In short
This site does not track you across sites and does not run ad tracking. Google Analytics cookies are used only if you allow them; if you do not, no cookies are written to your browser and the site works just the same.
Who is responsible
Ercüment Sarıtaş, the data controller under Turkey’s Personal Data Protection Law (KVKK, Law No. 6698). Contact: merhaba@ercumentsaritas.com.
Visitor statistics
I see how many people view which pages with two tools.
Cloudflare Web Analytics runs on every visit. It does not use cookies and does not identify you individually; I only see totals.
Google Analytics (Google) loads only if you choose “Accept” in the cookie banner; if you make no choice or decline, no request is sent to Google. If you accept, it measures which pages you view, where you came to the site from, your device and browser type and your approximate location (country, city). To do this it writes the _ga and _ga_VP45J8XGDK cookies to your browser; they last up to two years (Google: Analytics cookies). Google states that Analytics does not log or store IP addresses (Google: privacy in Analytics). Advertising cookies and ad personalisation are turned off. Detailed visit data in Google Analytics is deleted after two months.
I process this data on the basis of your explicit consent (KVKK art. 5(1)). Because Google’s servers are located outside Turkey, if you accept, this data is transferred abroad; this notice and the cookie banner are how I inform you of that. You can withdraw your consent at any time: press “Cookie settings” at the bottom of the page and choose “Decline”; Google Analytics stops and its cookies are deleted. Your choice is kept in your browser’s local storage (not in a cookie).
Hosting and server logs
The site is hosted on Cloudflare. Like any web server, Cloudflare processes technical information such as your IP address to deliver the site to you and protect it from attacks. Cloudflare processes these logs on my behalf as a data processor; it does not set a fixed period but keeps them for as long as its business purposes and legal obligations require (Cloudflare privacy policy).
External resources
The font is served from the site itself. The contact page loads Cloudflare Turnstile from Cloudflare’s server (challenges.cloudflare.com) to protect the form from bots. Some of the photos on the pages are currently loaded from Unsplash’s server (images.unsplash.com); like any web server, Unsplash then sees your IP address and browser information.
The contact form
When you fill in the contact form, I process your name, email address, the topic you choose, your website or social media account if you give one, and your message. When you email me directly, I process the information in your email. For bot protection (Cloudflare Turnstile), your IP address and technical information from your browser are processed, and your IP address is used in a one-minute counter to block many submissions from the same address in a short time. The form server does not write your personal data to its logs. For this, Turnstile processes your IP address, your browser’s User-Agent, a technical fingerprint of the connection (TLS) and the site the form is on; according to Cloudflare, this data is used only to tell bots apart, not to identify people (Cloudflare: Turnstile privacy addendum).
I use this information only to reply to you, understand your request and prepare a quote. It is not used for marketing emails, and it is never sold or rented. Your message is delivered to my inbox through Cloudflare’s email routing service (Email Routing) and is not stored separately on the site or at Cloudflare. My inbox is hosted on Google’s email infrastructure. The legal bases are article 5(2)(c) of the KVKK (directly related to setting up a contract: replying to your request and preparing a quote) and article 5(2)(f) (legitimate interest, provided it does not harm your fundamental rights and freedoms: replying to you and protecting the form from bots). Because Cloudflare’s and Google’s servers are also located outside Turkey, the information you send through the form may pass through servers abroad; this notice is how I inform you of that. Apart from this, your data is not transferred abroad without informing you first. Messages sent through the form are kept for one month and then deleted.
Your rights
Under article 11 of the KVKK you can ask whether your data is processed, request information about it, ask for it to be corrected or deleted, and object to processing. Send your request in writing or by email to merhaba@ercumentsaritas.com. It will be concluded as soon as possible, depending on its nature, and within thirty days at the latest, free of charge; if it involves an additional cost, a fee set by the Personal Data Protection Board may be charged (KVKK art. 13).
Changes
If this notice changes, the current version is published on this page and the date at the bottom changes.