Source: https://oguzerol.com/en/privacy-policy/

# Privacy Policy

[Oğuz Han Erol](https://oguzerol.com/en/about-me/)  |  10 min read  |  Published: 2 January 2022  |  Updated: 27 October 2026

**Effective date:** 30 July 2026 | **Last updated:** 27 October 2026

Bu politika, [oguzerol.com](https://oguzerol.com/en/)or get in touch, why it is collected, who it is shared with and how long it is kept.

For the formal notice setting out the legal framework and your rights under Turkish Personal Data Protection Law No. 6698 (“KVKK”), see the [Data Protection Notice](https://oguzerol.com/en/data-protection-notice/). For cookie detail, see the [Cookie Policy](https://oguzerol.com/en/cookie-policy/).

## 1. Data controller

**Trading name:** Oğuz Han Erol (sole proprietorship registered in Türkiye)

**Address:** Göztepe Mah. Tepegöz Sk. İkar İş Merkezi 1 İç Kapı 8, 34730 Kadıköy / Istanbul, Türkiye

**Tax office:** Göztepe | **Tax ID (VKN):** 3670133479

**Email:** [oguz@oguzerol.com](mailto:oguz@oguzerol.com) | **Phone:** +90 549 654 64 89

## 2. Short version

- **No membership is needed** to read the public website. Access and use of separate client applications are explained within the relevant service.
- **No payment is taken** through the Site; card or bank details are never collected here at any stage.
- I receive data that directly identifies you only **when you fill in the contact form, call me, or write via WhatsApp or email**.
- Statistical and advertising measurement data about your visit is collected **only if you choose “Accept” in the cookie panel** (except cookieless, aggregate Google Consent Mode signals, see 3.2).
- Your data is **never sold**, rented or transferred to third parties for their own marketing.

## 3. What is collected, and when

### 3.1. When you contact us directly

| Channel | Data collected | Why |
| --- | --- | --- |
| Contact form | Name, email, phone, website address, message text; plus IP address and timestamp at submission | To answer your request, prepare a proposal and prevent form abuse |
| Phone / WhatsApp | Phone number, conversation content, WhatsApp profile name | To conduct the conversation and record the request |
| Email | Email address, correspondence content and any attachments | To continue the correspondence and manage proposal and contract processes |
| If an engagement begins | Invoicing details (company name, tax office and number, address), contact person details, advertising account access credentials | Performance of the agreement and statutory bookkeeping obligations |

**Data deliberately not collected:** Special categories of personal data such as health, religion, ethnic origin, political opinion or biometric data are never requested. Please do not send such data through the form or by message.

### The 0850 WhatsApp number

Client messages sent to +90 850 304 43 65 reach the server through WhatsApp/Meta and Cloudflare and are recorded. The profile name, phone number and message text are also forwarded to Telegram so that Oğuz Han Erol can follow up. Button replies and associated message identifiers are recorded to preserve the conversation context.

A conversation does not grant general marketing permission or explicit consent for all processing. To request that promotional messages stop, write “STOP”, “DUR” or “İPTAL”, or send an email. Demonstrations, separate choices, recipients and your rights are explained in the [Data Protection Notice](https://oguzerol.com/en/data-protection-notice/). Erasure requests are covered by the [deletion instructions](https://oguzerol.com/en/user-data-deletion/).

### 3.2. Data generated automatically while you browse

| Source | Data collected | Consent needed? |
| --- | --- | --- |
| Server and content delivery network logs | IP address, date and time, requested URL, browser and operating system (user agent), response code | No — necessary for operation and security |
| Strictly necessary technologies | Security cookies, theme preference, record of your cookie-panel choice (in your browser) | No — required for the Site to work |
| Bot protection (Cloudflare Turnstile) | IP address, device and browser information, on-page interaction signals | No — required for form security |
| Web analytics (Google Analytics 4, via Google Tag Manager) | Cookie identifier, pages viewed, time on site, approximate location (city level), device and traffic source | **Yes** — “Accept” choice |
| Google Ads (conversions, remarketing) | Cookie identifier, which ad brought you here, conversion events such as form submission | **Yes** — “Accept” choice |
| Meta Pixel and Meta Conversions API (server-side, through the Site’s `/api/m` endpoint) | `_fbp` / `_fbc` identifiers, page views, clicks on WhatsApp / phone / email links, browsing five different pages in one session (an `oe_oturum` record is kept in the browser for this); if the contact form is submitted, SHA-256 hashes of email, phone and name (a “Lead” event) | **Yes** — starts only when “Accept” is chosen |
| Embedded YouTube video and external links | When the player loads, YouTube / Google may set its own cookies | Not separately blocked by the panel choice |

On your first visit a cookie panel appears; “Accept” and “Reject” are equally prominent. Google tags run under **Google Consent Mode v2**: if you reject or have not chosen, Google tags do not write cookies, but cookieless, aggregate measurement signals may still be sent to Google under Consent Mode. Meta Pixel and the Meta Conversions API start only if you accept. You can change your choice at any time with the “Cookie settings” button at the bottom of the page; see the [Cookie Policy](https://oguzerol.com/en/cookie-policy/) for detail.

## 4. Why the data is processed

- **To respond to you and prepare a proposal** — form, phone and email data.
- **To conclude and perform an agreement** — contact and invoicing details of clients.
- **To meet legal obligations** — invoicing, bookkeeping and document retention; responding to requests from competent authorities.
- **To keep the Site secure** — blocking spam, automated bots and attack attempts.
- **To improve the Site** — understanding which pages are useful (only if “Accept” is chosen).
- **To measure advertising performance and run remarketing** — seeing which ad works and being able to show ads to Site visitors across the Google and Meta networks (only if “Accept” is chosen).

**No automated decision-making:** No decision producing legal effects or similarly significantly affecting you is taken solely on the basis of automated analysis.

## 5. About the use of AI tools

AI-assisted tools are used in service delivery and content production. The commitments here are:

- Contact form data from Site visitors is not used to train AI models and is not transferred to third parties for that purpose.
- Client data is processed only within the scope of that client’s work and under a duty of confidentiality.
- Output produced by AI tools is reviewed by a human before it is published or implemented.

## 6. Who the data is shared with

Your data is not sold. It is shared only in the following cases and only as far as necessary:

| Recipient group | Purpose |
| --- | --- |
| Hosting and content delivery network providers | Keeping the Site online and secure |
| Email and communications infrastructure providers | Delivering form notifications and correspondence |
| Google (analytics, ad measurement, bot protection, embedded video) | Measurement, advertising performance and security — within the scope of what you accepted (Consent Mode cookieless signals aside) |
| Meta | Ad measurement and remarketing (Pixel and Conversions API) — within the scope of what you accepted; also, if you write via WhatsApp, that conversation takes place on Meta’s infrastructure |
| Accountant / bookkeeping service provider | Statutory bookkeeping and filing obligations (only for clients who are invoiced) |
| Legal counsel, competent public authorities and courts | Where required by law or to establish and protect legal claims |

### International transfers

The services used, including WhatsApp/Meta, Google, Cloudflare, netcup server hosting, Telegram and email, involve processing data outside Türkiye; the servers of these providers may be located abroad (for example in the United States). The relevant data, recipients and transfer conditions are described in the [Data Protection Notice](https://oguzerol.com/en/data-protection-notice/). Sending a message or accepting cookies does not replace the international transfer requirements in Article 9 of the Law.

## 7. How long data is kept

| Data | Retention period |
| --- | --- |
| Enquiries that do not lead to an engagement | 2 years **from the last correspondence** |
| Client contact and contract records | **10 years** from the end of the service relationship (general limitation period) |
| Invoices and accounting documents | **10 years** (Turkish Commercial Code Art. 82) / at least 5 years under tax legislation |
| Server and security logs | Maximum **12 months** |
| Analytics and advertising cookie data | For the lifetime of each cookie — details in the [Cookie Policy](https://oguzerol.com/en/cookie-policy/) |
| Your cookie-panel choice | Kept only in your browser, until you clear browser data or change the choice |

Once the period expires, data is deleted, destroyed or irreversibly anonymised.

## 8. Security

- The entire Site is served over encrypted HTTPS/TLS.
- Administrative access is protected by strong passwords and access restrictions; sessions and login attempts are logged.
- Software and infrastructure components are updated regularly; attack protection is applied at the content delivery network level.
- Data is accessed only as far as the work requires; as a one-person business, the circle of access is inherently narrow.
- Backups are taken regularly.

No system can offer absolute security. If a breach affecting your personal data is identified, the notifications required by Law No. 6698 and the decisions of the Turkish Personal Data Protection Board will be made.

## 9. Your rights

Under Article 11 of Law No. 6698 you have the right to: learn whether your data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request correction of incomplete or inaccurate data; request erasure or destruction where the conditions are met; request that these actions be notified to third parties to whom the data was transferred; object to an adverse outcome arising from automated analysis; and claim compensation for damage caused by unlawful processing.

The application procedure, data erasure instructions, and time limits are set out in full in the [Data Protection Notice](https://oguzerol.com/en/data-protection-notice/) and the [User Data Deletion](https://oguzerol.com/en/user-data-deletion/) guide. In short: send your request in writing to **[oguz@oguzerol.com](mailto:oguz@oguzerol.com)** or to the postal address above; it will be answered within **30 days** at the latest.

## 10. Children’s data

The Site is not directed at children and personal data is not knowingly collected from anyone under 18. If such data is found to have been submitted, it is deleted without delay.

## 11. Changes

This policy is updated when legislation or the Site’s technical setup changes. The current version is always published on this page and the date at the top is updated. Material changes are additionally announced on the Site.

## 12. Contact

For any privacy question or request:

**Oğuz Han Erol**

Göztepe Mah. Tepegöz Sk. İkar İş Merkezi 1 İç Kapı 8, 34730 Kadıköy / Istanbul, Türkiye

**[oguz@oguzerol.com](mailto:oguz@oguzerol.com)** | **+90 549 654 64 89**