Privacy & Cookies

1. Short summary

Visit measurement (Google Analytics 4) runs on this site only if you allow it; that is why you are asked on your first visit. If you do not allow it, the measurement code is not loaded, no measurement cookie is written and no measurement request is sent to Google Analytics. There is no advertising, remarketing or behavioural targeting tag on this site, and no embedded third-party content (iframe, video, map, external web font, CDN) — the fonts are served from our own server.

If this site is displayed inside another website as a frame (iframe), the consent banner is not shown and measurement never runs — even if you allowed it earlier.

What you type into the application forms is a separate flow and is unrelated to measurement (§4). The server's technical access and security logs (§5) are kept in all cases. You can change your choice at any time with the Privacy choices button at the bottom of every page.

2. Data controller

For this website the data controller is TuğraVarlık (tugravarlik.com): the party that operates the site and determines the purposes and means of processing personal data. This text is provided to meet the disclosure duty under Article 10 of the KVKK.

Stated gap — partial compliance. “TuğraVarlık” is a brand name; it is neither a natural nor a legal person within the meaning of Article 3/1(ı) of the KVKK. The identity element of Article 10 is therefore not fully met in this text. No verified trade name, registration, MERSİS number or registered address is published on this site, so none is written here either — no guess and no invented information is used. This text does not claim full regulatory compliance; this section will be updated with the name once the gap is closed.

You can send requests under the KVKK to: info@tugravarlik.com — your request is answered within 30 days at the latest under Article 13 of the KVKK (details: §9).

The right most often needed — withdrawing your permission — requires no request: the Privacy choices button at the bottom of every page turns measurement off immediately, and the measurement cookies are then deleted.

3. Cookies and similar technologies

If you allow it, first-party measurement cookies are used for Google Analytics 4: _ga and _ga_X6F21CBJ1W. Their lifetime is 90 days — this is not a legal limit but our own choice of voluntary data minimisation; the period is not restarted on each visit. If you do not allow it, these cookies are not written and no measurement request is sent to Google Analytics; the default state is declined. Measurement ID: G-X6F21CBJ1W.

Advertising personalisation and Google signals are switched off in the code. Google's “Consent Mode – denied” pattern is not used; in that pattern a signal would still reach Google for a visitor who declines, so on this site measurement is not loaded at all until it is allowed.

Measurement data is not anonymous; it is pseudonymous. Google Analytics assigns your browser a random client identifier; in legal terms that data counts as pseudonymous. You are not asked for your identity and no name-level profile is built about you.

What is measured — including Enhanced Measurement

Google Analytics 4's “Enhanced Measurement” feature is on by default; measurement is not limited to page views. If you allow it, the following are counted:

• page views;
• first visit and session start;
• engagement time;
• reaching about 90 per cent of the page (scroll depth);
• outbound link clicks — the external link targets on this site are varlikalsat.com, galataassets.com, www.vatanseverbilisim.com, pagespeed.web.dev, www.diligencepilot.com and, on this page, www.kvkk.gov.tr and tools.google.com (7 external domains in total, 432 links);
• file downloads — the 3 .zip brand-kit links on the brand resources page trigger this event. The .svg and .png links on the same page do not, because those extensions are not in Google Analytics 4's default file-extension list.

The site has no on-site search box and no embedded video, so search and video engagement events do not occur.

The record of your choice

Your choice — your decision, the date of the decision, the expiry date and the consent scope version — is stored in a local record that is not a cookie, in this browser, for 12 months, and is never sent to our server.

• Technical record name: tv-riza
• Location: your browser's localStorage area (on this device only)
• Content: the measurement decision (allowed / not allowed), the decision date, the expiry date, the consent scope version (analytics-scope-01)
• Lifetime: 12 months — allowing and declining are stored for the same period. When it expires you are asked again; if you delete it, or your browser clears site data, the record is gone.

Wording, design or explanatory updates do not reset your choice. You are asked again only if the scope of the measurement expands materially: a new provider, a new data category, a new recipient, a new purpose, advertising/Google signals, matching with a user ID, cross-site tracking, or a significant extension of the retention periods.

The earlier consent layer of this site used the same record name with a different schema. A record in that format is invalid under the new schema and is deleted from your browser once when the new version first runs, so two separate records are not left on your device. At the same time, any measurement cookies previously written to this browser are cleared until you make a new decision.

4. Application and contact data

This section describes a flow that is independent of measurement. If you fill in a seller or investor application form, the following are processed: name and surname, telephone, e-mail, organisation, investor type, asset type, transaction purpose, region preference/level, size or budget band, time horizon, document readiness, NDA/verification statements, communication-permission preference, application source information, IP address, timestamp and whatever you share in the body of the application. No identity document, title deed, financial statement or file upload is requested at the first application stage.

The content of form fields is not sent to measurement. Measurement data is not matched with application details such as your name, e-mail or telephone. Error pages produced on the server side by the application process are likewise outside the scope of measurement.

Collection method: data is collected electronically through web forms, e-mail correspondence, application source information and server logs. Measurement data is collected only through the Google Analytics 4 code that runs in your browser after your explicit consent.

Scope: this text covers the personal data processed through tugravarlik.com. The sibling brand links on the site (VarlıkAlSat, GalataAssets) are separate websites; if you follow a link you leave this site and the texts of the site you open apply. This text makes no statement on behalf of those sites.

5. Server access and security logs

When the site is accessed, standard technical information such as the IP address, access time, requested page, browser or device information and server response code may be processed in the hosting infrastructure in order to serve the website and keep it secure. These records are not used for advertising or marketing, no behavioural user profile is built, and they are not transferred to a separate visit-measurement system.

No aggregated visit counting is carried out from the server logs either. If it is to be carried out, a written legitimate-interest balancing test will be prepared first and this text will be updated.

Not yet verified, stated plainly: the full legal name of the hosting provider, the actual retention period of the server logs and the country or countries in which the logs are processed have not been verified by us. This section is not complete until those three items are verified; uncertain information is not written by guesswork and will be added here once verified.

The hosting provider's own script. The hosting server was able to append its own traffic-monitoring script (img1.wsimg.com/traffic-assets/js/tccl.min.js) to the HTML pages it serves and to write the cookies _tccl_visitor, _tccl_visit and _scc_session without asking the visitor. In a measurement carried out on the live site on 31.08.2026 — across the www and non-www addresses, seven separate pages and a 404 response — neither that script injection nor any Set-Cookie header for those cookies was observed. If the provider changes this behaviour, this section will be updated. That is why we avoid absolute wording about cookies in general; the accurate statement is: unless you allow it, this site's published package writes no cookie at all.

6. Purposes of processing and legal grounds

• Visit measurement (only with permission): to understand which content is of interest and to improve the site — legal ground: explicit consent (KVKK Art. 5/1).
• Receiving and assessing applications: understanding the seller or investor profile, contacting you, recording authority and seriousness statements, running the confidentiality and staged-access process, preventing abuse and spam applications — legal ground: direct connection with the conclusion or performance of a contract (KVKK Art. 5/2-c) and legitimate interest (KVKK Art. 5/2-f).
• Contact and application correspondence: if you write to the address above, your e-mail address and message are processed solely to reply to you — legal ground: legitimate interest (KVKK Art. 5/2-f).
• Server access and security logs: operating the site, ensuring information and system security, detecting errors and outages, preventing unauthorised access — legal ground: legal obligation (KVKK Art. 5/2-a) and applicable legislation.
• Optional information messages: only if you give separate and explicit permission — legal ground: explicit consent.

Legitimate interest is not claimed for measurement. These processing activities rest on different legal grounds and do not substitute for one another. If you do not allow measurement it never starts; if you withdraw your permission it stops.

7. Transfers, including transfers abroad (KVKK Art. 9)

Domestic transfers: application and contact data may be shared, only to the extent necessary for the process and under a confidentiality obligation, with technical infrastructure providers, e-mail and hosting service providers, authorised team members, independent service partners such as legal, tax, audit or valuation advisers, and with public authorities legally entitled to receive it. Identity and sensitive commercial information is protected through the staged-disclosure principle.

Measurement data: if you allow measurement, your visit data is transferred to Google (Google Ireland Limited / Google LLC) and may be processed outside Türkiye in Google's infrastructure. The legal ground for that transfer is your explicit consent.

We state this plainly: the transfer is regular in nature, and the Law requires an additional appropriate safeguard (for example the Board's standard contract) for regular transfers; no such contract has been concluded with Google. The site owner has chosen to run measurement on the basis of explicit consent while that gap persists. This text therefore does not claim full regulatory compliance. If you do not allow it, no transfer takes place at all.

Server access logs are a separate flow and are not part of the measurement transfer described above. For those logs the recipient's legal name, the country in which they are processed and any cross-border transfer mechanism are not stated in this text; those three items have not been verified by us and are not written by guesswork (§5).

In international investor processes, personal data is shared with persons or organisations abroad only where necessary, with staged disclosure, and in accordance with the KVKK's conditions for transfers abroad. Seller identity, directly identifying information and sensitive transaction documents are not shared without a clear transfer basis and, where required, separate explicit consent or an appropriate safeguard mechanism.

8. Retention periods

• Measurement cookies (_ga, _ga_X6F21CBJ1W): 90 days (voluntary minimisation).
• User and event data on Google Analytics servers: 2 months — this is Google Analytics 4's default setting and has not been increased.
• Preference record (tv-riza): 12 months.
• Application records and contact correspondence: at most 3 years, taking into account the nature of the application and the limitation period for possible disputes; unsuccessful or out-of-scope applications are deleted or anonymised within at most 12 months of the last action.
• Records of optional communication permission: until the permission is withdrawn and, thereafter, at most 3 years for evidentiary purposes.
• Server access and security logs: the period is set by the hosting provider; the actual period has not yet been verified by us (§5).
• Correspondence about KVKK requests: for the duration of the applicable legislation and possible dispute periods.

At the end of the period the data is deleted, destroyed or anonymised, and the destruction operations are recorded.

9. Your rights under the KVKK

Under Article 11 of Law No. 6698 you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom it is transferred at home or abroad; request rectification if it is incomplete or inaccurate; request erasure or destruction where the legal conditions are met; request that rectification and erasure be notified to the parties to whom the data was transferred; object to an outcome to your detriment arising from analysis carried out exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

You may withdraw your permission for measurement at any time, without giving a reason, with the Privacy choices button at the bottom of the page; when you withdraw it the measurement cookies are deleted and no new measurement request is sent to Google Analytics.

You may send your requests to info@tugravarlik.com; they are answered within 30 days at the latest (KVKK Art. 13). If your request is refused, the reply is inadequate or no reply is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board: kvkk.gov.tr. If you are visiting from the European Economic Area, you may also lodge a complaint with the data protection authority of your country under Article 77 GDPR.

10. How the privacy choices work

On your first visit three equal options are offered: Allow measurement · Continue without measurement · Review settings. The default state is declined; no measurement request is sent to Google Analytics until you allow it. In the “Review settings” panel the measurement category is not pre-ticked; you confirm your choice with Save choice and step back with Back.

If your browser blocks local storage (private mode and similar), your choice cannot be recorded in a provable way, so measurement is not started at all and you are told so on screen.

Other ways to turn measurement off:

• The on-site panel (recommended and primary route): the Privacy choices button at the bottom of every page.
• Browser settings: you can delete or block cookies and site data in your browser.
• Google's add-on: tools.google.com/dlpage/gaoptout disables Google Analytics measurement browser-wide.

11. Changes

When this text is updated, the last-updated date above changes. Wording and explanatory corrections do not reset your choice. If the scope of measurement expands materially (the cases listed in §3), the consent scope version is raised, your stored choice is treated as invalid and the preference banner is shown again. This is not merely a promise but a rule enforced by the software.