Privacy & Measurement

Who is responsible?

Data controller: TuğraVarlık (tugravarlik.com) — the party that operates this website and determines the purposes and means of processing personal data. This page serves the transparency obligation under Article 10 of the Turkish Data Protection Law (KVKK).

Requests: you can send requests under KVKK Article 11 to info@tugravarlik.com; they are answered within 30 days at the latest (KVKK Article 13). The most frequently needed right — withdrawing your consent — needs no request at all: the “Cookie preferences” link in the footer of every page opens the panel, and choosing “Necessary only” stops measurement immediately and deletes the measurement cookies.

An honest note on identity: KVKK Article 3/1(ı) defines a data controller as a “natural or legal person”. What is named above is a brand name; since no registered trade name, MERSİS or registry number has been published, this line improves transparency but does not fully satisfy the identity element of Article 10. No legal identity has been invented; this is a deliberate, recorded gap. When a registered identity is published, this section will be updated by name and the consent-text version will be raised.

Measurement is off until you accept

The default state is “declined”. Until you press “Accept”, no measurement cookie is written and no request is made to Google (including googletagmanager.com). The measurement code is loaded only after your consent.

What we use

Google Analytics 4, measurement ID G-X6F21CBJ1W. The purpose is to understand which pages are useful. The primary event is the page view (page_view).

Google’s “Enhanced Measurement” is on by default and may additionally collect outbound link clicks (outbound_click), scroll depth, file downloads (file_download), site search and video engagement. This site contains 429 links to 5 external destinations (varlikalsat.com, galataassets.com, vatanseverbilisim.com, pagespeed.web.dev, tools.google.com) and downloadable brand files under /brand/; clicking those may send the clicked address and link text to Google. These events occur only if you consent to measurement.

What is processed

If you consent: the address and title of the page you visit, the referring address, the time of the visit, coarse location (country/city level), device, operating system, browser and screen information, and a random device identifier (client_id) stored in a cookie. This is not linked to your application details (name, e-mail, phone); form field content is never sent to measurement.

Cookies

After consent only: _ga and _ga_X6F21CBJ1W. Both are first-party cookies carrying a random identifier, with a default lifetime of 2 years. They are deleted when you decline.

Consent text version currently in force: 2026-08-21. This version is stored in your consent record; when it changes, you are asked again.

Your consent record

Your choice is stored in your browser’s local storage under the name tv-riza — not in a cookie. It holds your decision (accept/decline), the date, and the version of the text you agreed to. It is never sent to our server. The record is valid for 12 months; when it expires, or when the version of this text changes, you are asked again (this is enforced in code). If your browser blocks local storage, your choice cannot be recorded and therefore measurement is not started at all; you will be told so.

Transfer outside Türkiye

With your consent, measurement data is transferred to Google Ireland Limited and Google LLC and may be processed outside Türkiye, including in the European Union and the United States. The legal basis is your explicit consent (KVKK arts. 5/1 and 9). If you decline, no measurement data leaves the site.

Withdrawing consent

The primary way is the site’s own preference panel: the “Cookie preferences” link in the footer of every page. Choosing “Decline” deletes the cookies and stops measurement. Secondary alternatives are your browser’s cookie settings and Google’s opt-out add-on.

What this site does not do

There is no advertising, remarketing or behavioural targeting code. Google Signals and ad personalisation signals are disabled in code. There is no embedded third-party content (iframe, video, map, external font, CDN); fonts are served from our own server. Google Consent Mode’s “denied” state is not used, because it would still send a cookieless signal to Google.

Your hosting provider’s own script (outside our control)

The hosting provider (secureserver / GoDaddy) appends its own traffic-monitoring script (tccl, img1.wsimg.com) to every page it serves, and that script may write cookies such as _tccl_visitor, _tccl_visit and _scc_session regardless of your consent. It is not part of the package we publish, was not added by us, and cannot be blocked by the consent gate above. This is why this page does not say “no cookies are written”; the accurate statement is: no measurement cookie is written and no request is made to Google until you accept.

Aggregated counting from server logs

What is produced: from the access records the server already keeps, we produce aggregated figures — daily page views, day-unique visitors, language distribution, most-read pages and referring sources.

Why no separate consent is asked: this counting reads only the server’s own records; nothing is written to your device and nothing is read from it, so it falls outside cookie/consent rules. Because an IP address is personal data, the processing relies on legitimate interest (KVKK art. 5/2-f).

Honesty clause: even if you decline measurement or choose “Necessary only”, your server record is still created and you are included in this aggregated count. This does NOT mean data goes to Google — when you decline, no request is sent to Google.

What is and is not kept: the report contains no IP addresses. For day-unique counting, IP and browser data are hashed with a random value that is regenerated on every run and never written to disk, so the report cannot be traced back to a person. No individual profiles are built, no cross-site tracking occurs, and bot/crawler requests are filtered out. Retention of the raw server logs is the hosting provider’s legal obligation and they set its duration.

Not measured

No application form field is sent to measurement. Error pages produced server-side by the application endpoint are outside the measurement scope.

Retention

User-level data in Google Analytics 4 is limited to 14 months. Cookies are deleted immediately when you decline.

Contact

For data protection requests: info@tugravarlik.com. Requests are answered within 30 days at the latest (KVKK art. 13). If your request is refused, the answer is inadequate, or you receive no reply within 30 days, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr). If you are in the European Economic Area, you also retain the right to complain to your local data protection authority. The controlling Turkish-language notice is the KVKK aydınlatma metni.