Legal Document
Your data belongs to you. Our policy is short and clear.
What data NoorSada collects, how it's used, what rights you have. KVKK and GDPR compliant.
Data Controller
This policy is published by the data controller operating the NoorSada platform. It is compliant with the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law (KVKK, Law no. 6698).
Data Controller: NoorSada Media · Contact: privacy@noorsada.com · Data Protection Officer (DPO) reachable at the same address.
What We Collect
We collect data in four limited categories. No special-category data (health, ethnicity, biometric) is collected.
Account Data
Email, name, hashed password, language and content preferences. Only for sign-in and personalization.
Log Data
Anonymized IP, browser info, visit timestamps. Only for security and analytics, retained 90 days.
Cookies
Essential cookies (session), measurement cookies (with consent), preference cookies (language/theme). No third-party advertising cookies.
Banner Data
For the location-aware info banner (weather, currency, crypto), your approximate location is resolved from your IP — never stored.
Legal Basis
Every processing purpose has an explicit legal basis.
| Purpose | KVKK | GDPR |
|---|---|---|
| Account management, sign-in, identity verification | Art. 5/2-c | Art. 6(1)(b) |
| Legal obligations (tax, audit log) | Art. 5/2-ç | Art. 6(1)(c) |
| Newsletter, notifications, personalization | Art. 5/1 — explicit consent | Art. 6(1)(a) |
| Security, fraud prevention, service improvement | Art. 5/2-f | Art. 6(1)(f) |
Third-Party Data Flow
Below are the only services we share data with — strictly for functional necessity.
- yahooStock and FX prices (symbol only — no personal data)
- coingeckoCrypto prices (no personal data)
- openmeteoWeather — approximate city coordinates only
- ipapiIP-to-country/city resolution (not stored, real-time)
- cloudflareCDN and DDoS protection — IP transit (Cloudflare DPA applies)
- resendNewsletter and account e-mail delivery (Resend) — e-mail address only
We never sell or share data with ad networks, tracking services, or data brokers.
Cookie Policy
We use three cookie categories: essential, analytics, marketing. We ask your preference on first visit.
Session & Security
Keep you signed in and protect the site. Cannot be declined — the site won't work without them.
Anonymous Measurement
Helps us understand how the site is used. IP addresses are anonymized. Active only with your consent — disable any time.
Advertising & Targeting
Helps us show more relevant ads and content. Not active today; if we ever introduce ad infrastructure, your consent will be requested.
Your Rights
Rights guaranteed under KVKK Art. 11 and GDPR Art. 15-22.
- 01
Access
You can find out what data we hold about you.
- 02
Rectification
You can correct inaccurate or incomplete data.
- 03
Erasure (Right to Forget)
You can request deletion of your data.
- 04
Restriction of Processing
You can pause processing temporarily.
- 05
Data Portability
You can download your data in machine-readable format.
- 06
Object
You can object to certain types of processing.
- 07
Withdraw Consent
You can withdraw any consent you gave at any time.
- 08
Lodge a Complaint
You can complain to a Data Protection Authority (KVKK / DPA).
Retention Period
Data is retained while your account is active. Deleted within 30 days after account closure. Audit logs and invoices may be kept up to 3 years to meet legal obligations.
Policy Changes
We notify you of substantial changes via email and an in-site banner. You receive at least 30 days' notice before any new version takes effect.
Contact
For Data Protection Questions
To exercise your rights or ask about this policy, write to our Data Protection Officer.
If you have a complaint, you may file it with KVKK (kvkk.gov.tr) in Türkiye, or with your country's Data Protection Authority within the EU.