Data Rights Request

1. What you can request

Six request types are handled through this page. The short token in the first column is the word to put in your message so the request is routed correctly on arrival.

Marketing email is not sent at all today, so there is nothing to unsubscribe from. If that changes, withdrawing consent will be a control in the account area rather than a request on this page — and until it exists, send an objection request.

2. How to send a request

Send it to privacy@drawoble.com. There is no web form and no separate privacy portal to sign up for: a plain email is the whole process, and it reaches the operator directly.

Pick your request type to open a pre-filled message:

• Request access
• Request rectification
• Request deletion
• Request portability
• Request restriction
• Request objection

If those links do not open your mail program, copy the template below into a new message to privacy@drawoble.com instead. Nothing is lost by writing the request in your own words — the template only helps us route it without a follow-up question.

Request type:               access | rectification | deletion |
                            portability | restriction | objection
Registered account email:
Explanation:

Attach any supporting document to the email itself. There is deliberately no upload form here: a document you attach to a message stays in that message, and we do not build a public upload endpoint for identity papers.

Please do not send data rights requests to the security or abuse addresses — those have their own process, described in the Security Policy.

3. How we confirm the request is yours

Acting on a data request from the wrong person is itself a data breach, so we confirm who is asking before we act. We use the lightest check that works, in this order — KVKK Article 11 requires data minimisation here too, and asking for an identity document when a reply from your own mailbox would do is over-collection.

Tier 1 — email ownership (the default)

We send a confirmation message with a one-time code to the account email address on file, and act once you send that code back. Nothing else is asked for. Because the confirmation goes to the registered address rather than the address that wrote to us, someone else writing in your name cannot complete this step.

Tier 2 — when the registered address is gone

If you no longer have access to the signup address, we ask for a proof tied to the account content instead: a .drawo file you still hold from the account, which we match against the project record, together with details only the account owner would know, such as project names and roughly when they were created.

Two checks that a privacy policy might promise are deliberately not offered here. Payment history cannot be used, because Drawoble does not charge and has no payment processor yet. A match against the original sign-in IP address and time zone cannot be used either, because that abuse-prevention record is cleared about a day after the address goes idle, so it no longer exists by the time a request arrives.

Tier 3 — identity document, only on documented suspicion

We ask for an identity document only where there are recorded signs of impersonation or fraud, and the grounds are written into the request record at the time the document is requested — never as a routine step, and never for a whole request type. Anything you send at this tier is used for the identity check alone and is deleted once the request is closed.

4. How long it takes

We answer within 30 days of a request being confirmed as yours. That single window satisfies both KVKK Article 13 and GDPR Article 12(3), so there is one deadline rather than two.

If a request is genuinely complex, GDPR Article 12(3) allows the window to be extended by up to two further months. We tell you that we are using the extension, and why, at the moment we take it — not in the fourth week when the original deadline is about to lapse. Public holidays do not extend the 30 days.

Every request is recorded when it arrives, and an internal check flags any request still open after 21 days, so the deadline is watched rather than remembered.

5. What deletion actually does

Deleting your account removes your access immediately and takes your projects, drawings and uploaded images out of the live service. Details of the retention schedule are in section 6 of the Privacy Policy; the parts that matter for a deletion request are these:

• the live copies are purged on the schedule the Privacy Policy publishes, not at some unspecified future point;
• scheduled backup copies age out on their own cycle, and data already written into them can persist until that cycle lapses;
• a sign-in session already issued can remain valid for up to an hour, because tokens are verified without a database lookup;
• records we are required to keep — for example fraud-prevention or legal-compliance records — are kept for as long as that obligation lasts, and the closure message says so.

The closure message you receive states what was deleted, what remains and why, and when the remainder falls away. We would rather tell you that than claim an erasure we cannot perform.

6. What we will not do

• We will not promise instant erasure from every copy. Backups, caches and generated exports age out on the disclosed cycles; a policy that claimed otherwise would be false.
• We will not ask for identity documents as a routine step. That is Tier 3 only, with the grounds recorded at the time.
• We will not make you register for a privacy portal. Email is the channel, and there is no account to create in order to exercise a right.
• We will not charge for a request. Responding to a data rights request is free.
• We will not answer a sensitive request without verifying it. Deletion in particular is never carried out on an unverified message.

7. If you are not satisfied

Write back and say so — most disagreements are a misunderstanding about what the product actually holds, and that is quicker to fix directly. If you would rather escalate, you may complain to the Turkish data protection authority (Kişisel Verileri Koruma Kurumu) or, in the EEA, to your local supervisory authority. Under KVKK Article 14 a complaint to the authority follows an application to us, so a request sent here first also preserves that route.

The data controller is Berk Kurtel, an individual based in Istanbul, Republic of Türkiye. Drawoble is a trade name; no company is registered for it at this stage of the product. A postal address is provided on request — write to legal@drawoble.com — and no postal address is needed to exercise any right described here.

Where this page and the Privacy Policy differ, the Privacy Policy governs; this page describes the procedure, not the rights themselves. As with every Drawoble legal document, the Türkçe text prevails if the two language versions conflict.