KVKK Information Notice
This notice is given under Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles of the Obligation to Inform. The Turkish version is the reference text. More detail is in the Privacy Policy.
Data controller
Data controller: Emin Karaman, the private individual who runs Filmdex. Contact: supportfilmdex@gmail.com.
No postal address is published; if you need one for your application, you can ask for it by e-mail.
Personal data processed
| Category | Data |
|---|---|
| Identity | First name, last name, date of birth, username |
| Contact | E-mail address |
| Profile and user content | Bio, avatar or uploaded profile photo, visibility setting, recommendation messages |
| Use of the service | Collection, watchlist, star ratings, quiz attempts and results, badges, member titles (unlocked titles and the one you display), the badges you choose for your profile showcase, the time zone your browser reports (for the time-of-day badges), reports about quiz questions |
| Social connections | Friend requests, friendships, blocks, recommendations sent and received, the profile stars you give |
| Requests and complaints | Content reports, e-mails sent to us |
| Transaction security | Password hash, the one-way hash of a sign-up code, session information, IP address, browser information, bot-check signals, rate-limit records, server logs |
| Legal transaction | The version of the Terms of Use and Privacy Policy accepted, and the time of acceptance |
We do not process special categories of personal data (such as health or biometric data). Please do not write such information in your bio, messages or reports.
Purposes of processing
- Creating the membership, managing the account, signing in and sending sign-up and security codes
- Checking the minimum age requirement (16)
- Providing the film collection, quiz, watchlist, rating, badge, friendship and recommendation services and displaying profiles
- Running information security processes; preventing abuse, cheating and automated attacks
- Assessing content reports, moderating user content and removing unlawful content
- Answering requests and complaints of data subjects
- Keeping a record of the acceptance of the Terms of Use and the Privacy Policy
- Fulfilling legal obligations and requests of competent authorities; protecting rights in legal disputes
Method of collection and legal grounds
Your personal data is collected electronically and by automated means: from the information you enter in the sign-up, profile and account forms, from what you do while using Filmdex, from the e-mails you send us and from the technical information your browser sends when it connects to the site.
It is processed on the following legal grounds of Article 5 of the KVKK:
- Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): creating and managing the account, the minimum-age check and providing the Filmdex services.
- Legitimate interests of the data controller (Art. 5(2)(f)): information security, abuse prevention, rate limits, assessing content reports and keeping the acceptance record.
- Compliance with a legal obligation (Art. 5(2)(ç)): acting on notices about unlawful content and answering requests of competent authorities.
- Establishment, exercise or protection of a right (Art. 5(2)(e)): keeping the records needed in case of a dispute.
- Explicit consent (Art. 5(1)): loading the YouTube player when you choose to play a trailer, and the resulting transfer of your data to Google.
Transfer of personal data
Your personal data is transferred, limited to the purposes above, to the following service providers we use to run the service:
| Recipient | Purpose of transfer | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage (profile photos) and server functions | Data stored in the EU (Frankfurt, Germany); company in the US |
| Vercel Inc. | Hosting the website | US; global network |
| Cloudflare, Inc. | Bot check (Turnstile), domain name system and forwarding support e-mails | US; global network |
| Resend | Sending sign-up and security code e-mails | US |
Quiz questions are generated with Google's Gemini service; only film information is sent to it, never data about users. Film searches are run on TMDB by our server without any personal data.
In addition, your browser connects directly to our database provider (Supabase) to load profile photos and check usernames, to TMDB's image servers when it loads film images and, only when you press Play, to YouTube (Google); your IP address and browser information are then processed by these services under their own policies.
All of the recipients above are established outside Türkiye, so these transfers are transfers abroad. Our service providers process data under their own data processing terms and security commitments. These transfers are necessary to provide the service; you can end the processing of your data by these providers at any time by deleting your account.
Your personal data may be disclosed to authorised public institutions and judicial authorities only where there is a legal obligation to do so. Your data is not sold or shared for advertising.
Retention
Personal data is kept for as long as the purpose of processing requires and deleted afterwards. The retention periods are listed in the Privacy Policy. Until you type the e-mail code, a sign-up is kept only as a pending record (the details you entered, with the password and the code as one-way hashes); it is deleted when your account is created, or automatically a few minutes after its code expired (a code works for 15 minutes), at the latest one day after the sign-up.
Your rights under Article 11 of the KVKK
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- learn whether your personal data is processed;
- request information about it if it has been processed;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your personal data is transferred;
- request the correction of incomplete or inaccurate data;
- request the deletion or destruction of your personal data under the conditions of Article 7 of the KVKK;
- request that the correction, deletion or destruction be notified to the third parties to whom the data was transferred;
- object to a result against you that arises from the analysis of the data exclusively by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
You can download a copy of your data with “Download my data” in your profile settings, delete your account with “Delete account”, and correct your profile details under “Edit profile”.
How to apply
Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can send your request by e-mail to supportfilmdex@gmail.com from the e-mail address registered in your Filmdex account, using a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature, or in writing (ask us by e-mail for the postal address).
Under Article 5 of that Communiqué, an application must contain your name and surname (and a signature if it is in writing); for Turkish citizens the Turkish identity number, for foreigners nationality and passport or identity number; an address for notifications; an e-mail address, telephone or fax number if available; and the subject of the request. If you apply from the e-mail address of your account, also give your Filmdex username.
Your application is concluded free of charge as soon as possible according to its nature, and within thirty days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
Complaint to the Board
If your application is rejected, you find the answer insufficient or it is not answered in time, you can lodge a complaint with the Personal Data Protection Board within thirty days of learning the answer, and in any case within sixty days of the application date (Article 14 of the KVKK).