Privacy Notice

This notice covers the personal data we process through muhammedsevimli.com (the "site"). It is drafted to be cross-compliant with Türkiye's KVKK (Law No. 6698), the EU GDPR, and California's CCPA.

Identity of the data controller

The card below shows the data controller (a Turkish sole proprietorship) and the US LLC used for US-side commercial relationships. The Turkish sole proprietorship is the data controller of record for every visitor of the site, regardless of locale. The US LLC is NOT a data controller; it is disclosed for transparency because invoicing and contracts for US-priced engagements run through it. Use the data controller's contact details for any privacy request.

Categories of personal data we process

• Identity and contact data: Email for newsletter subscriptions; name, email, message body for the advisory inquiry form.
• Transaction security data: IP address, browser and device info, visit timestamps.
• Marketing and analytics data: Page views, session length, click behavior — only when you grant cookie consent.

Purposes of processing

• Delivering the newsletter and content distribution
• Responding to advisory and contact inquiries
• Measuring and improving site performance
• Meeting legal obligations
• Defending legal rights in disputes

Lawful basis

• Consent: Newsletter subscription and marketing cookies (KVKK Art. 5/1, GDPR Art. 6(1)(a))
• Performance of a contract: Advisory and contact requests (KVKK Art. 5/2-c, GDPR Art. 6(1)(b))
• Legitimate interest: Site security, fraud prevention, baseline analytics (KVKK Art. 5/2-f, GDPR Art. 6(1)(f))
• Legal obligation: Tax, electronic commerce, KVKK registration requirements (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c))

Data transfers

Domestic processing

Data is processed in Türkiye by the data controller. The data controller responds to rights requests within statutory timeframes.

International transfers

The site is hosted on Hetzner Online GmbH infrastructure (Helsinki, Finland — EU). The processors below may move data to the US and other third countries. Transfers are governed by KVKK Article 9 and GDPR Chapter V using Standard Contractual Clauses (SCCs) and equivalent safeguards:

• Google LLC (Google Analytics 4) — only with analytics consent
• Microsoft Corporation (Clarity) — only with analytics consent
• Cloudflare, Inc. (Web Analytics, CDN, DNS)
• Meta Platforms, Inc. (Meta Pixel) — only with marketing consent
• Klaviyo, Inc. (newsletter) — only if subscribed
• Resend, Inc. (transactional email)

Retention periods

• Newsletter: Until unsubscribe or anonymized after 36 months of inactivity
• Form messages: 12 months
• Analytics cookies: GA4 14 months, Microsoft Clarity 12 months, Cloudflare 30 minutes
• Marketing cookies: Meta Pixel 90 days
• Statutory retention: Whichever is longer applies (TR tax 5y, ETK 3y, etc.)

Your rights

Under KVKK Article 11, GDPR Articles 15-22, and CCPA you can:

• Find out whether we process your data
• Request information about the processing
• Learn the purpose and whether your data is used in line with that purpose
• Know the third parties to whom we transferred data
• Request correction of incomplete or inaccurate data
• Request erasure or destruction (KVKK Art. 7, GDPR Art. 17)
• Request that corrections, erasures and destruction be communicated to recipients
• Object to outcomes derived solely from automated processing
• Claim damages for unlawful processing
• CCPA additions: Right to opt out of sale, right of access, right of portability

How to make a request

Use the contact email shown in the data controller card above. Include enough information to identify yourself, the right you want to exercise, and the substance of your request.

KVKK requests can also be made via the formal written application method per the Communiqué on the Procedures and Principles for Application to the Data Controller (Official Gazette No. 30356, 10 March 2018). KVKK requests are answered within 30 days; GDPR requests within 1 month. EU visitors may also lodge a complaint with their national supervisory authority.

We have NOT appointed an EU representative under GDPR Article 27 because our processing is occasional and small-scale per Article 27(2). This does not limit GDPR compliance — EU visitors can exercise all GDPR rights via the contact above.

Cookies

For cookie details see the Cookie Policy. You can change your preferences anytime from the cookie banner or your browser settings.

Children's data

The site is not directed at people under 18. The age of majority under the Turkish Civil Code is 18, so for any operation requiring explicit consent under KVKK Art. 5/1 (newsletter subscription, advisory form) the user is expected to be 18 or older. Records we identify as belonging to anyone below this age will be deleted.

Changes

When we update this notice we change the date shown at the top. Material changes are also communicated to subscribers.

Legal disclaimer

This text has been / will be reviewed by counsel. Before going live, the official version should be reviewed by a qualified attorney. Last review date is shown above.