Information Notice under Turkish Law No. 6698 (KVKK)

1. Data controller

The data controller under the Law is:

• Data controller: Safha Halit ALTIN
• Address: Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe İstanbul, Türkiye
• General contact: [email protected]
• Applications concerning personal data: [email protected]

2. Categories of personal data processed

Depending on how you use the service, the following personal data may be processed. We do not request any special categories of personal data.

If you use Kinozine as a guest, your list is kept only in your own browser and is not processed by us. Our anonymous, aggregated page-view counts are not personal data.

• Identity data: username and, optionally, a display name.
• Contact data: email address, and the log of emails we send you (recipient address, subject, delivery status and time).
• User transaction data: titles on your list, watch status, personal scores, episode progress, favorite titles, your recent activity feed, language and theme preferences, and the related timestamps.
• Profile data (optional): bio, location, links to social media profiles, profile design choices and visibility settings.
• Visual data (optional): the avatar image you upload.
• Transaction security data: password hash (argon2id), session token hash, browser user-agent string, session creation, last-use and expiry times, two-factor authentication secret (encrypted) and recovery codes (hashed), account role, account creation, last login and last activity times, IP addresses held only in server memory for at most 1 hour, and administrator audit log entries.
• Legal transaction data: the date on which you accepted the Terms of Use, and correspondence relating to applications you make under the Law.
• Request and correspondence data: the content of emails you send us.

3. Purposes of processing

• Creating, verifying and managing your membership account
• Providing the film and series list, scoring, episode tracking and profile features
• Operating public profile and list features according to your visibility choices
• Sending password reset emails, email change confirmations and security notices
• Ensuring information security and preventing unauthorized access, abuse and attacks (rate limiting, session security, two-factor authentication)
• Detecting violations of the Terms of Use and carrying out moderation
• Ensuring that administrator actions can be audited
• Answering your requests, questions and applications as a data subject
• Fulfilling data export (data portability) and account deletion requests
• Fulfilling legal obligations and providing information to authorized persons, institutions and organizations
• Establishing, exercising and protecting rights in the event of a dispute

4. Method of collection and legal grounds

Your personal data is collected electronically, by automated or partly automated means, through the registration, profile and settings forms, your list actions, strictly necessary cookies and the requests your browser sends to our server, and by email if you write to us.

Your personal data is processed on the following legal grounds set out in Article 5(2) of the Law. None of our processing activities is based on your explicit consent.

• (c) Processing is necessary, provided that it is directly related to the establishment or performance of a contract, for the personal data of the parties to the contract: creating and managing your account, providing the list and profile features, sending account emails and data export.
• (ç) Processing is necessary for the data controller to fulfil its legal obligations: answering data subject applications and requests from competent authorities.
• (e) Processing is necessary for the establishment, exercise or protection of a right: administrator audit logs and keeping records needed in the event of a dispute.
• (f) Processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms: information security, rate limiting, abuse prevention, session security, the mail log, creating anonymous statistics and answering general enquiries.

5. Transfer of personal data

Film and series information and images come from The Movie Database (TMDB), but no personal data is transferred to TMDB. Our server retrieves this data and your browser does not connect to TMDB. Your search terms are forwarded to TMDB without any information that identifies you.

If you set your profile or list to public, that information can be viewed by anyone at https://kinozine.com in accordance with your choice.

Your personal data is not sold, rented or shared for marketing purposes. It may only be transferred to the following recipients for the following purposes:

• Transfer abroad to our hosting provider: all site data and emails are stored on a server in Germany operated by Hetzner Online GmbH, which acts as a data processor. This constitutes a transfer of personal data abroad under Article 9 of the Law (as amended in 2024). The transfer takes place for the purpose of providing hosting and email services and is based on a standard contract, one of the appropriate safeguards provided for in Article 9 of the Law.
• Competent public institutions and judicial authorities: only where there is a legal obligation to do so and in accordance with Article 8 of the Law.

6. Retention periods

Your personal data is kept only for as long as necessary for the purposes for which it is processed and is then deleted, destroyed or anonymized. The main retention periods are:

• Account, profile and list data: until you delete your account; after deletion, immediately from the live database and within 7 days at the latest from encrypted backups
• Session data: 30 days
• Verification links: 48 hours; password reset links: 1 hour
• IP addresses: in server memory only, for at most 1 hour
• Mail log: 90 days
• Administrator audit log: 1 year
• Emails you send us: as long as needed to handle your request and any follow-up
• Anonymous aggregated statistics: indefinitely, as they are not personal data
• Where a longer retention period is required by law or the data is needed to establish, exercise or protect a right, only the data concerned is kept, and only for as long as necessary

7. Data security

In accordance with Article 12 of the Law, we take the necessary technical and organizational measures to keep your personal data secure. These include encrypted connections (HTTPS), password hashing with argon2id, two-factor authentication (optional for users and mandatory for administrators), rate limiting, CSRF protection, a strict Content Security Policy, encrypted backups, and least-privilege administrator access with an audit log.

8. Your rights under Article 11 of the KVKK

Under Article 11 of the Law, you may apply to the data controller to exercise the following rights:

• (a) to learn whether your personal data is processed;
• (b) to request information about the processing if your personal data has been processed;
• (c) to learn the purpose of the processing and whether your personal data is used in line with that purpose;
• (ç) to know the third parties in Türkiye or abroad to whom your personal data is transferred;
• (d) to request the correction of your personal data if it is incomplete or inaccurate;
• (e) to request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law;
• (f) to request that the actions taken under (d) and (e) be notified to third parties to whom your personal data has been transferred;
• (g) to object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems;
• (ğ) to claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

9. How to apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), you can submit your request in one of the following ways:

• In writing: by sending a signed letter to Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe İstanbul, Türkiye by post or delivering it by hand.
• By email: by writing to [email protected] from the email address that is registered in your Kinozine account and that you have therefore previously notified to us.
• By other methods provided for in the Communiqué: using registered electronic mail (KEP), a secure electronic signature or a mobile signature, sent to [email protected].

10. Content of your application and our response

Under the Communiqué, your application must include: your name and surname and, for written applications, your signature; for Turkish citizens, your Turkish ID number (T.C. kimlik numarası), and for foreign nationals, your nationality and passport number or, if any, identity number; your residential or business address for notifications; if available, an email address, telephone and fax number for notifications; and the subject of your request. Mentioning your Kinozine username helps us link your request to your account.

We will conclude your application as soon as possible depending on the nature of the request and within 30 days at the latest, free of charge. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. We may ask for additional information to verify your identity.

If your application is rejected, if you find our answer insufficient or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of our answer, and in any case within 60 days of the date of your application.

You can also exercise some of your rights directly in your account: you can correct your information in Settings, export your data as a JSON file and delete your account at any time.

11. Updates

We update this information notice when necessary. The current version is always published on this page, together with the date of the latest update.