This notice explains how your personal data is processed under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) when you visit emirbalin.com or use the reference or comment forms.
1. Data Controller
The data controller for this website is Emir Balın. Contact: [email protected]
2. Personal Data Processed and Purposes
Reference form: Your name, title/organization, message and optional LinkedIn URL are processed solely to review and publish the reference you submit. Your email address and IP address are not stored for this form.
Comments: Your comment and name are processed solely to review and publish your comment. No email address is requested; your IP address and browser information are not stored.
Security measures: To prevent abuse of the forms, a one-way hash of your IP address is used briefly for rate limiting, and an automatic security check is performed with Cloudflare Turnstile when a form is submitted.
Server access logs: When you access the site, technical data such as your IP address is recorded in standard web server logs on the site’s server to keep the site secure and to diagnose technical issues.
3. Recipients, Purposes and International Transfers
Hetzner Online GmbH (Germany): Hosts the site; reference and comment data, server access logs and backups are stored on a server in Germany.
Cloudflare, Inc. (USA): Provides content delivery (CDN) and security services and is active on every visit; data you send to the site and technical data such as your IP address pass through and are processed on Cloudflare’s infrastructure. Cloudflare also runs the security check (Turnstile) on forms. Anonymous visit statistics are collected with cookie-free Cloudflare Web Analytics.
Telegram: Used to notify the site administrator that a reference or comment is awaiting approval. The notification contains no personal data (a fixed message and a link to the admin panel); no personal data is transferred to Telegram.
Because the data is processed outside Türkiye, transfers to Hetzner and Cloudflare constitute international transfers under Article 9 of the KVKK. These transfers are carried out under the service providers’ data processing agreements and are limited to the purposes above.
4. Method of Collection and Legal Basis
Personal data is collected electronically, partly by automated means, through the forms on this website and the server logs.
Processing and publishing references and comments is based on the explicit consent you give with the checkbox on the form (KVKK Art. 5(1)).
Keeping server access logs, rate limiting and security checks are based on the legitimate interest in keeping the site secure (KVKK Art. 5(2)(f)).
5. Retention Periods
- Published references and comments are kept for as long as they remain published.
- References and comments awaiting approval are moved to the trash if not acted on within 90 days. Items in the trash and comments marked as spam are permanently deleted after 30 days.
- The LinkedIn URL is kept only for verification and is deleted once the reference is published or moved to the trash.
- The IP hash used for rate limiting is kept for no more than 10 minutes.
- Server access logs are kept for no more than 14 days.
- Deleted data may remain in the site’s daily backups for up to 7 more days and is then deleted automatically.
6. Your Rights (KVKK Art. 11)
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; request information if it has been processed; learn the purpose of the processing and whether the data is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction if it is incomplete or inaccurate; request erasure or destruction under the conditions set out in the KVKK; request that corrections and erasures be notified to the third parties to whom it was transferred; object to an outcome against you arising solely from automated analysis; and claim compensation if you suffer damage due to unlawful processing.
To exercise these rights, send your request to the email address above or use the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request will be answered within 30 days at the latest and, as a rule, free of charge.
7. Cookies
The site itself does not set cookies for visitors. Cloudflare’s security infrastructure may set strictly necessary technical cookies; these will be measured once the site is live and this notice will be updated.
Last updated: October 4, 2026