Privacy Policy and KVKK Data Protection Notice

1. Data Controller and Scope

Pursuant to Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable international data protection laws (including UK GDPR and EU GDPR), the data controller for reader accounts, digital archive features, and subscription services on Yeniden Ergenekon is MISTIKIST LTD (71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · Company No: 15705777 · Email: [email protected]).

2. Personal Data Processed and Purposes

We process only the personal data strictly necessary to deliver and secure our services electronically:

• Account and Identity Information (Name, email address, profile picture, Google account ID): Creating, verifying, and authenticating your reader account.
• Reading and Library Records (Bookmarks, likes, reading progress, and history): Allowing you to access saved articles and resume reading across your devices.
• Subscription and Billing Records (Selected plan, subscription status, Stripe customer and transaction references): Activating Ergenekon Dostu memberships and fulfilling statutory invoicing and accounting obligations (payment card numbers and CVC codes are processed directly by Stripe PCI-DSS infrastructure and are never stored in our database).
• Archive Sage and Comment Records (Submitted research questions, saved conversations, and article comments): Generating source-cited research answers and operating the reader discussion section.
• Communication and Newsletter Records (Newsletter preferences and support/rights requests): Sending optional daily editorial newsletters and responding to reader inquiries.
• Security and Technical Logs (Session tokens, IP address, Cloudflare Turnstile verification, and daily quota logs): Maintaining cybersecurity and preventing automated bot abuse.

3. Lawful Bases for Processing

Your personal data is processed pursuant to KVKK Article 5/2 and GDPR Article 6 on the bases of: performance of a contract (reader account and subscription services), compliance with legal obligations (tax, accounting, and consumer protection laws), legitimate interests balanced against your fundamental rights (network security and abuse prevention), and explicit consent for optional features (daily email newsletter and optional analytics cookies).

We never use your reading history or library records to infer or profile political opinions, philosophical beliefs, or religious views.

4. Infrastructure Providers and International Data Transfers

To deliver a reliable and secure platform, we use Google for authentication, Stripe for payment and subscription processing, Microsoft Azure for cloud hosting, AI, and speech synthesis, and Cloudflare for content delivery and network security.

Cross-border data transfers are safeguarded in accordance with KVKK Article 9, United Kingdom and European Union Adequacy Decisions, and Standard Contractual Clauses (SCCs).

5. Data Retention and Deletion

Your reader account and library records are retained for as long as your account remains active; upon an account deletion request, your personal profile and reading records are erased. Tax, accounting, and financial transaction records are retained for the statutory periods required by applicable law.

6. Your Rights under KVKK Article 11 and International Law

Under KVKK Article 11 and UK/EU GDPR, you have the right to learn whether your personal data is processed, request information and a portable copy, learn whether it is used in accordance with its purpose, request correction of incomplete or inaccurate data, request erasure when statutory conditions are met, and withdraw consent at any time.

You may submit requests via My Account > Rights and Requests or by emailing [email protected]. Properly submitted requests are answered free of charge within 30 days under KVKK (and within 1 month under UK/EU GDPR). You also retain the right to lodge a complaint with the Turkish Data Protection Authority (KVKK), the UK ICO, or your local EU Data Protection Authority.