Privacy Notice, KVKK / GDPR Disclosure & Cookie Policy

1. Data Controller & Institutional Contact

• Platform & Data Controller: nadir lab. (Independent Spacecraft Engineering & Astrodynamics Research Publication — https://nadirlab.space).
• Contact & Data Protection Inquiries: hi@nadirlab.space

2. Categories of Processed Data, Purposes & Legal Bases

• Server Access Logs (IP address, request timestamp, HTTP path, user-agent, referrer): Processed automatically by the web hosting infrastructure solely to maintain network security, mitigate abuse, and diagnose server faults. Legal basis: Legitimate interest and legal obligation (KVKK Art. 5(2)(ç) and 5(2)(f); GDPR Art. 6(1)(f)).
• Interface & Functional Preferences (localStorage keys nl_consent, sathq:reader, nl_recent_searches, nl_learn_progress, nl_celestrak_omm_v1): Stored locally in your browser to preserve your consent choice, reading layout, recent command-palette selections, curriculum progress, and 2-hour CelesTrak OMM cache. No first-party cookies are set without consent and no localStorage data is transmitted to our servers. Legal basis: Strictly necessary for service delivery requested by the user (KVKK Art. 5(2)(c)/(f); ePrivacy Art. 5(3); GDPR Art. 6(1)(b)/(f)).
• Aggregate Readership Analytics (Google Analytics 4 — Property G-ENZDSK78XL): Implemented in strict Basic Consent Mode. Prior to clicking 'Accept Analytics', the Google Analytics script (googletagmanager.com) is not loaded and zero requests are sent to Google servers. If you opt in, Google Analytics collects pseudonymous page-view, device, and session metrics. Legal basis: Explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)).
• Direct Email Correspondence (hi@nadirlab.space): When you contact us with technical errata, mission updates, or inquiries, your email address, sender name, and message content are processed solely to respond to and archive the correspondence. Legal basis: Communication initiated by the data subject and legitimate interest (KVKK Art. 5(2)(c)/(f); GDPR Art. 6(1)(b)/(f)).

3. Recipients & International Data Transfers (KVKK Art. 8–9 / GDPR Chapter V)

• Web Hosting Provider (Data Processor — Türkiye): Static site files and server access logs are hosted on managed Linux cloud infrastructure located in Türkiye acting as a data processor; no cross-border transfer occurs for static page delivery.
• Google LLC (United States — Analytics, Opt-in Only): Only when you explicitly grant analytics consent, pseudonymous measurement events are transferred to Google LLC servers in the United States based on your explicit consent (KVKK Art. 9; GDPR Art. 45 EU–US Data Privacy Framework / Art. 49(1)(a)). Google Analytics 4 does not log or store full IP addresses, and Google Signals / advertising personalization features are disabled in code.
• CelesTrak (celestrak.org — User-Initiated Only): All engineering calculators run 100% locally in your browser. Only when you explicitly click the 'Sync CelesTrak' button inside the Live Orbit Tracker (/lab/tracker) does your browser establish a direct HTTPS connection to celestrak.org to retrieve public GP orbital elements.

4. Collection Methods & Retention Periods

Server logs are collected automatically via HTTPS requests and retained by the hosting provider for statutory security and diagnostic windows (typically 30 to 90 days). Analytics cookies (_ga, _ga_ENZDSK78XL) have a maximum browser lifetime of 24 months unless cleared earlier; withdrawing consent via 'Cookie Preferences' immediately deletes these cookies from your browser. Email correspondence is retained for the lifecycle of the relevant technical record.

6. Your Rights under KVKK (Art. 11) & GDPR (Art. 15–22)

• Under Article 11 of Law No. 6698 (KVKK) and Articles 15–22 of the GDPR, you have the right to: learn whether your personal data are processed; request information if processed; learn the purpose of processing and whether data are used in accordance with that purpose; know the third parties in the country or abroad to whom personal data are transferred; request rectification of incomplete or inaccurate data; request erasure or destruction of data and notification of such actions to third-party recipients; object to any unfavourable result arising from analysis exclusively by automated systems; claim compensation for damages arising from unlawful processing; withdraw consent at any time with future effect; and lodge a complaint with the competent data protection supervisory authority.
• You may submit your requests and applications in writing via email to hi@nadirlab.space; all applications will be answered free of charge as soon as possible and within 30 days at the latest.