Privacy

Data controller

Mahsus is the data controller for everything submitted through this site. Mahsus is operated by Joshua Eren Cetindamar as a sole trader based in London, United Kingdom, while the Mahsus Ltd company formation completes. Until then, Joshua Eren Cetindamar is the UK GDPR and KVKK data controller for everything submitted through mahsus.com.

For any data-rights request — access, correction, deletion, objection — email eren@mahsus.com. We respond within 30 calendar days as required under UK GDPR Article 12.

Contact form

Anything you send through the contact form is held only so we can write back. If you send us a brief, we store the name, email, brand, and message you sent so we can reply. The lawful basis for this is UK GDPR Article 6(1)(b) — performance of a contract you have asked us to enter, i.e. responding to your enquiry. We do not share that with anyone outside Mahsus.

If we never end up working together, we delete the brief from our records within 12 months.

Inquiry and review submissions

If you send an inquiry, we store what the form asks: your name, email, the link to your listing, your number of properties, your city or market, where your bookings come from today, and your message — only so we can reply and prepare a quote. The lawful basis is UK GDPR Article 6(1)(b): responding to the request you made.

If you request the free listing review, we store your name, email, listing link and notes, and we keep a short structured note of the review's conclusions — photo grade, coverage, rights status — so a second request does not start from zero. The review is prepared by a person.

If we never end up working together, inquiries, review requests and review notes are deleted within 12 months, the same retention we have always applied to briefs.

Sub-processors

Four categories of party outside Mahsus touch data today, each operating under a data-processing agreement: email delivery (sending and receiving the studio's correspondence, including reply and reminder emails), hosting (this site and, while a Care Plan is active, client property sites), database (form submissions and guided-brief sessions), and payment processing (deposits and invoices, handled by a regulated provider — we never see or store card details). The hosting sub-processor operates in the United States under a UK GDPR Article 28 Data Processing Addendum, with international transfers covered by UK IDTA, and maintains its own published list of further sub-processors.

We use cookie-less analytics and performance measurement to count page views and track real-user performance metrics. Both are cookie-less, do not identify individual visitors, and aggregate at the URL level. We do not use Google Analytics, advertising pixels, or third-party trackers. If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all.

For visitors in Türkiye: under KVKK Article 9, the United States is not on the KVKK Board's adequacy list. Your explicit consent at the contact form is the legal basis for the US transfer of your contact-form data to the hosting sub-processor.

Cookies (PECR)

No tracking cookies, no advertising, no analytics with names attached. The only browser storage this site uses is functional: (1) a session-storage marker (mahsus_seen_v1) so the brand-intro animation plays at most once per visit, and (2) a locale-preference cookie (NEXT_LOCALE) set if you switch language between English and Turkish, so the choice persists. Both are exempt under PECR regulation 6(4)(b) (strictly necessary for the service you have requested).

Site measurement (non-personal)

The site counts steps — a page reached, a form submitted, a review requested — as session-less events with no name, no account and no profile attached. They tell us which pages work; they cannot tell us who you are. This sits alongside the cookie-less analytics described above and changes nothing in the cookies section: still no tracking cookies, no advertising, no third-party trackers.

Your rights (UK GDPR · KVKK)

You can ask us at any time what data we hold about you, ask us to correct it, ask us to delete it, restrict our use of it, or object to us holding it. Email eren@mahsus.com and we will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (UK) at ico.org.uk or with the Kişisel Verileri Koruma Kurumu (Türkiye) at kvkk.gov.tr.

If we work together on a project, the data minimums in our Statement of Work take over from this page.

Mahsus operates below the KVKK Article 16 turnover and headcount thresholds that trigger VERBİS registration; no active VERBİS record is required at this time. We will register and update this page if the threshold is crossed.

Non-disclosure (pre-engagement and during projects)

We sign one-way non-disclosure agreements on request before receiving a sensitive brief — no charge, no negotiation, 24-hour turnaround. Once a project is signed, the Statement of Work governs data handling: project files live in named, access-restricted folders; source photography is returned unaltered; intermediate working files are deleted within 90 days of final delivery unless retention is part of the brief; and a client's source photography is not used for any promotional purpose outside the agreed case study without separate written approval.

Breach notification

If we become aware of a personal-data breach involving your contact-form submission or, on an active project, your brand assets, we notify the relevant regulator within 72 hours as required under UK GDPR Article 33 — and we notify you within the same 72 hours, by email, with the facts as known and the steps we are taking. Notification is not conditional on the regulatory high-risk threshold; we notify regardless, because it is your data.

Photographer credit and image licence

Every Mahsus deliverable names the original photographer in the end-card and in the file metadata. We do not strip credits, repurpose photography across clients, or treat source material as our own work product. If your photographer has additional credit, attribution, or usage-window requirements, list them in the brief and they carry through into the deliverable and the case study.

Motion film disclosure

Every motion film Mahsus produces is generated with motion-craft tools and credits the original photographer. We are always clear where the source image comes from: where the place is real the work stays grounded in its own photography, restored to 4K in the studio where needed; where a place is not yet built, the film is labelled a concept or pre-construction visualisation and is never presented as a photograph of a finished, real place. The disclosure runs as the last frame of every film, and as part of the brief on every case study — satisfying EU AI Act Article 50(4) and UK ASA CAP Code §3.9 and §3.45 at the moment of first interaction.

The guided brief assistant

If you use the guided brief, an automated assistant (AI-assisted) helps you shape your project and prepares an indicative quote. This is disclosed the moment you begin, satisfying EU AI Act Article 50. A person at Mahsus reviews every brief before we reply.

We store your email, the conversation, any photographs you upload, and the prepared quote only to write your brief and respond. The lawful basis is UK GDPR Article 6(1)(b) — your request for a quote — together with your consent to use the assistant. If the project does not proceed, we delete the conversation and the photographs within 90 days.

The assistant runs through a sub-processor under a data-processing agreement; your conversation and images are used only to prepare your brief and are not used to train its models. We do not sell this data or share it with any other third party. If you choose to pay on the site, payment is handled by a regulated payment provider — we never see or store your card details.

Benchmarking (a future practice)

As kit properties come online, we will compile each property's monthly performance figures — bookings, sessions, film plays, booking clicks — into an aggregated, anonymized benchmark: portfolio averages and ranges that no reader can trace back to a single property. Property-level figures are published only with written consent, as with the Open Pilot on our Evidence page.

Never guest data. The property sites we build store no guest personal data, and nothing about any guest enters the benchmark. What is aggregated is the performance of films and pages, not people.

Reminder emails and opting out

If you begin a brief or request a review and leave your email, we may send a small number of reminder emails about that specific request — never a list, never marketing. Every one carries an unsubscribe link, and replying "stop" works just as well. The dispatch is separate, arrives only if you subscribed, and unsubscribes the same way.