At a glance
- Accounts and forms
- None
- Cookies set by KursSpot
- None
- Click records
- A random reference, deleted after 24 months
- Your IP address
- Not saved by KursSpot
Who is responsible
The data controller is Özgür Saygı, the publisher of KursSpot (kursspot.com). You can reach us at [email protected].
This policy is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). If the EU or UK General Data Protection Regulation (GDPR) applies to you, it also gives the information required by Article 13 of the GDPR.
What we process, why and for how long
All of the data below is collected automatically, by electronic means, when you use the site, except emails, which you send to us yourself.
| Data | Purpose | Kept for |
|---|---|---|
| Click record when you choose an offer ("View on …"): date and time, the offer, the page you came from, a random click reference, and whether your browser looked like an automated bot. Your IP address and browser details are not stored. | Matching sellers' commission reports to our records; learning which pages are useful. | 24 months, then deleted automatically |
| IP address on our server | Limiting the number of requests per visitor to prevent abuse. | About one minute, in memory only |
| Connection data handled by our hosting providers: IP address, browser type, page requested, time | Delivering the site and protecting it against attacks. | The providers' own retention periods |
| Emails you send us: your email address, name if you give it, and your message | Answering you and handling your request. | As long as needed to handle your request |
Our legal basis is our legitimate interest in running, securing and funding the site (KVKK Article 5(2)(f); GDPR Article 6(1)(f)). We don't use your data for automated decisions about you, and we don't sell it.
Who receives the data
We use these service providers, who process data on our behalf:
- Cloudflare: domain, website hosting, email forwarding
- Render: application server (Oregon, United States)
- Neon: database for click records (Oregon, United States)
- Google: the mailbox where emails to us arrive
- Resend: sending our email replies (Ireland)
Sellers: when you choose an offer, the click reference is added to the link that takes you to the seller. From then on the seller's own privacy policy applies. Products and prices are fetched from sellers by our server, so your browser doesn't connect to a seller until you choose an offer.
We may also disclose data to public authorities when the law requires it.
Transfers outside Türkiye
Our providers run servers outside Türkiye, including in the United States and the European Union, so the data above is transferred abroad. These transfers take place under KVKK Article 9 and, where the GDPR applies, Chapter V of the GDPR, based on the providers' data processing terms, which include standard contractual clauses.
Your rights
Under KVKK Article 11 you can ask us to:
- tell you whether we process your personal data, and give you information about it;
- tell you why it is processed and whether it is used for that purpose;
- tell you which third parties, in Türkiye or abroad, receive it;
- correct it if it is incomplete or wrong, or delete it under KVKK Article 7;
- inform the third parties who received it of a correction or deletion;
- hear your objection to a result that goes against you and comes only from automated analysis;
- compensate you for damage caused by unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, and you can complain to the data protection authority where you live or work.
To use a right, email [email protected]. Click records are not linked to your name, so tell us the date, time and page of your click and we'll look for it. We may ask you to confirm your identity. We answer free of charge within 30 days. If you're not satisfied with our answer under KVKK, you can complain to the Personal Data Protection Board (KVKK Kurulu) within 30 days of our reply, or within 60 days of your request if we haven't replied.
Children
The site is meant for adults planning trips. We don't knowingly collect data about children.
Changes to this policy
When we change this policy we update the date at the top of the page.