Privacy Notice (KVKK)

This notice explains, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the related Communiqué on the duty to inform, how personal data sent through serhatvarli.com and to info@serhatvarli.com is processed. The site is operated from Türkiye and Turkish law applies.

Data controller

The data controller is Serhat Varlı, the private individual who owns this site.

• Email: info@serhatvarli.com
• Phone: +90 501 207 67 53
• Location: Gaziosmanpaşa / Istanbul, Türkiye (a postal address for written requests is provided on request)

What personal data is processed?

Visit statistics are cookie-free: only “which page, which day, how many times” is counted; no identifying data, cookie or browser fingerprint is used. You do not need to give any personal data just to read the site. Special categories of personal data (health, religion, biometrics, etc.) are not requested; please do not include them in your message.

Purposes of processing

• To review your enquiry, job or project offer and to reply to you,
• To hold the preliminary talks of a working relationship that may start with you,
• To prevent abuse of the form and the email address (spam, bots) and to keep information secure,
• To protect rights in a possible dispute and to meet legal obligations.

Collection method and legal grounds

Data is collected electronically and only as sent by you, when you fill in the contact form or send an email. Processing in Türkiye does not rely on your consent; the legal grounds are (KVKK Art. 5/2):

• Directly related to concluding or performing a contract (c): job/project offers and preliminary talks,
• Legitimate interest of the data controller (f): replying to enquiries, security and abuse prevention,
• Establishing, exercising or protecting a right (e) and legal obligation (ç).

The required box on the form only records that you have read this notice. A separate and optional consent box covers the transfer abroad, explained below.

Who receives personal data and why?

• Hosting (server) provider — Türkiye: the site, its database and form messages are kept on a server in Türkiye; the provider can access data only as far as the service requires, as a data processor.
• Authorised public authorities: only when legally required and to the extent requested.

Your data is not used for marketing, not sold and not shared with third parties. You will not receive commercial electronic messages.

Transfer abroad (KVKK Art. 9)

The data controller’s email service is Google LLC (Gmail), whose servers are abroad. A transfer abroad therefore happens only in these cases:

• Form message — only with your consent: if you tick the optional box on the form, your full message is sent to Gmail in the notification email so that you can get a faster reply. The legal ground is your explicit consent, given after being informed of the possible risks (Art. 9/6-a). Possible risk: the country the data goes to may not offer the same level of protection and remedies as Türkiye. If you do not tick the box, the notification email contains none of your personal data and your message stays only on the server in Türkiye. Not giving consent has no effect at all on how your message is handled.
• Reply email: to reply to you, your email address and the correspondence pass through the email service used to send the reply. This transfer is occasional and necessary to answer your request (Art. 9/6-b).
• Emails you send directly to info@serhatvarli.com: they are forwarded to the data controller’s Gmail inbox. This transfer is occasional and necessary to answer your request (Art. 9/6-b). If you do not want this, use the contact form without ticking the consent box.
• Code examples: when you press “Run” in a blog post, the required libraries are downloaded from the jsDelivr content delivery network and your IP address technically reaches jsDelivr. This is an occasional action started only by you; it does not happen unless you press the button.

Retention

• Contact form messages and consent records: 10 years (the general limitation period of the Turkish Code of Obligations). They are deleted automatically when the period ends.
• Emails sent to info@serhatvarli.com are not stored on the site; they are only forwarded to the data controller’s inbox and kept there for at most 10 years. The forwarding record (time, sender domain, status) is kept for 90 days.
• Technical logs: at most 14 days, then deleted automatically.
• Backups: taken to prevent data loss, kept for 14 days and deleted in turn.

Data security (KVKK Art. 12)

The site works only over an encrypted connection (HTTPS). Only the data controller can read form messages, through an admin panel protected by password and session checks. IP addresses are not stored, only an irreversible hash. Passwords in the server settings are stored encrypted. The code-running area is isolated from the site and the database and has no internet access. If your personal data is obtained unlawfully by others, you and the Personal Data Protection Board will be notified as soon as possible (Art. 12/5).

Your rights under KVKK Art. 11

By applying to the data controller you may:

1. Learn whether your personal data is processed,
2. Request information if it has been processed,
3. Learn the purpose of processing and whether it is used accordingly,
4. Know the third parties in Türkiye or abroad to whom it is transferred,
5. Ask for it to be corrected if incomplete or inaccurate,
6. Ask for it to be erased or destroyed under the conditions of KVKK Art. 7,
7. Ask for corrections, erasure and destruction to be notified to the third parties it was transferred to,
8. Object to a result against you arising solely from automated analysis,
9. Claim compensation for damage caused by unlawful processing.

You may withdraw your transfer consent at any time; withdrawal does not affect the lawfulness of earlier processing. The site makes no automated decisions and builds no profiles.

How to apply

Send your request, in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller and with information that verifies your identity, by email to info@serhatvarli.com or in writing to the postal address provided on request. Your request is concluded free of charge within 30 days at the latest. If you are not satisfied with the outcome, you may complain to the Personal Data Protection Board.

Links

When you click a social media or external link on the site, that site’s own privacy rules apply; no data is sent to these sites unless you click.

Changes

This notice is updated when needed; each update is published with a new version number, and the consent record on the form shows the version you confirmed.