Privacy Policy

Last updated: 26 September 2026

This notice explains how personal data is processed when you use RadioTEDU's website, account features, email newsletter, and Model Context Protocol (MCP) connection. Cookie choices are explained in the Cookie Policy.

Data controller and contact

RadioTEDU operates within TED University. TED University is the data controller for the digital services described here. For general questions, contact radio@tedu.edu.tr. For formal applications under Turkish data-protection law (KVKK), use the form and methods listed on TED University's personal data protection page. Address: TED University, Ziya Gökalp Caddesi No. 48, 06420, Kolej, Çankaya, Ankara, Türkiye.

Institutional identification for TED University Economic Enterprise: Çankaya Tax Office, tax identification number 8330496440. This identifies the enterprise for tax purposes; it does not mean that RadioTEDU makes direct sales or collects payments.

Data, purposes, and legal bases

For services covered by this notice, account and requested-feature data are processed as needed to provide the service; security and anti-abuse records are processed on the basis of legitimate interests where applicable; newsletter and Google Analytics are processed only with your consent. Where KVKK applies, the relevant bases may include Article 5(2)(c) (contract), Article 5(2)(f) (legitimate interest), Article 5(1) (explicit consent), and Article 5(2)(ç) (legal obligation), depending on the purpose. Where GDPR applies, the corresponding bases are Article 6(1)(b) (contract), Article 6(1)(f) (legitimate interests), Article 6(1)(a) (consent), and Article 6(1)(c) (legal obligation). We explain any different basis when collecting the relevant data. A privacy notice does not itself collect consent.

Account and listening features

When you create an account, we may process your display name, email address, account and session information, and, if you register with a non-TEDU email address, the age information requested during registration. When enabled for your account, favourites, listening history, episode progress, and preferences may also be processed. We use this information to create and protect your account, provide the features you choose across devices, and respond to support requests.

Contact and comments

If you use a contact form or email us, your name, contact details, and message are processed to respond. If comments are enabled, the display name, email address, comment, IP address, and browser information may be processed for publication, spam control, and security. If Gravatar is enabled, a hash generated from your email address may be sent to Gravatar. These details are collected only when you use the relevant feature.

Email newsletter

The monthly podcast selection and RadioTEDU announcements are optional. If you subscribe, we process your email address, language preference, consent-text version and timestamp, and subscription and delivery status. Subscriber email addresses are stored encrypted in the newsletter system. This processing is based on your consent; you can withdraw it through the unsubscribe link in any newsletter. Newsletter consent is not required to create an account.

Analytics and security checks

Google Analytics 4 loads only after you give explicit consent through the analytics preference. If you allow it, visited pages, interactions, sessions, device and browser information, approximate location, and Google Analytics cookies may be processed for measurement. Google Analytics stops if you change or withdraw your choice. Advertising storage and personalized-advertising settings remain off.

Google reCAPTCHA may process device, browser, and interaction signals on protected forms to reduce spam and automated abuse. RadioTEDU uses this check to protect the relevant form; Google's own data-handling terms also apply.

MCP and studio bookings

Public information about RadioTEDU stations, programmes, podcasts, and schedules can be read through the RadioTEDU MCP without an account. Do not include personal or sensitive details in search queries. Studio-availability responses contain room information and aggregate availability only; they do not reveal another person's identity or booking records.

The book_studio_slot tool creates a studio booking. It is available only to an authorized, signed-in TED University account and requires your explicit confirmation of the requested booking details. The account identity comes from the signed-in ERP profile; names, email addresses, and phone numbers are not requested as tool inputs or returned in the response. The booking date and time, room, attendee count, and a short purpose are sent to the ERP. The authentication token is not stored persistently by the MCP service. A temporary record used to prevent duplicate requests is cleared after 15 minutes. The ERP booking record follows the applicable institutional retention schedule.

If you connect through a third-party AI application, that provider may process your chat content and connection credentials under its own terms. Review that provider's privacy information as well; do not put unnecessary personal details or access tokens in chat or search queries.

No sales or payment processing in these services

The RadioTEDU radio, podcast, account, and MCP features described in this notice do not provide product or ticket sales or payment processing. These features do not collect bank or payment-card details for a sale. This notice does not describe separate TED University services.

Recipients and international transfers

Where needed for the purposes above, data may be shared with website hosting and security providers; Google for Google Analytics or reCAPTCHA; TED University's email infrastructure for newsletter delivery; the RadioTEDU Hub ERP for authorized studio bookings; and public authorities where legally required. Google services may process some data outside Türkiye. International transfers are made only when the applicable conditions and safeguards under KVKK Article 9 and, where applicable, GDPR Chapter V are met.

Retention periods

• Account information and preferences are kept while your account is active. A closure or deletion request is assessed after records that must be retained by law are identified.
• Newsletter data is used while the subscription remains active. Unsubscribe and consent records may be retained as needed to prevent unsolicited messages and demonstrate the consent history.
• Contact requests are currently retained for 6 months, unless an open request or legal requirement requires a longer period.
• Google Analytics measurements are retained for 1 year after analytics consent.
• Comments are retained while published and while needed for spam or moderation purposes; they are deleted or anonymized when those purposes end unless a legal requirement applies.
• The MCP idempotency record expires after 15 minutes. Expired cache files are removed during a later MCP request, so physical cleanup may be delayed if no new MCP request arrives. The underlying studio booking remains in the ERP under the applicable institutional retention schedule.

Your rights and how to apply

Under Article 11 of KVKK, you may ask whether your data is processed, request information about the processing and recipients, request correction of incomplete or inaccurate data, request deletion or destruction where the legal conditions are met, ask that relevant updates be notified to recipients, object to a result against you produced solely through automated analysis, and seek compensation for unlawful processing. Submit formal KVKK applications using the methods listed on TED University's personal data protection page. For general questions, email radio@tedu.edu.tr. Applications are answered within 30 days under the applicable procedure.

Where GDPR applies, you also have rights to access, rectification, erasure, restriction of processing, data portability, and, in certain circumstances, to object; to withdraw consent for consent-based processing; and to complain to a competent supervisory authority. GDPR requests are generally answered within one month. See the European Commission's information about individual rights under the GDPR. The applicable rights depend on the processing and circumstances.

Security and changes

Technical and organizational measures are used to limit access to people and services that need it, protect data in transit, and prevent misuse. If a data-security incident occurs, notices to affected people and authorities are made as required by applicable law. This notice is updated when the services or processing activities change; the latest update date appears above.