Privacy Notice

1. Data controller

Your personal data is processed by Bahadır Sevgin as data controller.

Contact: bas.oper.co@gmail.com · Address: Bursa, Turkey

2. What we process

• Contact form: your name, Instagram username or email address, topic of interest and message.
• Review form: your name, a short note on how you know Bahadır (e.g. “group class student”) and your review.
• Source information: which link brought you to the site (e.g. an Instagram post) and the page the form was sent from. This is only sent together with a form.
• Technical logs: the hosting infrastructure may briefly keep server logs such as IP address and browser details for security.

The site does not use cookies. The link you arrived from is kept only in your browser's session storage until you close the tab.

3. Purposes

• Replying to class, workshop, festival, adjudicating and collaboration requests.
• Publishing your review on the site after it has been approved.
• Keeping the site secure and preventing misuse such as spam.
• Understanding, in aggregate, which content people find useful.

4. Legal grounds

• Contact requests: necessity for entering into or performing a contract (KVKK Art. 5/2-c) and legitimate interest (Art. 5/2-f).
• Security and technical logs: legitimate interest (Art. 5/2-f).
• Publishing reviews with your name: your explicit consent (Art. 5/1). You can withdraw it at any time and the review will be removed.

5. Who receives your data

Your data is never sold or shared for advertising. The site relies on these service providers:

• Hosting: Vercel Inc. (USA)
• Email delivery: Resend (US company; emails are sent through servers in Japan)
• Mailbox where messages are read: Google (Gmail, USA)
• Review database: Upstash, Inc. (US company; data stored on servers in Frankfurt, Germany)

6. Transfers abroad

These providers' servers are outside Turkey (USA, Germany and Japan). There is no adequacy decision of the Turkish Personal Data Protection Board for these countries, so transfers rely on the exceptions in KVKK Art. 9:

• Contact form: when you choose to send the form, your data is transferred only as far as needed to answer your request, i.e. to enter into an agreement such as a class, workshop or collaboration (Art. 9/6-b).
• Review form: the transfer is based on the explicit consent you give with the checkbox on the form (Art. 9/6-a).
• Risks: data protection rules abroad may differ from Turkey's, and authorities there may request access to data under local law. The providers contractually commit to encrypted transport and protection against unauthorised access.

Approved reviews are publicly visible on the internet.

7. Retention

• Contact messages: up to 2 years after your request is concluded, as correspondence may be needed as evidence in a dispute.
• Published reviews: while they remain on the site; deleted when you withdraw consent.
• Reviews awaiting approval: until a decision is made. Rejected reviews are deleted immediately.
• Technical logs: a few days in the hosting provider's systems, then deleted automatically.

8. Your rights

Under KVKK Art. 11 you may ask whether your data is processed, request information, learn the purpose and recipients, request correction or deletion, object to decisions made solely by automated means, and claim compensation for unlawful processing.

9. How to apply

Write to bas.oper.co@gmail.com, or in writing to the address above. Requests are answered free of charge within 30 days. If your request is rejected, the answer is insufficient or no answer is given in time, you may complain to the Turkish Personal Data Protection Board.