periods laid down in the applicable legislation. It is protected with appropriate technical and organisational measures.

The lifetime of the cookies stored on your device varies from cookie to cookie (session cookies 3 days, measurement cookies up to 365 days, the Meta matching cookie 180 days); each one is listed individually in the table in our Cookie Policy.

When you withdraw your consent, the cookies tied to that consent are deleted before they expire: removing analytics consent deletes pl_vid, pl_session and the A/B test cookies (pl_ab_*, pl_abc_*); removing marketing consent deletes pl_am, pl_gcl, _fbp, _fbc and the Google advertising cookies (_gcl_*). If you remove both, your pseudonymous user reference (pl_uref) is deleted as well. Your preference record (pl_consent) and the session cookies remain, because they do not depend on consent; you can also delete all of them manually with your browser's clear-site-data feature.

The site uses strictly necessary cookies, performance/analytics cookies and optional marketing cookies. Analytics and marketing cookies are off by default and run only with your explicit consent.

• Strictly necessary (accessToken, refreshToken, pl_consent): session, security and the record of your consent
• Analytics (pl_vid, pl_session, pl_ab_*, pl_abc_*): usage statistics and A/B tests
• Functional/attribution (vn_src): remembers which campaign or link brought you to the site, for our own internal advertising measurement; first-party, not shared with third parties (legitimate interest)
• Marketing (pl_am, pl_uref, pl_gcl, _fbp, _fbc, _gcl_au, _gcl_aw): advertising measurement and remarketing where explicit consent is given; pl_am carries the SHA-256 hash of your email address and is transferred to Meta, pl_gcl is our first-party cookie that stores the advertising click identifier (gclid/gbraid/wbraid) for 90 days only after marketing consent, while _gcl_au and _gcl_aw are used for Google advertising measurement

The name, purpose, party and retention period of every cookie, together with the data held in browser storage, are listed in a table in our separate cookie notice, the Cookie Policy. You can change your preferences at any time from the “Cookie Settings” link at the bottom of the page.