Türkiye Personal Data Notice (KVKK)
In force since November 7, 2026 · Version 2026-11-07.2
Türkiye Personal Data Notice (KVKK)
In force since November 7, 2026. This notice is issued by ScholarFolk as data controller under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It applies to everyone whose personal data is processed through ScholarFolk at https://scholarfolk.com. The Turkish text of this notice is authoritative; this translation is provided for convenience.
1. Data controller
ScholarFolk
The contact address will be published here before the public launch of the service.
2. Personal data processed
- Identity and contact data: display name, username, e-mail address, academic title, institution, department, location, website and links, profiles on other networks, ORCID iD.
- Account and transaction security data: sign-in method, sign-in and sign-out records, IP address, device and browser description, session identifiers, two-factor authentication secret (encrypted) and recovery code hashes, record of acceptance of the legal documents.
- Visual data: avatar and cover image, photos, story images, video content and their poster frames.
- Content data: posts, articles, replies, publication listings and their metadata, notes and corrections, direct messages and attachments, likes, bookmarks, reposts, reports.
- Social and preference data: followed and following accounts, blocked and muted accounts, language, time zone, notification, privacy, messaging and display preferences.
- Technical data: server logs (IP address, requested address, status, timing), error reports.
No special categories of personal data within the meaning of Article 6 of the KVKK are requested. Location metadata is removed from photos before storage.
3. Purposes of processing
- creating and operating your account, authenticating you and keeping your session,
- presenting your profile, publications, posts, stories and videos to the audience you choose,
- importing and synchronising publications from ORCID and resolving DOI records through Crossref and DataCite,
- delivering direct messages and stories to their recipients,
- sending notifications and system e-mails in line with your preferences,
- ensuring the security of the service and its members: rate limits, abuse prevention, device management, two-factor authentication, account activity log,
- handling reports and moderating content under the Terms of Use,
- answering your applications, requests and complaints and fulfilling legal obligations,
- producing aggregate statistics on the use of the service without profiling individuals.
4. Legal grounds (Article 5 of the KVKK)
| Purpose | Legal ground |
|---|---|
| account creation, authentication, presentation of your content, messaging, imports and synchronisation, notifications | processing is necessary for the establishment or performance of a contract to which you are party (Art. 5(2)(c)) |
| security measures, moderation, prevention of abuse, aggregate statistics | processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)) |
| retention of records, answering applications, disclosure to authorities | processing is expressly provided for by law and is necessary for the controller to fulfil its legal obligations (Art. 5(2)(a) and (ç)) |
| content you choose to make public | the data is made public by you (Art. 5(2)(d)) |
| optional features that rely on your consent, where any are offered | explicit consent (Art. 5(1)), which you may withdraw at any time without affecting the lawfulness of earlier processing |
5. Method of collection
Personal data is collected electronically through the forms and functions of the service (registration, profile editing, publishing, messaging, settings), automatically by the servers (logs, security records), and from the identity providers and bibliographic sources you choose to use (ORCID, Google, Crossref, DataCite).
6. Transfer of personal data
Domestic transfers (Article 8): data may be transferred to service providers acting on our instructions (hosting, storage, e-mail delivery, error monitoring), to other members to the extent you make content visible to them or write to them, and to competent authorities where the law requires.
Transfers abroad (Article 9): our infrastructure providers and the identity and bibliographic services named above may be located outside Türkiye. The server location will be published here before the public launch. Transfers abroad are carried out on the basis of an adequacy decision of the Personal Data Protection Board where one exists, otherwise under one of the appropriate safeguards in Article 9(4) of the KVKK, such as a standard contract notified to the Board, or, where the law so allows, with your explicit consent or in the exceptional cases listed in Article 9(6).
7. Retention periods
Personal data is kept for the periods set out in the Privacy Notice: account and profile data until deletion of the account and removal within 30 days thereafter; content until you delete it; stories for 24 hours; sessions until sign-out or 30 days after last use; the account activity log for 365 days; server logs for 30 days; moderation records for two years after the decision; and records required to prove legal acceptance for as long as the law requires. At the end of these periods data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Your rights (Article 11 of the KVKK)
You have the right to apply to the data controller to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in accordance with that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request rectification of incomplete or inaccurate data,
- request deletion or destruction of the data under the conditions of Article 7,
- request that rectification, deletion or destruction be notified to third parties to whom the data was transferred,
- object to a result that is to your detriment and arises from analysis of the data exclusively by automated systems,
- claim compensation for damage suffered as a result of unlawful processing.
9. How to apply
You may exercise these rights free of charge in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- through the self-service tools in Settings (Your data and legal: data export and account deletion; Edit profile; Privacy),
- by sending a written application to the postal address above, personally or through a notary,
- by e-mail to the contact address published on this page from the e-mail address registered on your account.
Applications must contain your name and surname, your signature if submitted in writing, your Turkish Republic identity number or, for foreigners, nationality and passport or identity number, your notification address or registered e-mail address, and the subject of the request. We answer free of charge as soon as possible and within thirty days at the latest; where the answer causes a cost, the fee set by the Personal Data Protection Board may be charged. If the application is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning of the answer and in any case within sixty days of the application.
10. Cookies
Only cookies strictly necessary for the service are used (session, sign-in state, language, time zone). No advertising or analytics cookies are set. Details are in the Cookie Notice.
11. Changes
Changes to this notice are published on this page with a new date, and members are shown a banner asking them to review the new version.