Personal data notice

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how borahaber.com ("Bora Haber") processes the personal data of readers, members, newsletter subscribers and people who contact us.

1. Data controller

Your personal data is processed by Bora Haber Medya Yayıncılık Limited Şirketi (Bora Haber; address: Quasar Tower, Şişli, Istanbul, Türkiye) as data controller.

• Email for personal data requests: info@borahaber.com

2. What we process, why, and on what legal basis

For each processing activity below, we list the data categories, purposes, legal bases and how the data is collected. Legal bases refer to Article 5 of the KVKK.

2.1 Membership and account

• Data: name, email address, password (stored only as an irreversible hash), the account identifier and email address shared by Google or Apple if you sign in with them, language preference, account creation and sign-in records (time, hashed IP address, browser details), saved articles, quiz history, newsletter and notification preferences.
• Purposes: creating and managing your account, email verification, password reset and sign-in by magic link, providing member features such as saved articles and quiz history, keeping your account secure and preventing unauthorized access.
• Legal bases: necessary for entering into or performing a contract (Art. 5/2-c); for sign-in records and security checks, legitimate interest (Art. 5/2-f) and compliance with a legal obligation (Art. 5/2-ç).
• Collection: sign-up and sign-in forms on the site; automatically from Google or Apple if you sign in with them.

2.2 Newsletter

• Data: email address, newsletter language, subscription and confirmation time, hashed IP address at confirmation, delivery and unsubscribe records.
• Purposes: sending the daily newsletter (every morning at 7:00 am Türkiye time), confirming your subscription by email (double opt-in), keeping proof of consent.
• Legal bases: explicit consent (Art. 5/1); for keeping proof of consent, compliance with a legal obligation (Art. 5/2-ç) and the establishment, exercise or defense of a right (Art. 5/2-e).
• Collection: the newsletter sign-up box on the site and the link in the confirmation email.

2.3 Breaking news notifications (web push)

• Data: the notification subscription your browser creates (subscription address and encryption keys), language, a link to your account if you are a member, delivery records.
• Purposes: sending notifications for breaking news only; applying frequency limits (no more than 3 notifications an hour, none between midnight and 7:00 am Türkiye time).
• Legal basis: explicit consent (Art. 5/1). You give permission through your browser's prompt and can withdraw it at any time in your browser settings.
• Collection: your browser's notification permission prompt.

2.4 Comments and reports

• Data: the display name shown with your comment, the comment text, the time and article, hashed IP address, the decision of the automated pre-screen and of moderation; the comment you report and the reason.
• Purposes: publishing comments, filtering out comments containing profanity, spam, insults or personal data, handling reports, responding to notices about unlawful content.
• Legal bases: performance of a contract (Art. 5/2-c); legitimate interest in moderation and preventing abuse (Art. 5/2-f); obligations under Law No. 5651 and related legislation (Art. 5/2-ç); the establishment, exercise or defense of a right (Art. 5/2-e).
• Collection: the comment and report forms on the site.

Your comments are published publicly together with your display name. Before publication, the comment text passes through an automated pre-screen that runs on Claude, a model provided by our service provider Anthropic. The pre-screen looks only at the comment text. If it holds a comment, the comment stays unpublished until our moderation team reviews it. To object to such a decision, write to info@borahaber.com.

2.5 Quizzes and polls

• Data: an anonymous identifier assigned to your browser (cookie), hashed IP address, your answers and result; your quiz history if you are a member.
• Purposes: scoring quizzes and showing results, making sure each person votes only once in a poll, counting participants, preventing abuse.
• Legal bases: performance of a contract (Art. 5/2-c); legitimate interest in one-vote and abuse checks (Art. 5/2-f).
• Collection: the quiz and poll components and a browser cookie.

2.6 Contact messages

• Data: name, email address, phone number if provided, subject and content of your message, time sent, hashed IP address.
• Purposes: replying to your message; handling corrections, right-of-reply requests, news tips, advertising enquiries and legal notices.
• Legal bases: legitimate interest (Art. 5/2-f); for legal notices, compliance with a legal obligation (Art. 5/2-ç) and the establishment, exercise or defense of a right (Art. 5/2-e).
• Collection: the contact form and email.

2.7 Measurement and analytics

• Data: visit session identifier, pages read and events, referring address, campaign parameters, device type, browser and operating system, country and city inferred from your IP address, hashed IP address and browser details, page speed measurements; if you consent, usage data collected by Google Analytics and Microsoft Clarity (in Clarity, including clicks and scrolling on the page).
• Purposes: understanding what people read, improving the site, measuring speed and errors, filtering out bot traffic.
• Legal bases: explicit consent (Art. 5/1) for Google Analytics, Microsoft Clarity and the identifying cookies of our own counter. If you don't consent, our own counter only produces aggregated, non-identifying counts.
• Collection: cookies and the measurement code on the site.

We don't store your IP address in raw form. It is combined with a secret key (pepper) and converted into an irreversible hash, and only the hash is kept.

2.8 Advertising

• Data: advertising cookies and device identifiers, IP address, ad impression and click information (collected by Google AdSense); for our own ad slots, only aggregated impression and click counts.
• Purposes: showing and measuring ads; personalized ads based on your interests if you consent.
• Legal basis: explicit consent (Art. 5/1). If you don't consent, Google AdSense is not loaded.
• Collection: cookies and ad code.

2.9 Embedded content

• Data: the IP address, browser details and cookies that YouTube, X or Instagram collect directly when their content loads.
• Purpose: showing videos and social media posts within articles.
• Legal basis: explicit consent (Art. 5/1). YouTube videos load only when you press play; X and Instagram content loads only if you allow "Embedded content".

2.10 Security and legal obligations

• Data: access logs, hashed IP addresses, security event records, admin panel activity logs, correspondence with authorities.
• Purposes: protecting the site against attacks, meeting obligations under Press Law No. 5187, Law No. 5651 and other legislation, responding to requests from courts and competent authorities.
• Legal bases: expressly provided for by law (Art. 5/2-a), compliance with a legal obligation (Art. 5/2-ç), the establishment, exercise or defense of a right (Art. 5/2-e), legitimate interest (Art. 5/2-f).

2.11 People named in news articles

Information about people featured in our articles is processed in the context of freedom of expression and journalism. Article 28/1-ç of the KVKK excludes from the scope of the law processing carried out within freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy or personal rights, and does not constitute a crime. For correction, reply or removal requests about an article, see our Corrections policy or write to info@borahaber.com.

3. Who we share personal data with

Limited to the purposes above, your personal data may be shared with:

• Our service providers: companies providing hosting (Hostinger), content delivery, security and file storage, email delivery, sign-in, measurement, advertising, comment pre-screening and notification delivery. They process data only to provide their services to us.
• Competent authorities: courts, prosecutors, the Personal Data Protection Board, the Information and Communication Technologies Authority and other competent public bodies, only where there is a legal obligation or request.

4. International transfers

Some of the service providers we use to run the site are based outside Türkiye or process data on servers outside Türkiye:

International transfers are made in accordance with Article 9 of the KVKK. Under the rules in force since 1 June 2024, data may be transferred to countries for which the Personal Data Protection Board has issued an adequacy decision; where there is none, by providing an appropriate safeguard such as a standard contract notified to the Board; and where neither is possible, under one of the occasional-transfer exceptions listed in the law. To find out which basis applies to a given provider, write to info@borahaber.com.

5. Retention periods

We keep personal data for as long as the processing purpose continues and for any period required by law. When that period ends, the data is deleted, destroyed or anonymized.

6. Your rights

Under Article 11 of the KVKK, you have the right to apply to the data controller to:

1. Learn whether your personal data is processed,
2. Request information about it if it is,
3. Learn the purpose of processing and whether the data is used in line with that purpose,
4. Know the third parties in Türkiye or abroad to whom it is transferred,
5. Request correction if it is incomplete or inaccurate,
6. Request deletion or destruction under the conditions of Article 7 of the KVKK,
7. Request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
8. Object to an outcome against you that results from analysis carried out exclusively by automated systems,
9. Claim compensation if you suffer damage because of unlawful processing.

Where processing is based on explicit consent (newsletter, notifications, analytics, advertising and embedded content cookies), you can withdraw your consent at any time. Withdrawal does not affect processing carried out before then.

7. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your request in any of the following ways:

• By email signed with a secure electronic signature or mobile signature: to info@borahaber.com,
• From the email address registered to your Bora Haber account: to info@borahaber.com,
• By a signed written application, delivered by hand or through a notary to: Bora Haber Medya Yayıncılık Limited Şirketi, Quasar Tower, Şişli, Istanbul, Türkiye.

Your request should include your full name, your signature (for written requests), your Turkish ID number if you are a Turkish citizen or your nationality and passport or ID number if you are not, your address for notifications, your email address and phone number if any, and the subject of your request.

We will respond free of charge within 30 days at the latest, depending on the nature of the request. If the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

If your request is rejected, you find the response insufficient, or we do not respond in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response, and in any case within 60 days of the date of your application.

8. Deleting your account and downloading your data

You can complete two account requests yourself, without a formal application:

• Download your data: use "Download my data" in your account settings to get a copy of your account details, saved articles, quiz history, comments and preferences as a machine-readable file.
• Delete your account: when you use "Delete my account" in your account settings, we send a confirmation email to the address registered to your account. Once you confirm, your account is closed immediately, your comments are removed from the site, and your data is deleted or anonymized according to the retention table above. Records we must keep because of a legal obligation are kept only for that obligation and only for as long as required.

Your newsletter subscription is kept separate from your account; you can unsubscribe at any time using the link at the bottom of every issue, without deleting your account.

9. Changes

We update this notice as our processing activities change. The current version is always on this page; the date of the last update is shown at the top.

Related pages: Privacy · Cookie policy · Comment rules

Last updated: 21 October 2026