Every release, sealed.

Draft — legal review required [VERIFY]

UK GDPR Notice

Last updated:

1. Scope

This notice supplements our Privacy Policy for people in the United Kingdom. It gives the information required by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), to the extent these laws apply to our processing (Art. 3(2) UK GDPR) [VERIFY].

2. Controller

[COMPANY], [ADDRESS] (MERSIS no. [MERSIS NO]), e-mail: privacy@vefkmedia.com. The controller is established in Türkiye [VERIFY].

3. UK representative and data protection officer

  • UK representative (Art. 27 UK GDPR): [UK REPRESENTATIVE VERIFY]. Whether we are required to appoint a representative is under review.
  • Data protection officer: [DPO VERIFY].
  • Server logs: when you open a page, our hosting provider processes your IP address, the date and time of the request, the page requested, the referring page, and browser and operating system details (user agent). Purpose: delivering the website, detecting and preventing abuse, keeping the service stable. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) UK GDPR).
  • E-mail: if you write to us, we process your e-mail address, your name if you give it, the content of your message and the time it was sent. Purpose: answering your request and keeping a record of the correspondence. Legal basis: steps prior to or performance of a contract where your request concerns one (Art. 6(1)(b) UK GDPR), otherwise our legitimate interest in answering messages (Art. 6(1)(f) UK GDPR).
  • YouTube and Spotify players (click-to-load): only after you click a player’s button does your browser connect to Google Ireland Limited (YouTube, served from youtube-nocookie.com) or Spotify AB and transmit at least your IP address and the page address. Legal basis: your consent, given by the click (Art. 6(1)(a) UK GDPR).

Server logs are technically necessary to show the website; e-mailing us and loading a player are optional. This website has no accounts, forms, analytics or advertising.

5. Cookies and your device (PECR)

This website sets no cookies and uses no local storage or similar technologies; in particular, it uses none that require your consent under regulation 6 PECR. YouTube and Spotify players load only after you click their button; the provider may then set its own cookies or similar identifiers. To that extent, this relies on the consent you give with that click [VERIFY]. Reloading the page turns the player off again. Details are in our Cookie Policy.

6. Recipients

  • Our hosting provider [HOSTING PROVIDER VERIFY], which processes server logs on our behalf.
  • Our e-mail provider Google Workspace.
  • If you click a player: Google Ireland Limited (YouTube) or Spotify AB, which receive the data directly from your browser and apply their own privacy policies.

7. Transfers to Türkiye and other third countries

The controller is established in Türkiye, so personal data we receive through this website or by e-mail is processed in Türkiye [VERIFY]. Our hosting provider and e-mail provider may also process data in other countries outside the UK [VERIFY]. Where a transfer needs a safeguard under Chapter V UK GDPR, we rely on [TRANSFER MECHANISM VERIFY], for example appropriate safeguards under Art. 46 UK GDPR such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses [VERIFY]. You can request a copy of these safeguards at privacy@vefkmedia.com.

The providers of the players may process data outside the UK, including in the United States [VERIFY].

8. Retention

  • Server logs: deleted after [RETENTION PERIOD VERIFY], unless a security incident requires longer storage.
  • E-mails: [RETENTION PERIOD VERIFY], or longer where a legal retention duty applies.
  • Players: YouTube and Spotify keep the data they receive under their own policies.

9. Your rights

Under Arts. 15 to 21 UK GDPR you have the right to:

  • access your data (Art. 15);
  • have it rectified (Art. 16);
  • have it erased (Art. 17);
  • restrict its processing (Art. 18);
  • data portability (Art. 20), where processing is based on consent or a contract and carried out by automated means;
  • object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) UK GDPR (Art. 21).

You can withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3) UK GDPR); reloading the page is enough. We do not make decisions based solely on automated processing, including profiling (Art. 22 UK GDPR).

To exercise your rights, write to privacy@vefkmedia.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), ico.org.uk.

10. Turkish law

Because the controller is established in Türkiye, the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) also applies to our processing [VERIFY]. The KVKK information notice is available in Turkish: KVKK Aydınlatma Metni. It also sets out your rights under Art. 11 KVKK.

11. Changes

We update this notice when the website, our processing or the law changes. The date at the top shows the current version.

← Back to home