How your data is handled.

Privacy notice

This page explains what personal data defneincekara.com collects, why, where it goes and how long it is kept. It is written to meet the disclosure duty in Article 10 of Turkish data protection law, Law No. 6698 (KVKK).

Who is responsible

Defne İncekara. This site is personally mine, and I am the data controller for everything described below.

For any question, request or formal application: defneincekara@kurm.ai

What is collected

The site only collects data when you fill in a form yourself. Nothing is gathered in the background while you browse. The fields differ by form:

Contact and proposal form
Name, email address, phone number, organization, type of request, event date, event location, budget range and your message.
Newsletter
Email address.
Playbook download
Email address.
Challenge registration
Email address.
Certificate request
Name, email address, organization, the name of the programme you attended, the training date, its duration and the document number if you have one.

Why it is collected

  • Proposal and contact requests: to reply, check availability and prepare a proposal for your organization.
  • Newsletter: to send you the newsletter you subscribed to.
  • Playbook and challenge: to send you the document or content you asked for and to recognise your registration.
  • Certificate: to issue your certificate and to let its QR code be verified later.

None of this is used for advertising, sold, or passed to third parties for marketing.

Legal basis

Proposal, contact and certificate requests are processed under Article 5(2)(c) of the Law, because they are directly related to forming or performing a contract. Newsletter, playbook and challenge registrations rest on the explicit consent you give when submitting the form. You can withdraw that consent at any time.

Who it is shared with

Nobody, apart from the service providers that keep the site running:

  • Netlify: hosting and form submissions. When you submit a form, the record is stored on Netlify's servers.
  • Substack: the newsletter list and its delivery.
  • GitHub: certificate records only. The record is stored in the site's source repository so the QR code on the document can be verified.

These providers' servers are outside Türkiye, so submitting a form means your data is transferred abroad and that you consent to that transfer.

How long it is kept

  • Proposal and contact requests: until the request is concluded, and after that only for as long as legal retention duties require.
  • Newsletter: until you unsubscribe. Every issue carries a one-click unsubscribe link.
  • Playbook and challenge registrations: until you ask for the record to be deleted.
  • Certificate records: indefinitely. This is deliberate: the QR code printed on a certificate has to keep working years later. If you ask for your record to be deleted, your certificate can no longer be verified.

There are no cookies

This site sets no cookies. There is no Google Analytics, no Tag Manager, no advertising pixel and no comparable tracker. Typefaces are served from my own server, so no font request leaves the page. That is why you never see a cookie consent banner here.

Two exceptions, stated plainly:

  • One entry is kept in your browser by the challenge page, to remember that you registered. It stays in your browser's own storage and never reaches me.
  • The video player. No request goes to YouTube unless you click a video card. When you do, the player loads from YouTube's privacy-enhanced domain, and at that point YouTube can see your IP address.

Your rights

Under Article 11 of the Law you can ask me to:

  • Tell you whether your personal data is being processed, and if so, give you information about it
  • Explain the purpose and whether the data is used in line with it
  • Name the third parties it has been transferred to, in Türkiye or abroad
  • Correct it if it is incomplete or wrong
  • Erase or destroy it, within the conditions the Law sets
  • Notify those third parties of any correction, erasure or destruction
  • Object to a result reached solely by automated analysis that works against you
  • Compensate damage caused by unlawful processing

Send your request to defneincekara@kurm.ai. I will answer within thirty days at the latest.

Changes

This notice is updated whenever the data collected or the services used change. Updates are published on this page.

Last updated: 2 November 2026