GDPR Notice — BVS Medya

1. Data controller

The data controller for personal data processed by BVS Social Manager and the bvsmedya.com website is BVS DOCTORS LTD, a private limited company registered in England and Wales under Companies House CRN 16987192, with registered address at 71–75 Shelton Street, London WC2H 9JQ, United Kingdom.

2. What data we process

• Contact form data — name, email and message you voluntarily submit on bvsmedya.com.
• Server logs — IP address, user agent, timestamps and requested URL, retained for security and abuse-prevention purposes.
• TikTok / YouTube / Meta API data — when an authorised brand-owner connects an account to BVS Social Manager, we receive identifiers (display_name, open_id, avatar_url, channel ID equivalents) for the sole purpose of confirming the connected account inside the editorial dashboard. We do not collect end-viewer data through these APIs.

3. Lawful bases for processing

• Consent — for contact form submissions and for the OAuth authorisations granted by brand-owners to BVS Social Manager.
• Legitimate interest — for security logging and abuse prevention.
• Contract — to operate the brand accounts entrusted to us by their owners.

4. Your rights

Under UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time (e.g. revoke BVS Social Manager authorisations from your TikTok / YouTube / Meta account settings)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority

5. Data retention

Contact form submissions are retained for as long as needed to respond to your inquiry, then archived for legal-compliance purposes for up to 24 months. Server logs are kept for up to 12 months. OAuth tokens for brand accounts are kept for as long as the authorisation remains active.

6. International transfers

Personal data may be processed on infrastructure located inside the UK, the EU and Türkiye. Where personal data leaves the UK/EU, transfers rely on appropriate safeguards (UK adequacy regulations, EU adequacy decisions or Standard Contractual Clauses).

7. How to exercise your rights

To exercise any of the rights above, write to [email protected]. We will respond within one month, as required by GDPR.