Privacy notice (KVKK)

1. Data controller and scope

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data, known as KVKK, and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains for what purpose, on what legal ground and how your personal data is processed when you use girisimcikafasi.com and when you contact us.

• Data controller: Girişimci Kafası
• Address for requests: info@girisimcikafasi.com
• Website: girisimcikafasi.com

This notice covers people who visit the site, fill in forms, subscribe to the Kafa Notları newsletter or to browser notifications, sign up for the email course or write to us by email. For cookies and browser storage, see the Cookie policy.

If we open a separate registration page for a sponsored report or event, that page will also carry a privacy notice specific to the programme. In such a registration your data is shared only to the extent stated on that page and with your explicit consent; this notice applies alongside it.

Where the content we publish names people, it relies on public information with a known source. If you want to correct or remove information in such content, you can use the Startup Graveyard correction page, in Turkish, or write to us through the channels in the How to apply section of this notice.

Our forms do not ask for special categories of personal data such as health, religion, ethnic origin or political opinion. Please do not write such information in message and note fields.

2. What data we process and why

Below, for each activity, we set out what data we collect, for what purpose and how, which legal ground we rely on and how long we keep it. The meaning of the legal grounds is explained in the next section.

The box on our forms stating that you have read the privacy notice shows that you have read this notice. That box is not the basis for processing your data; the basis is the legal ground stated below for each activity. For processing based on explicit consent, we ask for a separate and optional consent.

Forms can also be submitted through a software agent or application acting on your behalf. In that case the name of the agent is also recorded. We expect the agent to confirm that the person it acts for has read this notice.

3. Legal grounds

We process your data only on one of the grounds in Article 5 of the Law. Which activity relies on which ground is stated above; the grounds mean the following.

• Explicit consent: Article 5, paragraph 1 of the Law. You give it for the newsletter and browser notifications by ticking the box or granting permission. You are not obliged to give consent, and not giving it does not affect your access to the site's content. You can withdraw your consent at any time; withdrawal does not make processing carried out up to that point unlawful.
• Conclusion or performance of a contract: Article 5, paragraph 2, subparagraph c of the Law. Data needed for proposals, applications and providing the service you asked for.
• Legitimate interest: Article 5, paragraph 2, subparagraph f of the Law. Processing needed for our interests, such as replying to you and protecting and improving the site, provided it does not harm your fundamental rights and freedoms. You can object to processing based on this ground.
• Establishment, exercise or protection of a right: Article 5, paragraph 2, subparagraph e of the Law. As evidence in a possible dispute; one of the reasons for the retention periods.
• Legal obligation: Article 5, paragraph 2, subparagraph ç of the Law. Complying with lawful requests from competent authorities and courts.

4. Who we share it with

We do not sell your personal data and do not open it to advertising networks. We share it only with the parties below, for the stated purpose.

• The Girişimci Kafası team: What you write in forms is sent as a notification to team email addresses so that we can respond to your request; newsletter subscriptions are excluded. Some of these addresses are on the Webtures domain. Only authorised team members can access records through the admin panel; the panel opens only with an approved email address and a one-time code.
• Cloudflare: Hosting of the site, network and security services, running the code and the database where records are kept. Cloudflare also processes technical information such as IP addresses on its own infrastructure so that a connection can be made.
• Resend: Email sending service. Confirmation emails, the newsletter, course lessons, tool results, the media kit link and team notifications are sent through this service; your email address and the content of the email pass through Resend.
• Browser notification services: If you subscribed to notifications, the notification service of Google, Mozilla, Apple or Microsoft, depending on the browser you use, delivers the notification to your browser. The content of the notification is sent encrypted.
• Competent authorities and institutions: When there is a legal obligation or a request from a competent authority, to the extent the request requires.
• Sponsors: We do not give your data to a sponsor or advertiser. In a sponsored report or event programme, such sharing happens only with your explicit consent, which we ask for separately, with the programme's page stating which information goes to whom.

5. Transfers abroad

Cloudflare and Resend are service providers based outside Turkey. The infrastructure where your data is processed may be in more than one country, including in Europe. For browser notifications, the notification services of Google, Mozilla, Apple and Microsoft are also abroad. For this reason, the information you write in forms, your email address and your notification subscription are transferred abroad.

We carry out these transfers in line with Article 9 of the Law, with one of the safeguards listed in that article in place. If you would like details about the transfers, you can write to us.

You do not need to fill in any form or turn on notifications to access the site's content.

6. Retention and deletion

The retention period for each activity is stated above. We take the date of the last action on a record as the date the matter was closed. Data whose period has expired is deleted, destroyed or anonymised by an automatic clean-up that runs every day, within six months at the latest. If there is a legal retention obligation or an ongoing dispute, the data is kept until that period ends.

Notifications and correspondence in team mailboxes are subject to the same periods. Our service providers keep technical and sending records in their own systems for the periods in their own policies.

7. Security

We take reasonable technical and organisational measures to protect your data.

• The connection between you and our site is encrypted with HTTPS.
• Only authorised team members can access records; signing in requires an approved email address and a one-time code.
• Your IP address is not stored in raw form; only a one-way encrypted hash is kept.
• Notification content is sent encrypted.
• The number of submissions is limited and unwanted submissions are filtered out.

If your data is obtained by unauthorised persons, we will notify you as soon as possible under Article 12 of the Law, and the Personal Data Protection Board within 72 hours at the latest.

8. Your rights

Under Article 11 of the Law, you can apply to the data controller to:

• Find out whether your personal data is processed.
• Request information about it if it has been processed.
• Find out the purpose of the processing and whether the data is used in line with that purpose.
• Know the third parties in Turkey or abroad to whom it has been transferred.
• Ask for it to be corrected if it is incomplete or inaccurate.
• Ask for it to be deleted or destroyed under the conditions in Article 7 of the Law.
• Ask for corrections, deletions and destructions to be notified to the parties to whom the data was transferred.
• Object to an outcome against you that arises from your data being analysed solely by automated systems.
• Claim compensation if you have suffered damage because your data was processed unlawfully.

For processing based on your explicit consent, you can withdraw your consent at any time.

9. How to apply

To use your rights, you can send your request in line with the Communiqué on the Procedures and Principles of Application to the Data Controller through one of the channels below.

• With the email address registered with us: Write to info@girisimcikafasi.com from the email address you gave us before and that is in our records.
• In writing or by KEP: If you want to apply in writing with a signed petition or by registered electronic mail, known as KEP, write to the same address and we will send you our postal address and our KEP address.

Your application should include your name and surname, your signature if it is a written application, your Turkish ID number or, if you are not a Turkish citizen, your nationality and passport or ID number, your residential or business address for notifications, your email address for notifications if any, your phone and fax number, and the subject of your request.

We will conclude your application free of charge within thirty days at the latest, depending on the nature of the request. If the action requires an additional cost, a fee from the tariff set by the Board may be charged.

For an information request, we send you the newsletter, form, programme, course and source records matching your address as a machine-readable file. For a deletion request, we delete the same records together with their source information; both are done from the person card in the admin panel; a deletion is logged only with the number of records deleted, and your address is not logged. Copies held by the email service provider and in team mailboxes are subject to their own periods. Browser notification subscriptions are kept without your name or email, so they cannot be matched to your address; you can turn them off in your browser settings. If your data has already been delivered to a sponsor, we will notify the sponsor separately.

If we reject your application, if you find our answer insufficient or if we do not answer in time, you can file a complaint with the Personal Data Protection Board within thirty days of learning of the answer and, in any case, within sixty days of the application date.

There are also ways that need no application: the unsubscribe link at the end of every newsletter ends your subscription; with the preference centre link at the bottom of every newsletter and course lesson you change your name, interests and frequency, pause your subscription for 30 days or leave the course; you can turn off browser notifications in your browser settings or with the notification button on the site.

10. Changes

We update this notice when we add a new data processing activity or when the legislation changes. The current version is always on this page; the date at the top of the page shows the last update. For questions, you can write to info@girisimcikafasi.com.