Privacy Policy

This text is published by Oğuzhan Arslan. The current version is available in the legal documents section at https://oguzhanarslan.com.

This text has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, to inform people who visit the site at https://oguzhanarslan.com, use its tools, contact the Seller or make a purchase in the Shop section about the processing of their personal data. Additional information under Article 13 of the General Data Protection Regulation (GDPR) for people in the European Union and the European Economic Area is set out in section 9.

1. DATA CONTROLLER

The data controller is the natural person who operates the site and sells the products and services in the Shop as an individual seller:

Oğuzhan Arslan (the “Seller”)
Address: Şile/istanbul
Email: info@oguzhanarslan.com
Phone: +387 62 903 669

There is no data controller representative or data protection officer acting for the Seller; you can use the contact details above for all requests concerning your personal data.

2. GENERAL PRINCIPLES

The site has no user account system. The site does not use advertising or analytics cookies, tracking pixels or similar tools to track visitors; the Whop payment form is also started by the site with its tracking pixel and usage analytics switched off. This setting does not switch off the device identification technologies that Whop and its payment partners use for payment security and fraud prevention once the payment form opens (3.7 and 3.10). Personal data is not sold or shared for advertising. No special categories of personal data are processed. You will not receive commercial electronic messages (for example, marketing emails) without your consent. The Seller does not make decisions about you solely by automated means and does not profile you; Whop and its payment partners, however, carry out an automated risk assessment for payment security and may decline a payment on that basis. These checks are subject to Whop's privacy policy.

3. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL GROUNDS

3.1 Site visits, hosting and network security: The site is hosted on Vercel Inc. infrastructure, and its domain is delivered through the network of Cloudflare, Inc. When you open the site, technical connection data such as your IP address, browser and device information, the requested address including its query parameters, the request time and the referring address pass through these providers' servers and may be kept in their technical logs. The search text you type in the music notch and, when you return from the payment step, the order key (3.7), payment number and payment status added to the address may therefore also appear in these logs; the order key is also part of the address when the order status is checked. This data is processed to deliver the site, ensure security, block attacks and misuse and fix errors. For this purpose Cloudflare may set a strictly necessary security cookie (for example, “__cf_bm”). Legal ground: the data controller's legitimate interest (KVKK Art. 5(2)(f)).

3.2 Fonts and page files: Fonts and style sheets are loaded from the site's own server; no requests are made to third-party servers such as Google Fonts for this. Third-party scripts are loaded only when you use the relevant feature (3.4 and 3.7).

3.3 Weather widget: When the weather widget on the desktop is on screen, an approximate location based on the connection's IP address is used to show the weather; no lookup is made while widgets are turned off. Only the approximate city and coordinate information added to the request by the hosting provider Vercel is used; because the site is delivered through Cloudflare, this is usually the location of the Cloudflare server your connection passes through. If it is not available, no weather is shown; your IP address is not passed to any other service to determine a location. The approximate coordinates obtained are sent to Open-Meteo to retrieve weather data; your IP address is not sent to Open-Meteo. Your precise location is not requested; your IP address and location are not recorded by the site. The result (city name and weather) is kept only in your browser tab's session storage to avoid repeated requests, is reused for 15 minutes and is deleted when the tab is closed. Legal ground: legitimate interest (Art. 5(2)(f)).

3.4 Music player (YouTube): When you search in the music notch, your search text is searched on YouTube's (Google LLC) public search page through our server; your IP address is not passed to YouTube in this request. Results for the same search may be cached for a few minutes without being linked to anyone. To limit excessive requests, your IP address is held only in temporary server memory for at most one minute and is not stored permanently. Searching loads nothing from YouTube into your browser. When you want to play a video or paste a YouTube link, the music notch first asks for your explicit consent; if you do not consent, the player is not loaded. If you consent, the YouTube player is loaded into your browser directly from Google's servers (www.youtube.com and www.youtube-nocookie.com and, during playback, domains such as googlevideo.com, i.ytimg.com, www.google.com and googleapis.com). Google then processes your IP address, device and browser information and playback interactions under its own privacy policy; it may set cookies on the www.youtube.com domain that are kept for up to 180 days (for example, VISITOR_INFO1_LIVE and YSC) and use browser storage. Your consent applies only to the open tab and you can withdraw it by closing the tab; you can delete the cookies Google has set in your browser settings. Withdrawing consent does not affect processing before the withdrawal. Your listening history is not stored by the site. Legal grounds: legitimate interest for search (Art. 5(2)(f)); explicit consent for loading the YouTube player (Art. 5(1)).

3.5 Wikipedia search: When you search Wikipedia in the web app, type something in the address bar that is not a web address or a portfolio page, or open a result, your browser connects directly to the Wikipedia servers of the Wikimedia Foundation; your search text, IP address and browser information are transmitted to Wikimedia. Results are kept only in the memory of the open page and are not sent to the site's server. Legal ground: legitimate interest (Art. 5(2)(f)).

3.6 Contact form: The contact form does not send data to the server; it opens a draft in your device's email app with the name, email address and message you entered. If you choose to send the email, your name, email address and message content reach the Seller's email account, are stored with the email service provider the Seller uses and are processed to respond to your request. Legal grounds: direct relation to the conclusion of a contract (Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)).

3.7 Shop and payment (Whop): The purchase is completed on this site. When you tick the checkboxes in the Shop and press “Continue to payment”, the site's server creates an order record for this purchase. The order record holds: the order number and an unguessable random order key; the order status (awaiting payment, paid, refunded or cancelled) and the times it was created and updated; your language; the product details at the moment the order is created (product identifier, name, description, access period, delivery method, whether it is delivered instantly, and the amount including all taxes and its currency); the time and version of your pre-order approvals, your approval concerning the exception to the right of withdrawal where applicable, and the version of the legal texts in force at that time; and the identifier and time of the payment session opened at Whop. The wording of those legal texts at that time is also archived unchanged. At this stage your name, email address and IP address are not written into the order record; to limit excessive requests and misuse, your IP address is held only in temporary server memory for at most 15 minutes and is not stored permanently.

The server then opens a one-time payment session at Whop for this order only, with the amount and currency in the order record. For this, the product details the payment session requires (such as the product identifier and name), the amount and currency, the order number, the fact that the order comes from this site, the time and version of your approvals and, where applicable, your approval concerning the exception to the right of withdrawal are passed to Whop; at this step the Seller does not pass your name, email address or IP address to Whop. Whop's payment component is loaded into your browser from Whop's servers only when you press “Continue to payment”, and the payment form opens in the site's payment step, in the language selected on the site. As soon as the payment form opens, before you enter any information, Whop and its payment and fraud-prevention partners (providers observed: Stripe, Sardine, nSure and hCaptcha; Sentry for error logs) derive a device fingerprint from your browser and device characteristics (for example, installed fonts and screen details), use persistent device identifiers and cookies kept for up to a year on their own domains and subject the payment to an automated risk assessment. The email address you enter in the payment form, payment details (including card details), billing and tax information where applicable, and device and connection information are collected directly by Whop and these partners; payment methods such as Apple Pay, Google Pay, PayPal/Braintree or Plaid come into play only when the form offers them and you choose them. Your card details do not pass through the Seller's server and are not shared with the Seller. If your email address belongs to an account registered with Whop, Whop may offer in the payment form to send you a sign-in code for that account. Whop processes this data as an independent data controller under its own privacy policy (https://whop.com/privacy); you can find the current list of its partners and details of these technologies in Whop's privacy policy.

When the payment is completed, Whop sends a signed payment notification to the Seller's server. The Seller matches this notification to the order on the site by the identifier of the payment session opened at Whop for this order and adds to the order record the payment number, payment time, the amount and currency charged, the email address you entered in the payment form and the payment status; if the amount or currency charged differs from the order record, a warning saying so is also added and the order shows as “under review” until the Seller checks it. Your email address is added to the order record only after the payment is completed, from this notification from Whop; records of orders whose payment is not completed contain no email address. If a refund is made, the refund number, status, amount and date are added to the record; if the payment is disputed (chargeback), the dispute's number, status, reason, amount and response deadline are added. Your name, card details and IP address are not kept in the order record. Order records created before this order flow contain the information described in the version of this text in force when they were created and are subject to the same retention periods.

To show the outcome when you return from the payment, your browser checks the order status with the site's server using the order key. This check returns only the order number, order status, amount, currency, the amount and currency charged, payment time, the time of your pre-contract approval and, for display on the return screen and in the downloaded documents, the product details in the order record (product ID, name, description, access period, delivery method and whether it is performed instantly); your email address, the payment and payment session numbers and the other details of the order record are not returned. For the downloaded documents, the same key is used to request the legal texts archived with the order and the seller details at the time of the order. Because anyone who knows the order key can see this information, we recommend that you do not share the return address containing the order key with others.

The Seller can also access, via the Whop dashboard, the buyer information Whop shares with sellers under its Seller Data Sharing Addendum (name, email, address and phone where applicable, IP address, purchase and transaction history, communications and requests relating to the Seller, and transactional analytics); Whop and the Seller are separate, independent controllers of this data.

This data is processed to create the order number, match the payment to the right order and the right amount, prevent duplicate orders and double payments, conclude and perform the contract, deliver, provide support, handle withdrawal and refund requests, prove the pre-contract information and approvals, meet accounting and tax obligations, prevent fraud and protect rights in potential disputes. Legal grounds: conclusion and performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)), establishment, exercise or protection of a right (Art. 5(2)(e)) and legitimate interest (Art. 5(2)(f)).

3.8 Invoicing and accounting: If the law requires an invoice or another document to be issued for a sale, the identity and contact details that must appear on it (such as your full name, address and email) and the transaction details are processed for this purpose; where applicable, this information is passed to the Seller's accountant and electronic document (for example, e-Arşiv invoice) service provider. Legal ground: legal obligation (Art. 5(2)(ç)).

3.9 Product images: Product images are loaded only from the site's own server; no requests are made to third-party servers to show them.

3.10 Browser storage and cookies: Your language, theme, wallpaper, accent colour, widget, desktop icon, Dock and motion preferences and your desktop icon layout are kept in your browser's local storage (localStorage; keys “portfolio-preferences”, “portfolio-desktop-layout” and “wallpaper”). Session storage (sessionStorage) holds the weather result (“portfolio-weather-v1”), the consent you gave for the YouTube player (“portfolio-youtube-consent”) and, when you move to the payment step in the Shop, order information such as the order key and number, product identifier, time of approval and, once the payment is completed, the payment number (keys beginning with “portfolio-shop-”), so that the same order can be used if you try again for the same product within a short time and the outcome can be shown when you return from the payment; all of these records are deleted at the latest when the tab is closed. The order key is sent to the site's server to reuse the order and check its status; the other records are not sent to the server. This information is used only to make the features you request work, so your separate consent is not requested; you can delete it in your browser settings. The site does not set cookies for visitors for its own functions. However, when you press “Continue to payment” in the Shop, Whop's payment script writes the following on the site's domain: the “whop_anonymous_id” cookie (valid for one year; it identifies your device and is sent to Whop), the “_whop_ssk” cookie (about 20 minutes; payment session and fraud prevention) and a “_whop_device” entry in local storage. Because these cookies belong to the site's domain, they are also sent to the hosting providers with your later requests to the site; the site does not read or use them. The identifiers the Whop payment form uses in its own frames are described in 3.7. The Cloudflare security cookie mentioned in 3.1 and, if you consent, YouTube's cookies (3.4) are separate from these. Only for the site administrator who signs in to the admin panel, a strictly necessary, HttpOnly session cookie named “portfolio_admin”, valid for at most 2 hours, is used to keep the session secure; failed admin sign-in attempts are limited by IP address in temporary server memory for at most 15 minutes for security. Legal grounds: legitimate interest for browser storage and the admin session (Art. 5(2)(f)); conclusion of a contract (Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)) for the Whop entries.

4. METHOD OF COLLECTING PERSONAL DATA

Personal data is collected electronically, by automated or partly automated means, through the requests your browser sends when you visit the site, your use of the site's tools, emails you send to the Seller, the creation of an order record on the site with the “Continue to payment” button, the information you enter in the payment form, Whop's payment notifications and the order information shared in the Whop dashboard.

5. TRANSFERS OF PERSONAL DATA

For the purposes in section 3 and only to the extent they require, personal data may be transferred to the following recipients (KVKK Arts. 8 and 9):

a) Vercel Inc., the hosting, server and data storage provider (site content, technical logs and order records, including those of orders whose payment is not completed), as a processor acting for the Seller.

b) Cloudflare, Inc., the domain network, content delivery and security provider (technical connection data), as a processor acting for the Seller.

c) Whop, Inc. and its payment partners for payment processing (order number and order key, product details, amount and currency, and your approvals), as an independent data controller.

d) The Seller's email service provider (email correspondence).

e) The Seller's accountant, electronic document service provider and legal adviser, if any, only to the extent required by the relevant obligations.

f) Competent public authorities and courts upon request and within the scope of legal obligations.

Only approximate coordinates are sent to Open-Meteo; your IP address or any other information identifying you is not sent. YouTube (Google LLC), Wikipedia (Wikimedia Foundation) and the Whop payment form collect data directly from your browser when you use the relevant feature; in that case the data is not transferred by the Seller, and these services process it under their own privacy policies.

Because the servers of Vercel, Cloudflare and Whop may be located abroad (for example, in the United States of America or in European Union countries), the transfers above result in your personal data being transferred abroad. Transfers abroad are subject to Article 9 of the KVKK: a transfer must rest on an adequacy decision provided for in that article, on one of the appropriate safeguards such as the standard contract announced by the Personal Data Protection Board, or on one of the occasional transfer cases listed in the law. Putting these grounds in place and, where a standard contract is used, notifying the Board are the Seller's responsibility. You may ask the Seller, through the channels in section 8, which ground applies to which transfer and for a copy of the relevant safeguard, if any.

6. RETENTION PERIODS

Personal data is kept for as long as necessary for the purpose for which it is processed and as required by the relevant legislation:

a) Technical connection data: The site does not permanently record visitors' IP addresses in its own application; IP addresses used to limit excessive requests are held only in temporary server memory, for at most one minute for music searches and at most 15 minutes for order actions in the Shop and failed admin sign-ins. The technical logs of Vercel and Cloudflare (including the address and query details mentioned in 3.1) are kept for these providers' limited retention periods, which depend on their service terms.

b) Records in your browser: Session storage records are deleted when the tab is closed; preferences in local storage remain in your browser until you delete them.

c) Records of paid orders and the archive of legal texts: kept for the longest of the following periods: three years under the Distance Contracts Regulation; five years from the calendar year following the year to which they relate under tax legislation (Tax Procedure Law No. 213, Art. 253); and, if the Seller is a merchant, ten years under Turkish Commercial Code No. 6102, Art. 82.

d) Orders whose payment is not completed: records of orders awaiting payment, expired or cancelled (these records contain no email address) are kept for 30 days from creation to prevent duplicate orders and double payments, to match late payment notifications to the right order and to answer your questions about these orders; records past this period are deleted by the Seller within one month at the latest, with the bulk deletion in the admin panel. The same operation closes the Whop payment session of orders that can no longer be paid. If the payment is completed within this period, the record becomes subject to the periods in item (c).

e) Your email address in the order record: kept for as long as needed for performance of the order, support, withdrawal and refund handling and potential claims, and for no longer than three years from the payment date; it is then deleted from the order record. The Seller deletes expired email addresses at least every six months with the bulk deletion in the admin panel. If you ask, it is deleted earlier. When the email address is deleted, the order and payment numbers, amount, product details, approval times and legal text version remain in the record because of the obligations in item (c).

f) Invoices and accounting records: kept for the tax and commercial law periods in item (c).

g) Email correspondence: kept for no longer than two years after your request has been resolved or, if it relates to an order, for the periods in item (c).

h) If there is a dispute, complaint or official investigation, the relevant data may be kept until that process and the applicable limitation periods have ended.

Personal data whose retention period has ended is deleted, destroyed or anonymised within six months at the latest. Data kept by Whop as an independent data controller is subject to Whop's own retention periods.

7. YOUR RIGHTS AS A DATA SUBJECT

Under Article 11 of the KVKK, by applying to the Seller you have the right to:

a) learn whether your personal data is processed,

b) request information about the processing if your personal data has been processed,

c) learn the purpose of processing and whether your personal data is used in line with that purpose,

d) know the third parties in Turkey or abroad to whom your personal data is transferred,

e) request correction of your personal data if it is incomplete or inaccurate,

f) request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,

g) request that the actions taken under items (e) and (f) be notified to third parties to whom your personal data has been transferred,

h) object to a result against you arising from the analysis of the processed data exclusively through automated systems,

i) claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

8. HOW TO APPLY

You may submit requests concerning your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to Şile/istanbul, by email to info@oguzhanarslan.com from an email address you previously provided to the Seller and that is registered in the Seller's system (for example, the address you used in the payment form), or by registered electronic mail (KEP), secure electronic signature or mobile signature. Your application must state your full name, your Turkish identity number if you are a Turkish citizen or, if you are not, your nationality and passport or identity number, your address for service, your email address and phone number for notifications if any, and the subject of your request.

The Seller concludes your application free of charge as soon as possible according to the nature of the request and within thirty days at the latest; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If you ask for your email address in the order record to be deleted, the Seller deletes it from the record matching the order number or payment number and informs you.

If your application is rejected, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and, in any case, within sixty days of the application date. For data that Whop processes as an independent data controller, you may also apply to Whop.

9. ADDITIONAL INFORMATION FOR PEOPLE IN THE EU AND EEA (GDPR)

If you are in the European Union or the European Economic Area and buy products or services in the Shop, the GDPR may also apply to the processing of your data. In that case the information above applies together with the following:

a) Legal bases (GDPR Art. 6(1)): performance of a contract or taking steps at your request before entering into a contract (point (b)) for creating the order number and order record, opening the payment session, payment, delivery, support, withdrawal and refunds and your pre-contract requests; legitimate interests (point (f)) for site visits and security, the weather, music search and Wikipedia features, preventing fraud, duplicate orders and double payments, the establishment, exercise or defence of legal claims and the Seller's compliance with retention and evidence obligations under Turkish tax and consumer law; your consent (point (a)) for loading the YouTube player. You can withdraw your consent at any time by closing the tab; withdrawal does not affect the lawfulness of processing before it.

b) Legitimate interests: delivering the site securely and without interruption, preventing misuse and fraud, providing the features you request, meeting legal obligations and protecting rights. You may object at any time to processing based on legitimate interests.

c) Provision of data: Entering your email address and payment details is necessary to conclude the contract; without them a purchase cannot be made. Technical connection data is necessarily processed so that you can view the site. Using the other features is optional.

d) Transfers: The Seller is located in Turkey; your data may be processed in countries outside the EU/EEA, including the United States. For data sharing between Whop and the Seller, the EU Standard Contractual Clauses (Module One, controller to controller) apply under Whop's Seller Data Sharing Addendum. Transfers to other providers must rest on adequacy decisions of the European Commission (for example, for organisations participating in the EU-U.S. Data Privacy Framework) or on appropriate safeguards such as Standard Contractual Clauses; you may ask the Seller which mechanism applies and for a copy of the safeguards, if any.

e) Your rights: You have the right to access your data, to request its rectification, erasure or restriction of processing, to data portability for data processed by automated means on the basis of a contract, and to object to processing based on legitimate interests. You can make requests through the channels in section 8; the Seller responds within one month at the latest, and this period may be extended only in the cases provided for in the GDPR.

f) Complaints: You may lodge a complaint with the data protection supervisory authority of the EU/EEA country where you habitually reside, where you work or where the alleged infringement took place.

g) Recipients are described in section 5 and retention periods in section 6. The Seller does not carry out automated decision-making or profiling. Whop and its payment partners may decline a payment through an automated risk assessment to prevent fraud; these decisions are Whop's responsibility and you can exercise your rights concerning them (including under GDPR Art. 22) against Whop.

10. CHANGES

The Seller may update this text in line with changes to its data processing activities; the current version is published on the site.

This text is published in Turkish and English. If the two versions differ, the Turkish version prevails; this does not limit the rights a consumer has under the mandatory provisions of the law of their place of residence or the principle that unclear terms are interpreted in the consumer's favour.