Privacy notice

1.Controller

Umut Deniz Yorulmaz, trading as UDY Digital (sole proprietorship)
Rissener Straße 42, 22880 Wedel, Germany
E-mail: info@udymedia.com
Phone: +49 176 31641953

No data protection officer has been appointed because there is no legal obligation to do so. For all data protection questions please use the contact details above.

2.Scope

This notice applies to the website udymedia.com, the advertiser portal app.udymedia.com and our own processing in connection with our channels on social networks (section 18). Processing by the operators of the social networks is governed by their own privacy terms. Our paid offers on app.udymedia.com are directed exclusively at businesses.

3.Providing the websites (hosting)

Both websites run on a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, which provides the server on our behalf.

When you visit, the following are processed because they are technically necessary: IP address (normally a Cloudflare address, see section 4, and the visitor's IP address forwarded by Cloudflare), requested address, method, time, browser identification (user agent), the browser's language setting and cookies sent along.

The reverse proxy on our server does not log individual requests. Our applications log only technical events (e.g. that an enquiry was sent); IP addresses and form contents are not logged, e-mail addresses at most in shortened form. These logs are rotated by size (at most three files of 10 MB per application) and overwritten automatically.

To prevent abuse we use the IP address in working memory as a key for rate limits (e.g. number of form submissions per hour). These values are held only in working memory, are no longer taken into account after one hour and are deleted at the latest when the application restarts.

Purpose: providing the websites, secure and stable operation, error analysis, preventing abuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and abuse-free operation of our websites.

4.Cloudflare

All requests to udymedia.com, www.udymedia.com and app.udymedia.com pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (reverse proxy, protection against attacks, TLS encryption, DNS). Cloudflare terminates the encrypted connection and therefore processes all transmitted content, such as form entries, sign-in codes, uploaded files and cookies, as well as the IP address, requested address, other request data (e.g. user agent and referrer), TLS connection data and times. Cloudflare does not cache HTML pages or interfaces. It caches static files such as scripts, stylesheets, fonts and images; they contain no personal data.

Cloudflare also sends your browser an instruction to report network errors (Network Error Logging). The browser keeps this instruction for up to 7 days. If a connection to our websites fails during that time, the browser sends an error report to Cloudflare (a.nel.cloudflare.com). The report may contain in particular the type of error, the requested address, referrer, user agent, the server's IP address, protocol, method, status code and duration of the request; Cloudflare also receives your IP address. Successful requests are not reported.

On our websites Cloudflare may replace e-mail addresses shown on a page with an obfuscated form and load a small script from the same address for this. No data are stored in the browser. The e-mail addresses in this notice and in the legal notice are exempted from this.

Purpose: security, availability and encryption of the websites.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting the websites against attacks and keeping them reliably available.
Cloudflare acts on our behalf. Processing in the USA is possible. According to its own statements Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer is based on adequacy decision (EU) 2023/1795 and, where it does not apply, on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
Retention at Cloudflare: according to Cloudflare's rules; we have no direct influence on it.

5.Cookies and browser storage

We ourselves use no analytics, advertising or tracking cookies. We use the following storage in your browser because it is strictly necessary for a function you have expressly requested (Section 25(2) no. 2 TDDDG):

• Cookie udy_locale (both websites): chosen language. Set only when you switch the language; kept for 180 days.
• localStorage udymedia-theme (both websites): light or dark display. Set only when you switch the display; kept until you delete it.
• sessionStorage udymedia-range (both websites): chosen statistics period; deleted when the tab is closed.
• Cookie udy_ads_session (app.udymedia.com only): keeps you signed in. Contains a random identifier, is readable only by the server (HttpOnly) and is sent only over encrypted connections; kept for 30 days or until you sign out.
• localStorage udy-ad-draft-v4 (app.udymedia.com only): draft of your campaign (e.g. amount, logo reference, small preview). Deleted on submission or when you delete it.
• localStorage udymedia-signup-v1 (app.udymedia.com only): name, company name and e-mail address from sign-up with the time they were saved, so that the billing details of that address's first campaign are prefilled; used for at most 30 days. Deleted as soon as you submit a campaign, sign out or sign in with another address in this browser; after 30 days it is no longer used and is deleted at the next sign-in. You can delete it yourself at any time.

The display, period, draft and sign-up values do not leave your browser; we receive your name and company name only with the billing details when you submit a campaign. The language cookie is sent with requests so that we can redirect you to the chosen language; the session cookie is sent so that we can recognise you.
For the error-reporting instruction that Cloudflare has your browser store, see section 4.
Legal basis for further processing: Art. 6(1)(b) GDPR (sign-in) or Art. 6(1)(f) GDPR (convenience functions).

6.No analytics or tracking services, no embedded content

We use no web analytics, no advertising pixels and no third-party error monitoring. Fonts, images, flags and profile pictures are served from our own server; apart from the Cloudflare functions (section 4), no third-party content is loaded when a page is opened.

While the page is visible, the live statistics regularly query our own interface /api/live. It contains only aggregated figures of our own channels and no data about visitors.

Links to Instagram, Facebook, X and TikTok and to other websites and offers of the owner (udydigital.com, clinicvi.com, doctorvi.com, umutdenizyorulmaz.com) are plain links. Only when you click a link do you leave our website; the respective provider then processes your data under its own responsibility.

7.Enquiry form on udymedia.com

With the advertising enquiry form we collect first name, last name, phone, company and e-mail address (required fields) as well as the form language and the time. A hidden field and the time taken to fill in the form are used to detect automated spam.

The data are not stored in a database but sent by e-mail to our mailbox info@udymedia.com (sending and receiving: see section 17).

Purpose: answering your enquiry and preparing a contract, spam protection.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in answering business enquiries and preventing abuse).
Retention: no fixed automatic deletion period is set up. We delete the enquiry when it is no longer needed for dealing with it; if a contract is concluded or the correspondence prepares a deal, we keep it within the statutory periods (section 20).

8.Request forms on app.udymedia.com

On app.udymedia.com you can send an advertising request, a request for an ad video or an application as a sales partner. Depending on the form we process: company, name, e-mail address, phone, country, desired channels and formats, goal, start date, links, description or reach, plus a reference number, the form language, the processing status and times.

The data are stored in our database at Supabase (section 19) and sent by e-mail to info@udymedia.com.

Purpose: processing the request, preparing offers, selecting sales partners, spam protection.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in processing business requests and preventing abuse).
Retention: no fixed automatic deletion period is set up. We delete the data as soon as they are no longer needed for processing the request and no statutory retention duty applies; if a contract is concluded, the periods in section 20 apply.

9.Tips to the newsroom

With the tip form you can send us tips about events: what happened and where (required), optionally when, a link to a video or photo, your name and a way to contact you (e-mail or phone). Files cannot be uploaded. Your contact details are voluntary; without them we cannot ask follow-up questions. Tips may contain information about other persons.

Tips are stored in our database and sent by e-mail to the newsroom (info@udymedia.com). The newsroom decides on any publication. The confirmation box in the form concerns the accuracy of the information and your right to share the material; it is not a consent under data protection law.

Purpose: receiving and checking tips for the reporting of the UDY Media channels.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in receiving and checking tips). Where the processing serves journalistic purposes and the legal requirements are met (Art. 85 GDPR, Section 23 MStV or the applicable state law), data subject rights may be restricted.
Retention: no fixed automatic deletion period is set up. We delete tips when they are no longer needed for the editorial check and for reporting.

10.Sign-in to the advertiser portal

Sign-in works with your e-mail address and a password. At sign-up and for “Forgot password” we send a six-digit code to your e-mail address; it confirms the address, after which you set your password. For the codes we process your e-mail address, a cryptographic check value of the code (not the code itself), IP address and network range, number of attempts, times and failed checks. We do not store your password ourselves: our server forwards it encrypted to Supabase Auth (section 19), which keeps only a one-way hash (bcrypt) together with your e-mail address and times such as creation, confirmation and last sign-in. Supabase Auth does not receive your name, your company or your IP address; our server appears as the sender of the requests. To prevent abuse we count password sign-in attempts per IP address, network range and e-mail address only in our server's memory; these counters are deleted after about an hour. For your user account we store e-mail address, language, the linked business account, creation time and last sign-in. For the session we store a check value of the session identifier, IP address, user agent and times. At sign-up we also ask for your name and company name; both stay in your browser and only prefill the billing details of your first campaign (section 5).

Purpose: access to your advertiser account, protection against abuse and against attempts to use other people's addresses.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in account security).
Retention: codes are valid for 10 minutes and deleted one day after expiry or use, failed checks after one day. The IP address and user agent of a session are removed 30 days after it started; session data are deleted 30 days after expiry or sign-out. We keep the user account and the password hash at Supabase Auth as long as your account exists; if you ask us to delete your account, we delete both. Supabase Auth logs sign-ins, failed sign-in attempts and password changes with e-mail address and time; Supabase deletes these logs after 7 days.

11.Business profile and VAT ID check

For bookings we store in the business profile: company name, legal form, address, country, VAT ID with check status and check time, tax number, tax office, contact person, invoice e-mail, phone, the confirmation that you act as a business and the acceptance of our terms, each with time, text version and IP address, participation in the founding programme, account status and language. Changes to the account are recorded in an event log.

For businesses from other EU member states we send the VAT ID to the European Commission's VIES system, which checks it with the tax administration of the member state. We receive the result “valid” or “invalid”; if the service cannot be reached, the number remains unchecked for the time being. If VIES rejects a VAT ID as invalid, the profile cannot be saved with that number. For the reverse-charge procedure we also confirm the VAT ID manually. We do not send German VAT IDs or numbers from states outside the EU to VIES.

Purpose: concluding and performing the contract, invoicing, VAT treatment (reverse charge), proof of business status and of acceptance of the terms.
Legal basis: Art. 6(1)(b) GDPR (contract, including the VAT ID check), Art. 6(1)(c) GDPR (invoice details under Sections 14 and 14a of the German VAT Act) and Art. 6(1)(f) GDPR (legitimate interest in proving declarations and in checking the VAT ID; IP addresses).
Retention: IP addresses relating to confirmations are removed after 30 days. We keep the other data for the duration of the business relationship and afterwards as long as statutory retention duties apply (section 20).

12.Ad creatives, review and publication

For campaigns we process uploaded logos (stored as the uploaded file), ad banners generated from them, display name, offer text, caption, Instagram handle, sector, and our review notes and decisions. Files are kept in non-public storage areas at Supabase. The newsroom reviews every creative before publication; we send the result to the sign-in addresses of your account. Approved creatives are published in videos on the UDY Media channels on social networks; where labelled as a paid partnership, your Instagram account is named as partner. To produce, publish and archive these videos we use service providers acting on our behalf (section 19).

Purpose and legal basis: performance of the advertising contract (Art. 6(1)(b) GDPR).
Retention: replaced logo uploads beyond your newest five that are not used in any submitted creative are deleted automatically. Otherwise we keep creatives for the duration of the business relationship and afterwards as long as statutory retention duties apply.

Case study: only if you expressly agree in your profile may we publish your results as a case study (Art. 6(1)(a) GDPR). Consent is voluntary and can be withdrawn at any time with effect for the future in the profile or by e-mail; the lawfulness of processing before the withdrawal is not affected. The IP address relating to the consent is removed after 30 days.

13.Acceptance of the contract terms

When you accept our advertising terms (Werbe-AGB) or our advertising policy in the advertiser portal, we store as proof: the document and its version, the language shown, checksums (SHA-256) of the version shown and of the authoritative version, the occasion of the acceptance (for example an order, a top-up or sign-in), your business account, your user account, the e-mail address at the time of acceptance, IP address, user agent and the time. Apart from removing the IP address and user agent when the period ends, the entries are not changed afterwards.

Purpose: proof of which version of the terms was agreed for your account and when.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in proving the conclusion of the contract).
Retention: we remove the IP address and user agent three years after the end of the year in which the business relationship ends (regular limitation period, sections 195 and 199 of the German Civil Code, BGB). We keep the other details as proof until ten years after the end of that year, when the longest limitation periods have expired (section 199(3) and (4) BGB), and delete them afterwards. The business relationship counts as ended once no campaign is open; the end of the last campaign or the last acceptance counts, whichever is later.

14.Declaration on political advertising

With every order you declare that the advertising booked is not political advertising within the meaning of Regulation (EU) 2024/900. With the order we store the version of this declaration, the time and the IP address.

Purpose: proof of the declaration and compliance with our obligations under Regulation (EU) 2024/900.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7 of Regulation (EU) 2024/900, and Art. 6(1)(f) GDPR (legitimate interest in proving the declaration).
Retention: the IP address is removed 30 days after the declaration. We keep the version and the time with the order for the duration of the business relationship and afterwards as long as statutory retention duties apply.

15.Top-ups and payments

Advertising credit is topped up in advance by bank transfer or card. We store top-up requests (amount, tax, payment method, reference, terms version, time and IP address of acceptance, expiry time), incoming payments and a ledger of the credit. Businesses from other EU member states can top up only after we have confirmed their VAT ID (section 11).

For bank transfers, your bank and our bank receive the payment data (e.g. payer name, IBAN, amount and payment reference) and process them under their own responsibility.

Card payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland. We send Stripe the company name with its legal form, the invoice e-mail, address and country, your VAT ID (for businesses from Türkiye the tax number), our internal account and reference numbers, the payment reference and the description of the service, the version of the accepted terms, the amount and the language. You enter your card data, name and billing address on Stripe's payment page; card data do not reach our server. From Stripe we receive the payment status and payment references. Stripe processes the data partly on our behalf and partly under its own responsibility, e.g. for fraud prevention and to meet legal obligations; Stripe's privacy policy applies to this (stripe.com/privacy). Data may be transferred to Stripe group companies in the USA; according to its own statements Stripe is certified under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795).

Purpose: processing payments, preventing fraud and chargebacks, bookkeeping.
Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR (tax and commercial law duties) and Art. 6(1)(f) GDPR (legitimate interest in preventing fraud).
Retention: the IP address relating to acceptance of the terms is removed after 30 days; booking data within the statutory retention periods (section 20).

16.Invoices

For every payment we issue an invoice and, for refunds, a corrected invoice with invoice number, our details, your billing details (company, legal form, address, VAT ID and check status, tax number, tax office, contact person, invoice e-mail), amounts, VAT treatment and payment details. We send invoices to your invoice e-mail and make them available in the portal.

Legal basis: Art. 6(1)(b) and (c) GDPR (Sections 14, 14b, 17 of the German VAT Act, Section 147 of the German Fiscal Code).
Retention: 8 years (section 20).

17.Sending e-mails and contact by e-mail

E-mails from our websites (sign-in codes, enquiries, tips, payment confirmations, invoices, review results) are sent via Amazon Simple Email Service (Amazon SES) of Amazon Web Services (AWS) in the Frankfurt am Main region (eu-central-1) over encrypted connections. AWS processes the recipient address, content and delivery data.

E-mails to our addresses at udymedia.com, such as info@udymedia.com, are received by Amazon SES in the Frankfurt am Main region. The messages are stored in Amazon S3 in the same region and transferred from there to our own mail server at Hetzner (section 3). We back up the mail server daily; the backups are stored encrypted in Cloudflare R2 with storage location in the EU, where we keep one backup per day for 7 days, one per week for 4 weeks and one per month for 3 months. Incoming messages are checked for spam automatically. When you write to us, we process your address, the content, attachments and the message metadata.

Purpose: communication with prospects, advertisers and tipsters.
Legal basis: Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
AWS acts on our behalf. Access by Amazon group companies in the USA cannot be ruled out; according to its own statements AWS is certified under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795).
Retention: we delete e-mails when they are no longer needed for dealing with them; business letters and other messages subject to retention are kept within the statutory periods (section 20).

18.Our presences on social networks

UDY Media runs channels on Instagram, Facebook, X and TikTok, including UDY Haber, Gurbet Haber and the country pages. When you visit these channels, follow them or interact with us there, the respective operator processes your data under its own responsibility and its own privacy terms:

• Instagram and Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
• X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
• TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

The operators may also transfer data to third countries such as the USA under their own responsibility; they describe the details in their privacy terms.

Statistics: for our Facebook pages, Meta provides us with statistics (Page Insights) that Meta creates from your interactions with the pages. We are joint controllers with Meta Platforms Ireland Limited for this (Art. 26 GDPR). Under the agreement with Meta, Meta takes on the GDPR obligations for this processing, in particular informing data subjects and fulfilling their rights (agreement: www.facebook.com/legal/terms/page_controller_addendum, information: www.facebook.com/legal/terms/information_about_page_insights_data). For the statistics of our TikTok account (TikTok Analytics) we are joint controllers with TikTok Technology Limited where personal data subject to the GDPR are processed; TikTok enables data subjects to exercise their rights (agreement: www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en, information: www.tiktok.com/legal/page/global/information-about-tiktok-analytics/en). Meta also provides us with statistics for our Instagram accounts. We receive only aggregated evaluations (e.g. reach, views, interactions and the followers' countries and cities, age and gender), no information about individual persons. We publish selected aggregated figures on udymedia.com. You can exercise your rights against each of the joint controllers (Art. 26(3) GDPR); requests about these statistics that reach us are forwarded to Meta or TikTok within seven days.

Comments and messages: we read and answer comments and messages that you address to us on our channels. We hide or delete comments that are offensive, unlawful or break the platform's rules; automated checks are also used for this. To understand which topics interest our audience, we store public comments on our posts, including the user name, on our server and evaluate them. For our public statistics we count comments, replies and removed comments; these figures contain no names or content. If you send us tips, photos or videos, we treat them like tips to the newsroom (section 9).

Purpose: communication with our audience, moderation of our channels, evaluating the reach and interests of our audience.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in communicating with our audience, respectful conduct on our channels and developing our offering. Where a contract or its preparation is concerned, the legal basis is Art. 6(1)(b) GDPR.
Retention: comments and messages stay on the platform until you or we delete them. We delete the copies stored by us when they are no longer needed for the purposes stated.

19.Recipients and transfers to third countries

Besides us, your data are received by the following recipients where necessary for the respective purposes:

• Hetzner Online GmbH, Gunzenhausen, Germany: server and our own mail server (on our behalf, section 3).
• Cloudflare, Inc., USA: network, protection, DNS (on our behalf, section 4) and encrypted backup copies of our mail server in Cloudflare R2 with storage location in the EU (on our behalf, section 17).
• Service providers for producing, publishing and archiving our videos: creatives that appear in these videos (on our behalf, section 12).
• Supabase: database, file storage and password management (Supabase Auth) of the portal (on our behalf); the data are located in the Frankfurt am Main region (eu-central-1). As Supabase is based outside the EU, access from third countries (in particular the USA and Singapore) cannot be ruled out; according to Supabase it takes place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• Amazon Web Services (Amazon SES and Amazon S3), Frankfurt am Main region: sending and receiving e-mail (on our behalf, section 17).
• Stripe Payments Europe, Ltd., Dublin, Ireland, and the Stripe group: card payments (section 15).
• Banks: bank transfers (under their own responsibility, section 15).
• European Commission (VIES) and the tax administrations of the member states: checking VAT IDs (section 11).
• Operators of the social networks: published creatives (section 12) and statistics of our channels (section 18).
• Authorities, where we are legally obliged.

You can request a copy of the respective safeguards for transfers to third countries at info@udymedia.com.

20.Retention at a glance

We delete personal data as soon as the purpose no longer applies and no statutory retention duty prevents it. The periods for the individual processing operations are stated in the sections above. Statutory retention periods (Section 147 of the German Fiscal Code, Section 14b of the German VAT Act):

• invoices and accounting vouchers: 8 years
• business letters received and sent: 6 years
• books and records: 10 years

The periods begin at the end of the calendar year in which the document was created. During this time we restrict processing to fulfilling the retention duty.

21.Obligation to provide data

You are under no legal or contractual obligation to provide us with data. Without an e-mail address, however, you cannot sign in to the portal. Without the details marked as required we cannot process enquiries. Without business details we cannot conclude a contract, issue an invoice or accept a top-up; for businesses from other EU member states a VAT ID confirmed by us is also required. Contact details in the tip form are voluntary.

22.No solely automated decision-making

No solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. If VIES rejects a VAT ID as invalid, the profile cannot be saved with that number; if you believe the number is correct, contact us so that we can check the details manually. We check the VAT ID for the reverse-charge procedure and every creative manually. Stripe may check card payments for fraud automatically under its own responsibility.

23.Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object (Art. 21 GDPR, see section 24)
• withdraw a consent with effect for the future (Art. 7(3) GDPR)

Please contact info@udymedia.com or the address in section 1.

24.Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No particular form is required, e.g. an e-mail to info@udymedia.com is sufficient.

25.Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
Phone: +49 431 988-1200
E-mail: mail@datenschutzzentrum.de
www.datenschutzzentrum.de

26.Changes to this notice

We update this notice when our processing or the legal situation changes. The version published here applies; its date is shown above under “Last updated”.