Privacy Notice (KVKK)
Draft — legal review in progress. Highlighted fields and some provisions will be finalised before launch.
This English version is provided for convenience. If there is any inconsistency, the Turkish version prevails.
At SectorBeat we care about protecting your personal data. Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for the Obligation to Inform, this notice explains how your personal data is processed when you use the SectorBeat website and apps (the “Platform”).
1. Data controller
Your personal data is processed by [data controller's full name / company name] (“SectorBeat”, “we”) as the data controller.
- Address: [postal address]
- Email: [contact email address]
- Registered e-mail (KEP): [registered e-mail (KEP) address — if any]
2. Personal data we process
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Email address |
| Membership and preferences | An irreversible hash of your password, language, favourite driver and team, email verification status, account role, date joined; where applicable, the suspension record and reason |
| Transaction security | Session records (start and end time), an irreversible keyed hash of your IP address (the raw IP address is not stored), browser and device information; account activity (sign-up, sign-in, sign-out, email verification, password reset, profile update, data export, account deletion and admin actions) |
| Platform usage | Last sign-in time, last seen time and online status, approximate time spent on the Platform per day (minutes). Which pages or articles you read is not recorded per person. |
| Profile photo (optional) | If you choose to upload one, your profile photo (resized to 256×256 pixels, with embedded details such as location removed) and the colour you choose for your profile icon |
| Consent records | Acceptance of the privacy notice and terms of use, your email contact permission; the version and date of the accepted text |
| Notification subscription (optional) | If you turn on race notifications: the subscription address and encryption keys issued by your browser’s push service, your language and device type (iPhone / Android / computer). No name or email is required; if you are signed in, the device is linked to your account. |
We do not process special categories of personal data (health, religion, political opinion, etc.) or payment information.
When you visit the Platform without an account, we keep no record that identifies you. Article reads, ad impressions and clicks are kept only as anonymous totals. For security (e.g. limiting repeated failed sign-in attempts) your IP address is processed briefly in server memory and is not stored.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating your account, verifying your email address, handling sign-in and password reset | Formation and performance of a contract (Art. 5/2-c) |
| Storing your preferences such as language, favourite driver and team, and presenting the Platform accordingly | Formation and performance of a contract (Art. 5/2-c) |
| Showing the profile photo you choose to upload as your profile icon (visible only to you and to administrators who manage accounts; no face recognition or other biometric processing) | Formation and performance of a contract (Art. 5/2-c) — optional; without a photo your initials are shown |
| Keeping accounts secure, preventing unauthorised access and misuse, recording account activity | Legitimate interest (Art. 5/2-f) |
| Operating, managing and improving the Platform with measures such as online status, last seen and daily active time | Legitimate interest (Art. 5/2-f) |
| Suspending accounts that breach the Terms of Use; using records as evidence in possible disputes | Establishment, exercise or protection of a right (Art. 5/2-e) |
| Responding to your requests under KVKK, meeting requests from competent authorities, keeping consent records | Compliance with a legal obligation (Art. 5/2-ç) |
| Sending the daily news digest and Platform announcements by email (only if you subscribe) | Explicit consent (Art. 5/1) — see the Explicit Consent Text |
| Sending race notifications to your device if you turn them on — shortly before the race starts and at key moments (safety car, red flag, result, etc.) | Explicit consent (art. 5/1) — given through your browser’s permission prompt when you turn notifications on; withdraw it any time with “Turn off notifications” in the menu or in your browser settings |
4. How we collect data
Your personal data is collected electronically, partly or fully by automated means, when you fill in the sign-up, sign-in and profile forms and while you use the Platform, through cookies and similar technologies and the technical information your browser sends. See the Cookie Policy for details.
5. Transfers
We do not sell your personal data or share it with third parties for advertising. Your data may only be transferred, to the extent necessary, in the following cases:
- Our service providers (as data processors): the server and database service hosting the Platform (Railway Corp. (USA) — servers in Europe (Netherlands); domain / DNS: Cloudflare, Inc. (USA)) and the email delivery service (Resend, Inc. (USA); incoming email forwarding: Cloudflare, Inc. (USA)) — only to provide the service.
- Your browser’s push service for delivering notifications (e.g. Apple, Google, Mozilla): only the subscription address and the encrypted notification content; these services’ servers may be located abroad.
- Competent public authorities and courts — where required by law.
The AI service used to write articles (Cloudflare Workers AI) only receives publicly available news headlines and summaries; your personal data is not sent to it.
If the selected hosting or email provider has servers outside Türkiye, the transfer will be made in line with Article 9 of KVKK (with appropriate safeguards such as an adequacy decision or standard contractual clauses) and this notice will be updated.
6. Retention periods
| Data | Period |
|---|---|
| Account and profile data | As long as your account is open; deleted when you delete your account. |
| Account activity (logs) | 12 months, then deleted automatically. If you delete your account, the logs are unlinked from you (anonymised). |
| Daily activity records | 12 months, then deleted automatically. |
| Session records | Up to 30 days or until you sign out. |
| Email verification and password reset links | Valid for 24 hours and 1 hour respectively; expired links are deleted. |
| Profile photo | Until you remove it or delete your account; the file is deleted immediately when you remove it. |
| Consent records | As long as your account is open. |
| Daily digest delivery records (recipient, day, success) | 12 months, then deleted automatically. |
| Email contact permission | Until you withdraw it or delete your account. |
| Notification subscription | Until you turn notifications off; deleted automatically if the browser invalidates the subscription (permission removed, app deleted). |
7. Your rights (KVKK Art. 11)
By contacting us, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions of Article 7 of KVKK,
- request that correction, deletion or destruction be notified to the third parties the data was transferred to,
- object to a result against you arising exclusively from automated analysis,
- claim compensation if you suffer damage due to unlawful processing.
8. How to apply
On the My Profile page you can download your data (JSON), correct your details and permanently delete your account.
For other requests, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in writing to [postal address], via registered e-mail (KEP) to [registered e-mail (KEP) address — if any], or from the email address registered on the Platform to [contact email address]. Your application must clearly state your name, last name, contact details and request.
Your request will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or it is not answered in time, you may file a complaint with the Personal Data Protection Board (KVKK Art. 14).
Explicit Consent Text — Email contact
Reading this text on the sign-up form, in the newsletter box at the bottom of the site or on your profile page and pressing “I have read and consent” means you give explicit consent to the processing below. This permission is optional; not giving it does not affect your membership in any way. Our newsletter is sent to members only.
- Data processed: first name, last name, email address, language, favourite driver and team.
- Purpose: sending, every morning (09:00 Turkey time), a daily digest of the news published since the previous digest, and Platform announcements, by email. No email is sent if there is no new news; emails contain no ads, and opens or clicks are not tracked.
- Transfer: only to the email delivery service provider (Resend, Inc. (USA); incoming email forwarding: Cloudflare, Inc. (USA)).
You can withdraw your permission at any time using the “Unsubscribe” link in every email, from your profile page or by writing to [contact email address]; withdrawal applies to future processing. Commercial emails are sent in line with Law No. 6563 on the Regulation of Electronic Commerce and the rules of the Message Management System (İYS).
Changes
We update this notice as our data processing changes. The current version is published on this page with its effective date; we will let you know about significant changes by email or on the Platform.