Privacy Policy

Last updated: 21 September 2026

1. Who is responsible

Your personal data is processed by Atakan Okul as the data controller, under Turkish Personal Data Protection Law No. 6698 (KVKK).

2. What data is collected

Data is collected only through the quote and contact forms. There are no user accounts.

a) Provided directly by you

• Identity and contact: name, email address, phone number, company or brand name if given
• Enquiry content: the service and package you are interested in, budget range, timing, and the message you write

b) Collected automatically

• Connection data: IP address and browser information
• Approximate location: city/country-level location and internet provider derived from the IP address. No location permission is requested and no GPS or precise location is used.
• Device data: device type, operating system, screen size, language and time-zone settings, and the number of pages viewed before submitting the form
• Attribution data: the page you arrived on, the referring link, and any advertising parameters (utm_source, gclid, fbclid and similar)
• Notice record: the date and time you confirmed you had read this notice, and which version of it you saw (the date at the top of this page)
• Form and measurement choice: which form you used, and whether you had accepted measurement cookies in the cookie banner when you submitted it

This technical data is kept to verify who submitted a form, to prevent abuse such as automated spam, and to measure which work actually generates enquiries.

Ticking “I have read the Privacy Notice” on a form only records that you were informed before sending your enquiry. It is not consent to advertising measurement; that is a separate choice you make in the cookie banner.

3. Why the data is processed

4. Who the data is shared with

Your personal data is never sold or passed to third parties for marketing. It is shared only with the providers needed to deliver the service, and only as far as needed:

• Hosting provider: the server where the site and its database run
• My own work-management system (Atakan OS, os.atakanokul.com): so that I can follow up on your enquiry, the enquiry record is also kept there: your name, contact details, company name, message, the service, package, budget and timing you chose, the status, dates and (if any) amount of the enquiry, approximate location (city/country), device type and where you came from (campaign tags, landing page, referring site). Your IP address, browser details, ad click identifiers and measurement cookie identifiers are not transferred to it. The system runs on a hosting provider's server.
• Anthropic (Claude AI assistant, USA): I use Claude inside my work-management system to review and prioritise enquiries. Claude sees the text of your message, your company name, the service, package, budget and timing information, the status, dates and (if any) amount of the enquiry, your approximate location (city/country), device type, where you came from (campaign tags, landing page, referring site) and, once I have replied to you for the first time, your name. Your email address and phone number are not passed to Claude as separate fields; however, if you wrote them in your message, they reach Claude together with the message text. Claude's assessment only assists me; I decide how to respond to you and what to quote.
• Email provider: enquiry notifications are delivered to me by email and, if enabled, you receive a short confirmation email
• WhatsApp notification service (CallMeBot or Meta's WhatsApp Cloud API, depending on setup): new-enquiry notifications reach my phone, if enabled
• Google Analytics and Meta: only if you accepted measurement cookies in the cookie banner. That choice is stored with your enquiry, and only then is a conversion event sent to these services — for Meta, with contact details in hashed form. If you declined, nothing about your enquiry is sent to Google or Meta. Enquiries flagged as possible spam are never sent.
• Cloudflare: during verification, if spam protection (Turnstile) is enabled
• IP location services (ipwho.is, ipapi.co): when a form is submitted, only the IP address is looked up to estimate an approximate location; your name and contact details are not sent.

Some of these providers are located outside Türkiye. Such transfers are carried out under Article 9 of the KVKK; for Google and Meta they happen only with the explicit consent you give in the cookie banner.

Claude seeing the details of an enquiry means personal data is transferred abroad (to the USA), which falls under Article 9 of the KVKK. The data transferred is limited to what is listed above for Anthropic. Your email address and phone number are not transferred as separate fields; contact details you wrote in your message are transferred with the message text.

5. How long the data is kept

• Enquiries that do not lead to work: deleted 2 years after the last activity on the enquiry
• Enquiries that led to work: kept for 10 years because of statutory record-keeping obligations, then deleted
• Entries marked as spam: deleted after 6 months
• Technical security records (login and form attempt logs, including IP addresses): deleted after 30 days

The IP address, device and attribution data stored with an enquiry are deleted together with the enquiry. These deletions run automatically and are checked daily; deleted records are overwritten in the database rather than merely hidden.

When an enquiry is deleted on this site (because its retention period ended or at your request), an automatic deletion notice is sent to my work-management system and the copy there is anonymised: your message, company name, location and device details are deleted, and the name and contact details in the client record created from your enquiry are deleted too unless you have another enquiry or project with me. Only information that does not identify you (service, budget, timing, source, status, amount and dates) is kept for statistics. If the enquiry led to work, the client record for that work may be kept separately for the periods above because of contract and invoicing obligations. If I created your client record myself (for example for earlier work), that record is not deleted by this notice; I review it separately when handling your deletion request. If there is a technical fault, the deletion notice may be delayed; it is sent once the fault is fixed.

6. Cookies

The site itself does not require cookies to function. Google Analytics and Meta cookies are set only if you accept measurement in the cookie banner, and you can change that choice at any time via Cookie preferences at the bottom of the page. You can also delete or block cookies in your browser without affecting how this site works.

Your cookie choice is remembered in your browser's local storage and sent along with any form you submit, so that the measurement rule in section 4 can be applied to your enquiry.

To remember which advertisement brought you here, a small record is kept in your browser's local storage for 30 days. It stays on your device and is not transmitted anywhere until you submit a form.

7. Your rights

Under Article 11 of the KVKK you may ask me to:

• Confirm whether your personal data is being processed, and obtain information about it
• Explain the purpose of processing and whether the data is used accordingly
• Identify any third parties in Türkiye or abroad the data has been transferred to
• Correct incomplete or inaccurate data
• Erase or destroy the data
• Notify third parties of any correction or erasure
• Object to a decision produced solely by automated analysis that works against you
• Claim compensation for damage arising from unlawful processing

Send requests to [email protected]. They are answered free of charge within 30 days at the latest. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

8. Security

The site is served over HTTPS only. Enquiry records are stored in a directory that is not reachable from the web, the admin panel is password protected, and login attempts are rate limited. That said, no transmission over the internet can be guaranteed to be completely secure.

9. Changes

This notice is updated when needed. The date at the top of the page reflects the most recent change.

---

This text is provided for information and is based on a general template. As your operations or data processing change, having it reviewed by a lawyer is recommended.