Privacy notice

Draft text: This text becomes final after the institution's legal review. Details in square brackets are awaited from the institution.

Data controller

Under the Turkish Personal Data Protection Law No. 6698 (KVKK) the data controller is the Presidency of Manuscripts Institution of Türkiye (TÜYEK). Address: [PLACEHOLDER: data controller postal address]. Registered e-mail (KEP): [PLACEHOLDER: KEP address]. Personal data contact: [PLACEHOLDER: application e-mail address].

The software service provider that runs the platform for TÜYEK is a contracted data processor and processes data only on TÜYEK's instructions.

What we process

• Account data: name, e-mail address, password hash, language and display preferences and, optionally, institution and research purpose.
• Your records: saved searches, workspaces, download orders and entitlements.
• Consent records: which version of which text you accepted, and when.
• Security records: an audit trail of actions taken with your account. IP addresses are not stored in the clear; they are hashed with a salt that changes daily.
• Search logs are kept anonymously and are not linked to your identity.

Purposes and legal bases

• Creating your membership and providing the service: performance of a contract (KVKK art. 5/2-c; GDPR art. 6/1-b).
• Security, abuse prevention and audit trail: legitimate interest and legal obligation (art. 5/2-ç, 5/2-f; GDPR art. 6/1-c, 6/1-f).
• Keeping order and payment records: required by law (art. 5/2-a).
• Transfer abroad for the AI assistant: only with your explicit consent (art. 9; GDPR art. 49/1-a).

Transfers

Data is stored and backed up on servers in Türkiye. The only flow abroad is the content you send to the AI assistant, if you give explicit consent; see the consent text for transfers abroad. You can withdraw that consent at any time in the Consents section of your account.

Retention

• Account data is kept while the account is open. If you delete your account it is anonymised after a 7-day cooling-off period; saved searches, workspaces and entitlements are deleted.
• Consent records are kept for 3 years after the account closes, audit records for 5 years and download orders for the statutory commercial period (10 years), without personal details.
• The text of anonymous search logs is deleted after 13 months; only counts remain.

Cookies

Only strictly necessary session cookies and a language preference cookie are used; there are no analytics or advertising cookies. Details: cookie policy.

Your rights

Under KVKK art. 11 and GDPR arts. 15–21 you may learn whether your data is processed, request information, rectification, erasure and portability, and object. You can download your data as JSON and delete your account in the Data section of your account. For other requests see the data protection request page; requests are answered within 30 days.