Privacy Policy

Controller: Bedel Boseli, an independent Kurdish researcher, writer and digital media producer based in Switzerland.

Contact: [email protected] — or via the contact form at bedelboseli.com/contact.

This website and its associated social channels publish research, articles, videos and educational material on Kurdish history, culture and identity.

Information you provide directly: name, email address and message content when you use our contact or newsletter forms; comment content, name and (optionally) email when you comment on our website or social channels.

Information collected automatically: IP address, browser type, device information, pages visited, referrer URL, and approximate location derived from IP. We use Google Analytics 4 with IP anonymization to understand how the site is used.

Information from Meta/Facebook webhooks: When users comment on or mention our Facebook Page, Meta sends us the comment text, the commenter's public Facebook user ID and public name, timestamps, post identifiers, and related metadata via the Graph API. We do not request private profile information.

Cookies and similar technologies: strictly necessary cookies for site functionality, plus optional analytics cookies (see section 11).

To operate, maintain and improve bedelboseli.com and its content.

To respond to your messages and deliver the newsletter you subscribed to.

To moderate comments on our official social media channels in real time, removing or hiding hateful, threatening, defamatory or harassing content while preserving legitimate criticism and debate.

To document and report illegal content (threats, defamation, hate speech) to the relevant platforms and, where necessary, to Swiss law enforcement and judicial authorities (including the Fribourg Public Prosecutor's Office) as part of ongoing legal proceedings.

To produce anonymous, aggregate statistics about online harassment targeting Kurdish public figures, which may be published for research and human-rights advocacy purposes.

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): newsletter and contact requests.

Legitimate interests (Art. 6(1)(f) GDPR; Art. 31 nLPD): operating the site, securing it against abuse, moderating our own social channels, and preserving evidence of unlawful behaviour against the controller.

Compliance with legal obligations (Art. 6(1)(c) GDPR): retaining evidence for ongoing or anticipated judicial proceedings; responding to lawful requests from competent authorities.

Consent (Art. 6(1)(a) GDPR): optional analytics cookies. You may withdraw consent at any time.

Our official Facebook, Instagram, YouTube, TikTok and X pages receive a high volume of comments, including organised harassment, ethnic slurs and threats. To protect community members and preserve a respectful space, we operate an automated moderation system called kontrolAI.

How it works: when a user comments on our Facebook Page, Meta sends the comment to a secure webhook at kontrol.bedelboseli.com. The comment text and limited metadata are then analysed using a third-party large language model (Anthropic Claude) to classify whether the content contains hate speech, threats, defamation, or qualifies as legitimate criticism.

Outcomes: comments classified as hateful or threatening are hidden from public view using Facebook's standard comment-hiding feature. The author is not notified and is not blocked from the page. Legitimate criticism — including critical, negative or politically opposing views — is never hidden.

Human oversight: classification results are reviewable by the controller. Users may dispute a moderation decision at any time by contacting us; we will re-examine the decision and restore the comment if appropriate.

Evidence retention: full comment content, author identifiers (as provided by Meta), timestamps, classification reasoning and the moderation action taken are stored in a PostgreSQL database hosted in Switzerland, as a chain of evidence usable in civil or criminal proceedings.

We do not sell or rent personal data. We share limited data only with the following processors, each governed by appropriate data-processing agreements or standard contractual clauses:

Meta Platforms, Inc. — Facebook and Instagram pages, webhook delivery, Graph API.

Anthropic, PBC — content classification via the Claude API. Inputs are not used to train Anthropic's models.

Cloudflare, Inc. — DNS, CDN, DDoS protection and Web Application Firewall.

Google LLC — Google Analytics 4 (IP-anonymised), YouTube embedded player.

Hostinger International Ltd. — server hosting (EU data centre).

Law-enforcement and judicial authorities — only where required by Swiss law or by binding court order, in particular in the context of pending criminal complaints filed by the controller.

Newsletter subscriptions: until you unsubscribe.

Contact form messages: 24 months, unless ongoing correspondence requires longer retention.

Analytics data: 14 months (Google Analytics default for the EU region).

Moderated comments and chain-of-evidence logs: retained for as long as the related legal proceeding is pending, plus the applicable Swiss statutory limitation periods. Where no proceeding exists, comments classified as unlawful are retained for up to 5 years.

Server access logs: 30 days for security purposes.

Under the nLPD and the GDPR you have the right to: access your personal data; request rectification of inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; data portability; and withdraw any consent you have given.

To exercise these rights, contact [email protected]. We will respond within 30 days.

Important: where personal data is retained as evidence of unlawful conduct in pending or anticipated legal proceedings, erasure may be refused on the basis of overriding legitimate interests and compliance with legal obligations.

If you believe your rights have been violated, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you reside in the EU, with your national supervisory authority.

Some of our processors (Meta, Anthropic, Google, Cloudflare) are based outside Switzerland and the EEA, primarily in the United States. Transfers are protected by the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework and/or Standard Contractual Clauses, supplemented by appropriate technical and organisational measures.

We use TLS 1.3 encryption for all data in transit, encrypted-at-rest databases, principle-of-least-privilege access controls, multi-factor authentication for administrative access, and regular security updates. The kontrolAI evidence database is hosted on a hardened server with restricted SSH access and audited logs.

We use strictly necessary cookies to keep the site functional (e.g. language preference). With your consent, we also use Google Analytics 4 with IP anonymization to understand how visitors use the site. You can withdraw consent at any time via your browser settings or by using a privacy extension.

Our services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Substantive changes will be announced on the website.

Email: [email protected]

Website: bedelboseli.com/contact

Postal correspondence is available upon request via email.