Privacy Policy

1. Controller

Mesut Yıldız (MY Angora Studios)
Yeni Batı Mah., 2386. Cad. No: 60
06370 Ankara
Türkiye
Email: mesut@mesutyildiz.com

Under the KVKK, Mesut Yıldız is the data controller (“Veri Sorumlusu”).

Our offering is also directed at visitors in the EU, in particular in Germany. The GDPR therefore also applies (Art. 3(2) GDPR).

2. Summary

• We use no tracking, no analytics tools and no advertising cookies.
• Fonts are served from our own server – there is no connection to Google Fonts.
• YouTube videos only load after you explicitly click (two-click solution).
• Contact form data is used solely to handle your enquiry.
• Visitor data is not passed on to AI services; we use AI tools only internally to produce our content.
• There is no automated decision-making, including profiling.

3. Hosting and server log files

This website runs on a server we rent from a hosting provider. The provider processes data on our behalf (processor, Art. 28 GDPR) and is a recipient of the data listed below.
Provider: Keyubu
Server location: İstanbul/Türkiye

When you access the website, the web server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer URL, browser and operating system. This data is required to deliver the website, ensure security and fend off attacks, and is deleted after 14 days at the latest.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK).

4. Cookies and local storage

We only use strictly necessary cookies and storage entries (your language choice, login to the non-public editorial area and – only if you wish – your consent to load YouTube videos). No consent is required for strictly necessary storage. See our cookie policy for details.

5. Contact form and email

If you write to us via the contact form or by email, we process your name, email address, message, chosen language and, to prevent abuse (limiting the number of enquiries per hour), a hash (SHA-256) of your IP address. The plain IP address is not stored with the enquiry; the hash is nevertheless regarded as pseudonymised personal data. The legal basis for this is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK).

Providing your name, email address and message is voluntary but necessary for us to answer your enquiry.

The purpose is to handle your enquiry. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 5(1) KVKK) and – for enquiries about a possible collaboration – pre-contractual measures (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK). You may withdraw your consent at any time with effect for the future.

We delete enquiries 12 months after we have marked them as handled (read), at the latest 24 months after receipt (in each case including the associated hash) unless statutory retention obligations apply. If email notification is enabled, the content of your message is forwarded to our mailbox via the email service provider we use (processor). Messages received by email are deleted by the same standard.

6. YouTube videos

On some pages we embed videos from our YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and only load when you click “Load video”. No connection to YouTube is made before that.

After your click, your IP address, the page visited and technical device information in particular are transmitted to YouTube; YouTube may set cookies. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework (EU Commission adequacy decision). Google determines how long the data is stored.

The legal basis is your consent (Art. 6(1)(a) GDPR; for transfers abroad Art. 9 KVKK). If you choose “always load”, we store this decision only locally in your browser. You can revoke it here at any time:

More information: Google privacy policy.

7. Links to social networks

We link to our profiles on YouTube, Instagram, TikTok and Facebook. These are plain links – no plugins are embedded and no data is transmitted before you click a link. After clicking, the privacy policy of the respective platform applies.

8. Transfers to third countries

The controller is based in Turkey. There is no EU Commission adequacy decision for Turkey. Data you send us via the contact form or by email is processed in Turkey to handle your enquiry. The basis is your explicit consent (Art. 49(1)(a) GDPR, given via the checkbox in the form) or pre-contractual measures taken at your request (Art. 49(1)(b) GDPR). Risk notice: Turkey may not offer a level of protection equivalent to EU law, and enforcing your rights may be more difficult.

The recipients of your data are only ourselves, our hosting provider and – if enabled – our email service provider (as processors); when you load a YouTube video, additionally Google (see section 6). Data is not passed on for advertising purposes.

9. Your rights under the GDPR

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))
• Complaint to a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77)

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (server log files, abuse protection), you may object at any time on grounds relating to your particular situation; simply send your objection to mesut@mesutyildiz.com.

There is no automated decision-making, including profiling (Art. 22 GDPR).

10. Your rights under the KVKK

Under Art. 11 KVKK you have the right in particular to learn whether your data is processed, to request information about it and its purpose, to know the recipients in Turkey and abroad, to request rectification, erasure or destruction, to object to outcomes based solely on automated analysis, and to claim compensation for unlawful processing.

Please send requests in writing or by email to mesut@mesutyildiz.com. We will respond within 30 days at the latest. If a request is rejected, the answer is insufficient or it is not answered in time, you may lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu / Board) within 30 days of learning of the answer and in any case within 60 days of your request (Art. 14 KVKK). We may ask for additional information to verify your identity.

11. Children

Some of our content is aimed at children; however, the website itself does not collect data from children. Persons under 16 should only use the contact form with parental consent.

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.