Legal
Privacy Notice
Information under Law No. 6698 on the personal data processed through the website and the submission system of the Cyberspace, Space, and Law Review.
This is an English translation. In case of discrepancy, the Turkish version prevails.
This notice has been prepared under Article 10 of the Personal Data Protection Law No. 6698 (KVKK) to inform you about the personal data processed through the website (buhd.org.tr) and the submission system of the Cyberspace, Space, and Law Review.
1. Data controller
Kulular Bilişim Teknolojileri Limited Şirketi Kızılırmak Mah. 1450 Sk. Hayat Plaza No: 16 Çankaya/Ankara MERSİS No: 0591095454600001 Email: teknoloji@kulular.com
2. Personal data processed, purposes and legal grounds
2.1. Website visitors
| Data | Purpose | Legal ground |
|---|---|---|
| IP address, browser and device information, address visited, time information | Security of the website, prevention of misuse, resolution of technical problems | KVKK Art. 5(2)(f) (legitimate interest), Art. 5(2)(ç) (legal obligation) |
The website does not use analytics or advertising tools that track visitor behaviour.
2.2. Users of the submission system (authors, reviewers, editors)
| Data category | Example |
|---|---|
| Identity | First name, surname, title |
| Contact | Email address, institution, country |
| Professional | Institution and department, areas of expertise, ORCID iD, optional short biography |
| Transaction security | Username, hashed password, session and transaction logs, IP address |
| Work and review | Submitted works and their attachments, declarations and forms, signature, reviewer reports, editorial decisions, correspondence |
These data are processed for the following purposes:
- Carrying out the submission, initial check, reviewer assignment, review, decision and publication processes
- Communication with authors, reviewers and editors
- Account security and authentication
- Publishing the author's name, institution and ORCID iD, and the corresponding author's email address, in published works
- Transmitting the metadata of works to the relevant organisations for DOI registration and indexing
- Conducting publication ethics investigations
- Fulfilling legal obligations
Legal grounds: KVKK Art. 5(2)(c) (establishment or performance of a contract), Art. 5(2)(ç) (legal obligation), Art. 5(2)(e) (establishment, exercise or protection of a right), Art. 5(2)(f) (legitimate interest, in particular the integrity of the scholarly record).
For Student Forum submissions, student status is verified through the author's university email address ending in .edu.tr. No student certificate is required.
2.3. Correspondence
The name, contact details and content of a request sent by email are processed under KVKK Art. 5(2)(f) in order to respond to the request.
2.4. Usturlap journal assistant
Questions written to the Usturlap assistant on the website are processed under KVKK Art. 5(2)(f) in order to answer them, to prevent misuse and to improve the service by turning frequently asked questions into ready answers. To apply the daily question limit, a one-way hash of the IP address is kept in memory for up to 24 hours; the IP address itself is not recorded. Stored question records contain no identifying information; email addresses and telephone numbers are masked automatically. Please do not write personal data to Usturlap.
3. Special categories of data
The Review does not request special categories of personal data within the scope of KVKK Art. 6 (health, religion, political opinion, biometric data and similar). We ask users to ensure that the documents they upload do not contain such data or Turkish identity numbers.
4. Method of collection
Personal data are collected electronically through forms in the submission system, uploaded documents, email correspondence and server logs.
5. Transfers
Personal data may be transferred to the following recipients, limited to the purposes above:
| Recipient | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany | Server and hosting services |
| Cloudflare, Inc. | USA | Content delivery and security |
| Resend (Plus Five Five, Inc.) | US company, European Union server | Sending system emails |
| Google LLC (Gmail) | USA | Copy of the submission acknowledgement to the Review's records mailbox: title of the work, author name and email address. Work files are not transmitted in this way. |
| OpenRouter, Inc. and the AI and web search providers it routes to | USA | Answering questions written to the Usturlap assistant |
| Backup service provider | European Union | Encrypted, access-restricted remote backup of the database and files |
| ORCID, Inc. | USA | Only if the user links their ORCID account |
| Crossref | USA and United Kingdom | Metadata of works for DOI registration |
| Indexing organisations (TR Dizin, DOAJ and similar) | Türkiye and abroad | Metadata of published works |
| PKP Preservation Network | Canada | Long-term archiving of published works |
| Authorised public institutions and organisations | Türkiye | Legal obligation |
Transfers abroad are made in accordance with the procedures and safeguards set out in KVKK Art. 9: standard contracts announced by the Personal Data Protection Board are signed with service providers and notified to the Board. Where this is not possible, the conditions for occasional transfers in Art. 9(6) apply. Only the publicly available metadata of published works is transmitted to indexing and archiving organisations. Reviewer identities and review reports are not transferred to third parties.
6. Retention periods
| Data | Period |
|---|---|
| Bibliographic details of published works | Indefinitely (integrity of the scholarly record) |
| Review records, reviewer reports, rejected works | 5 years from the date of publication or rejection |
| User account | Until the account is deleted, except for information linked to published works. |
| Server and security logs | Up to 1 year |
| Email correspondence | 2 years |
| Usturlap question records | 1 year |
At the end of the period, data are erased, destroyed or anonymised. Accounts whose email address has not been verified and which have never been logged in to are deleted automatically after 28 days.
7. Data security
Personal data are protected by administrative and technical measures such as encrypted connections (HTTPS), storage of passwords as irreversible hashes, role-based access, verification that prevents automated attacks at registration and login, email verification, server and application updates, daily backups and access logs. Verification on the registration and login forms is carried out on your device without using any third-party service. Only authorised editors have access to reviewer reports. Only authorised editors and the reviewers assessing the work have access to anonymised full texts. Reviewers cannot see the identity of the authors.
8. Your rights
Under KVKK Art. 11, you have the right to:
- Learn whether your personal data are processed
- Request information about the processing, if your data have been processed
- Learn the purpose of processing and whether the data are used in accordance with that purpose
- Know the third parties in Türkiye or abroad to whom the data are transferred
- Request rectification if the data are incomplete or inaccurate
- Request erasure or destruction under the conditions set out in KVKK Art. 7
- Request that rectification, erasure and destruction be notified to the third parties to whom the data were transferred
- Object to a result against you arising from analysis exclusively by automated systems
- Claim compensation if you suffer damage due to unlawful processing
9. Applications
You may submit your applications, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the address above or by email to teknoloji@kulular.com from the email address registered in the system. Applications are concluded free of charge within 30 days at the latest.