Privacy

Data controller

Mahsus is the data controller for everything submitted through this site. Mahsus is operated by Joshua Eren Cetindamar as a sole trader based in London, United Kingdom, while the Mahsus Ltd company formation completes. Until then, Joshua Eren Cetindamar is the UK GDPR and KVKK data controller for everything submitted through mahsus.com.

For any data-rights request — access, correction, deletion, objection — email eren@mahsus.com. We respond within 30 calendar days as required under UK GDPR Article 12.

Contact form

Anything you send through the contact form is held only so we can write back. If you send us a brief, we store the name, email, brand, and message you sent so we can reply. The lawful basis for this is UK GDPR Article 6(1)(b) — performance of a contract you have asked us to enter, i.e. responding to your enquiry. We do not share that with anyone outside Mahsus.

If we never end up working together, we delete the brief from our records within 12 months.

Sub-processors

One party outside Mahsus touches your data today — the hosting sub-processor, named and contractually bound. The site is hosted in the United States by a sub-processor operating under a UK GDPR Article 28 Data Processing Addendum, with international transfers covered by UK IDTA. The sub-processor maintains its own published list of further sub-processors.

We use cookie-less analytics and performance measurement to count page views and track real-user performance metrics. Both are cookie-less, do not identify individual visitors, and aggregate at the URL level. We do not use Google Analytics, advertising pixels, or third-party trackers.

For visitors in Türkiye: under KVKK Article 9, the United States is not on the KVKK Board's adequacy list. Your explicit consent at the contact form is the legal basis for the US transfer of your contact-form data to the hosting sub-processor.

Cookies (PECR)

No tracking cookies, no advertising, no analytics with names attached. The only browser storage this site uses is functional: (1) a session-storage marker (mahsus_seen_v1) so the brand-intro animation plays at most once per visit, and (2) a locale-preference cookie (NEXT_LOCALE) set if you switch language between English and Turkish, so the choice persists. Both are exempt under PECR regulation 6(4)(b) (strictly necessary for the service you have requested).

Your rights (UK GDPR · KVKK)

You can ask us at any time what data we hold about you, ask us to correct it, ask us to delete it, restrict our use of it, or object to us holding it. Email eren@mahsus.com and we will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (UK) at ico.org.uk or with the Kişisel Verileri Koruma Kurumu (Türkiye) at kvkk.gov.tr.

If we work together on a project, the data minimums in our Statement of Work take over from this page.

Mahsus operates below the KVKK Article 16 turnover and headcount thresholds that trigger VERBİS registration; no active VERBİS record is required at this time. We will register and update this page if the threshold is crossed.

Non-disclosure (pre-engagement and during projects)

We sign one-way non-disclosure agreements on request before receiving a sensitive brief — no charge, no negotiation, 24-hour turnaround. Once a project is signed, the Statement of Work governs data handling: project files live in named, access-restricted folders; source photography is returned unaltered; intermediate working files are deleted within 90 days of final delivery unless retention is part of the brief; and a client's source photography is not used for any promotional purpose outside the agreed case study without separate written approval.

Breach notification

If we become aware of a personal-data breach involving your contact-form submission or, on an active project, your brand assets, we notify the relevant regulator within 72 hours as required under UK GDPR Article 33 — and we notify you within the same 72 hours, by email, with the facts as known and the steps we are taking. Notification is not conditional on the regulatory high-risk threshold; we notify regardless, because it is your data.

Photographer credit and image licence

Every Mahsus deliverable names the original photographer in the end-card and in the file metadata. We do not strip credits, repurpose photography across clients, or treat source material as our own work product. If your photographer has additional credit, attribution, or usage-window requirements, list them in the brief and they carry through into the deliverable and the case study.

Motion film disclosure

Every motion film Mahsus produces is generated with motion-craft tools and credits the original photographer. The disclosure runs as the last frame of every film, and as part of the brief on every case study — satisfying EU AI Act Article 50(4) and UK ASA CAP Code §3.45 at the moment of first interaction.

The guided brief assistant

If you use the guided brief, an automated assistant (AI-assisted) helps you shape your project and prepares an indicative quote. This is disclosed the moment you begin, satisfying EU AI Act Article 50. A person at Mahsus reviews every brief before we reply.

We store your email, the conversation, any photographs you upload, and the prepared quote only to write your brief and respond. The lawful basis is UK GDPR Article 6(1)(b) — your request for a quote — together with your consent to use the assistant. If the project does not proceed, we delete the conversation and the photographs within 90 days.

The assistant runs through a sub-processor under a data-processing agreement; your conversation and images are used only to prepare your brief and are not used to train its models. We do not sell this data or share it with any other third party. If you choose to pay on the site, payment is handled by a regulated payment provider — we never see or store your card details.