KVKK Information Notice
Notice under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data
Last updated: October 12, 2026. This English text is a courtesy translation of the Turkish text. If the two differ, the Turkish text prevails.
1. Data controller
The data controller is Boray Evirgen, an individual software developer and the owner of borayevirgen.com. "BEvn Labs" is a brand name used for mobile apps and is not a registered company or a separate legal entity.
Address for notifications: [[EKSİK: posta adresi: yasal-bilgiler.json dosyasına site sahibi yazacak]]. No data controller representative has been appointed.
2. Who this notice is for
This notice is for people who visit borayevirgen.com, people who email the site owner, people who use the working forms of the demo websites, and people who have been given access to a demo admin panel. It does not cover the One Card Closer mobile app, which has its own privacy policy and does not send personal data to the developer, nor future client websites, which will have their own data controllers.
It is the notice referred to at the point where data is collected, for example on the demo forms. The Privacy Policy explains the website's data handling in more detail.
3. Personal data processed, purposes and legal bases
| Data subject group | Data processed | Purpose | Legal basis (KVKK Art. 5/2) |
|---|---|---|---|
| People who visit the site | IP address, browser and device details, requested address, time (via Cloudflare); Cloudflare Web Analytics measurements (aggregated visit and performance statistics) | Delivering the site, protecting it against attacks and seeing aggregated statistics | (f) legitimate interest |
| People who email the site owner a business or service request | Name, email address, message content | Assessing and answering the request | (c) directly related to the conclusion of a contract |
| People who email the site owner about anything else | Name, email address, message content | Reading and answering the message | (f) legitimate interest |
| People who use demo forms | The name, phone, email and note you type are sent to the server but NOT stored; made-up details are written instead. Stored: choices such as date, time, number of people, room, vehicle, service or treatment. The dental demo has no free-text message field. | Showing how the demo works (checking the request) | (f) legitimate interest. A demo form does not create a contract; no explicit consent is requested. |
| Connections that use demo forms | A shortened, pseudonymous IP digest derived with a server secret (the plain IP address is not stored) | Limiting spam and abuse | (f) legitimate interest |
| Admin panel users | Username, display name, role, password hash, session data | Providing access to the panel and keeping it secure | (f) legitimate interest |
| When a competent authority makes a lawful request | The data the request requires | Meeting a legal obligation | (ç) legal obligation |
Legitimate interest. Where Article 5/2(f) is used, the interest is running, securing and presenting a personal portfolio website and its demos, and limiting abuse. We keep the data to what that needs: there is no advertising or profiling, demo forms keep no name, phone, email or note, and what is kept can be deleted on request. A demo can show how a form works with made-up details, so real personal details are not necessary for it, and we do not claim they are. Your fundamental rights are not expected to be harmed by this, because what is kept is low in sensitivity, is shown only to the site owner and to people the owner gives demo access, and you are told at the form not to enter real information.
Special categories of personal data. We do not intend to process them. The dental demo does not store the name, phone number or email you type and has no free-text field, so a treatment choice is stored with a made-up identity and is not linked to you. Entries created before this change could contain details typed at that time; if you entered real information, ask us to delete it. We do not rely on consent for demo forms.
The data is not used for advertising, profiling or automated decisions.
4. How the data is collected
The data is collected automatically through your browser's requests when you visit a page, directly from you when you send an email or submit a demo form, and from admin panel users when an account is created for them. The legal bases are listed in the table above.
5. Recipients
Personal data is not sold. It can be seen by:
- The site owner.
- People given access to a demo admin panel (for example prospective clients), who can see the entries made in that demo, only for evaluating the demo.
- Service providers that run the site: Cloudflare, Inc. (hosting, delivery, security, Web Analytics and the D1 database) and Google (the Gmail service for emails sent to the site owner). The website no longer loads fonts or anything else from Google.
- Authorities, where the law requires.
6. Transfers abroad
Cloudflare and Google operate servers in several countries, so using them can mean personal data is transferred abroad within the meaning of Article 9 of KVKK. Article 9 (as amended by Law No. 7499) allows a transfer where an adequacy decision exists, or where one of the appropriate safeguards the law lists (for example the Board's standard contracts) is in place, or in the limited incidental cases the law names.
Status. As of the date of this notice, which of these Article 9 mechanisms applies to each provider has not been confirmed by the data controller and is under legal review. We therefore do not state that a particular mechanism is in place. If you want information about a specific transfer, or object to one, contact us (see "How to apply").
7. Your rights
Under Article 11 of KVKK you may apply to the data controller to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request correction if it is incomplete or inaccurate; request deletion or destruction within the conditions of Article 7; request that these actions be notified to the third parties the data was transferred to; object to a result against you that arises from analysis exclusively by automated systems; and claim compensation for damage caused by unlawful processing.
8. How to apply
Everyday requests. For general privacy questions, or to ask for an entry you made in a demo to be deleted, an email to [email protected] is enough. Say which demo or page it concerns, roughly when you entered the information and what you typed, so that we can find it.
Formal KVKK applications. Applications under Article 13 of KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller are made in one of these ways:
- In writing, with a wet signature, by hand, through a notary or by post, to: [[EKSİK: posta adresi: yasal-bilgiler.json dosyasına site sahibi yazacak]].
- By email signed with a secure electronic signature or a mobile signature, sent to [email protected].
- By email from an address you previously gave us and that is registered in our records (for example the address you used to email us before), if we can match it to you.
The application should contain your name and surname (and signature if in writing), your Turkish ID number or, for foreigners, nationality and passport or ID number, your residence or workplace address for notification, your email, phone or fax if you have one, and your request. We try not to ask for more than we need to confirm who you are. If we ask for confirmation, we will not ask you to send documents that are not needed for that purpose.
Time. We answer free of charge and at the latest within 30 days of receiving the application. If answering needs a cost, the fee in the Board's tariff may be charged, and we will tell you first.
Complaint. If your application is rejected, if the answer is insufficient or if no answer is given in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer and in any case within 60 days of your application, as set out in Article 14 of KVKK.