Skip to content
Search the site

KVKK Data Protection Notice

Updated:

Under Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK), this notice explains which of your personal data is processed when you use cbd.com.tr and its English edition cbd.school, for what purpose and how. cbd.com.tr and cbd.school do not sell products and receive no advertising or sponsorship income; they do not sell your personal data to anyone or share it with anyone for marketing.

What's on this page?7 sections

Data controller

Data controller: Selçuk Gündoğdu (cbd.com.tr). Contact: [email protected]

What data do we process, and why?

Contact form

  • Data: your name, email address, the subject you choose and your message.
  • Purpose: to reply to you, and to review error reports and source suggestions.
  • Legal basis: the explicit consent you give through the checkbox on the form (KVKK Art. 5(1)).
  • Method of collection: the form on the site, electronically.
  • Against misuse: your IP address is not recorded; only an irreversible hash of it is kept, solely to limit one person sending many messages in a short time.

Newsletter

  • Data: your email address.
  • Purpose: to send, at most once a month, the newsletter about new research and updated guide pages.
  • Legal basis: explicit consent (KVKK Art. 5(1)). Sign-up is double opt-in: no newsletter is sent until you click the link in the email we send you.
  • Sending service: the newsletter is sent through Brevo (Sendinblue SAS, France); your email address is stored on this service’s servers.
  • Unsubscribing: you can unsubscribe at any time using the link at the bottom of every newsletter or by writing to [email protected].

Expert applications (Join our team)

  • Data: full name, email, profession, title, specialty, institution, employment status, topics you are interested in, how you would like to take part, ORCID and publication link, your answer to the question about commercial ties to cannabis products, and your note. We do not ask for an ID number, diploma or other documents.
  • Purpose: to review your application and contact you. If your application is accepted, we will separately ask for your written consent for the information to be published on the site (name, title, specialty, institution, profile links).
  • Legal basis: the explicit consent you give through the checkbox on the form (KVKK Art. 5(1)).
  • Method of collection: the form on the Join our team page, electronically.
  • Against misuse: your IP address is not recorded; only an irreversible hash of it is kept, solely to limit many applications being sent in a short time.

When you visit the site

  • Data: IP address, browser and device information, the page visited and the time (server and security logs).
  • Purpose: to keep the site running securely and without interruption, and to prevent attacks.
  • Legal basis: legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)).
  • Visit statistics: we count which pages are read with Vercel Web Analytics. This service does not use cookies and does not store your IP address; the one-way hash generated from the request to tell apart visits on the same day is deleted after 24 hours. Only aggregate information such as page, country, device and browser type is kept; we do not know who you are.
  • Cookies: which cookies are used and how you can manage them are explained on the Cookies and Tracking Technologies page.

Who receives your data?

Your data is shared only with the companies whose services we use to run the site, and only for the purposes above. These companies’ servers are outside Turkey; transfers are made in accordance with the conditions in KVKK Art. 9.

  • Hosting, file storage and security: Vercel Inc. (USA), Cloudflare Inc. (USA).
  • Database: Neon Inc. (USA; server in Frankfurt, Germany).
  • Contact form messages: Google (Gmail, USA): your message is forwarded to us by email.
  • Expert applications: stored in our database (Neon, Frankfurt) and forwarded to the founder by email (Google Gmail, USA).
  • Newsletter: Brevo (Sendinblue SAS, France).

Apart from these, your data is not transferred to anyone, is not sold and is not used for advertising or marketing. If there is a legal obligation, it is shared with the competent public authorities, and only to the extent requested.

How long do we keep it?

  • Contact messages: 12 months; then they are deleted. If you ask us to delete them sooner, we will.
  • Expert applications: applications that are not accepted are deleted automatically after 12 months. Accepted applications are kept for as long as we work together and, after that, for as long as legal obligations require.
  • Newsletter subscription: until you unsubscribe. When you unsubscribe, your address is kept only as a "do not send newsletters" record, so that newsletters are not sent to you again by mistake.
  • Server and security logs: for the short period set by the service providers for security.

Your rights

Under Article 11 of the KVKK, you have the right to:

  • learn whether your personal data is processed,
  • request information about it if it has been processed,
  • learn the purpose of the processing and whether the data is used in line with that purpose,
  • know the third parties in Turkey or abroad to whom it has been transferred,
  • ask for it to be corrected if it has been processed incompletely or incorrectly,
  • ask for it to be deleted or destroyed,
  • ask for corrections and deletions to be notified to the third parties to whom the data has been transferred,
  • object to an outcome against you that results from analysis exclusively by automated systems,
  • ask for compensation if you suffer damage because your data was processed unlawfully.

You can withdraw the explicit consent you have given at any time; this does not affect processing carried out before the withdrawal.

How do you submit a request?

You can write to [email protected] with your requests or, in the contact form, choose the subject "My personal data." We reply to your request free of charge within 30 days at the latest. You can also use the other application methods set by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Changes to this notice

We update this notice when the way we process data changes; the date of the update is shown at the top of the page. When the newsletter’s sending service moved from Mailchimp to Brevo, the notice was updated accordingly.