General Data Protection Regulation
This page is the operational record we keep to comply with the GDPR — written for you to read, not for an auditor. Every claim links back to the Article number that backs it up.
If you live in the EU, EEA, UK or Switzerland, the rules below are the floor — not the ceiling. We extend the same controls to every reader globally because operating two policies is harder than just running on GDPR for everyone.
01 — ScopeWho this applies to
GDPR applies whenever a "data subject" (you) is in the EU/EEA at the time of processing, regardless of where the data controller (us) is based. We are based in Türkiye, with a designated representative in the EU as required by Art. 27:
- Data controller — tuto.digital, Istanbul, TR. Determines the purposes and means of processing.
- EU representative — DataRep, Berlin, Germany. Acts as a point of contact for EU supervisory authorities and data subjects.
- Data Protection Officer — Selin Aydın (not legally required at our scale, appointed voluntarily).
If you live outside the EU/EEA, you still have all the rights below — we apply them globally — but your local law (e.g. CCPA in California, KVKK in Türkiye, UK GDPR) governs the legal interpretation.
02 — RightsYour eight rights, with one-click actions
The GDPR grants every EU data subject these specific rights. Each card below shows the relevant Article and how to exercise it on tuto.digital — usually in under a minute.
We must tell you, in plain language, what data we collect, why, and on what lawful basis. That's what this page (and our Privacy Policy) is for.
Ask for a full export of the personal data we hold about you, in a structured machine-readable format. Delivered as JSON + CSV, within 30 days.
If we hold inaccurate data about you — wrong email, misspelled name on a newsletter — tell us and we correct it without delay.
"The right to be forgotten." We delete all personal data and confirm in writing — except where retention is legally required (e.g. tax records for affiliate payouts).
Keep the data on file but stop processing it while a dispute or correction is resolved. Common after a rectification request that we're still reviewing.
Receive your data in a structured, commonly-used, machine-readable format (JSON) and transmit it to another controller. Useful if migrating from our newsletter to another.
Object to processing based on legitimate interest (e.g. affiliate attribution, analytics). We stop unless we can demonstrate compelling grounds that override your interests.
You have the right not to be subject to a decision based solely on automated processing. We don't run profiling or automated decisions, so this is structurally guaranteed — confirmed in writing on request.
03 — Art. 6Lawful basis matrix
Under Art. 6 GDPR, every act of processing must rest on one of six legal bases. Here's the full mapping — what we collect, why, and which Art. 6 paragraph authorizes it:
04 — Art. 28Sub-processors registry
A complete list of third parties that process personal data on our behalf, under a written Data Processing Agreement (DPA). We update this list 30 days before any addition.
05 — Ch. VInternational transfers
Some of our processors operate outside the EU. Chapter V GDPR (Art. 44–49) requires us to apply specific safeguards. Here's how data physically flows:
06 — Art. 33 / 34If something goes wrong: breach policy
A "personal data breach" is any incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Our internal runbook follows the GDPR timing precisely:
Monitoring or human report triggers the runbook. On-call DPO is paged within 15 minutes.
Affected systems isolated. Scope, categories of subjects, and likely impact are documented.
If risk to rights & freedoms is more than minimal, we file with the lead supervisory authority (Art. 33).
If risk is high, every affected data subject is contacted directly, in plain language, with steps to take (Art. 34).
07 — ActionFile a Data Subject Request
This form goes to dpo@tuto.digital — a real human inbox monitored daily. We acknowledge within 48 hours and respond fully within the SLA for the request type. Free of charge unless requests are "manifestly unfounded or excessive" (we have never invoked this clause).
08 — Art. 77If you're not satisfied: complaints
If you believe we've mishandled your data or your request, you have the right to lodge a complaint with a supervisory authority — without going through us first. Under Art. 77, you can complain to:
- Your home country's data protection authority — full list at edpb.europa.eu
- The lead supervisory authority for our EU representative — Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
- For UK readers — the Information Commissioner's Office, ico.org.uk
We always prefer to resolve issues directly — write to dpo@tuto.digital first if you can — but it is your unconditional right to go to the regulator without informing us.
Still have a question about your data?
For anything not covered above — including bulk requests, journalistic inquiries, or compliance questionnaires — write directly to our DPO. Real human inbox, responses within 48 hours on weekdays.
Email dpo@tuto.digital →