KVKK Notice

1. Who the data controller is

CDR Türkiye is an independent initiative today: there is no company, association or foundation behind it. The notice opens with this fact because knowing who processes your data is where a notice like this has to start.

With no legal entity, the controller is the people who run CDR Türkiye. Once the company is incorporated it becomes the controller itself; its legal name and registered address go here that day, and the date on this notice changes with them.

CDR Türkiye is not registered with VERBİS, the Turkish registry of data controllers. Whether registration is required turns on the nature and the size of the controller, and with no legal entity yet that assessment belongs with the incorporation. CDR Türkiye will make it then and write the outcome here: a registry number, or the fact that no obligation arises. Today one sentence is true and it is the one above: CDR Türkiye is not registered.

For anything about your data there is a single point of contact, below. CDR Türkiye has no postal address and no KEP (Turkish registered electronic mail) address; listing one that does not exist would be showing you a door that does not open.

• Controller: CDR Türkiye (the team running cdrturkiye.com)
• Legal entity: none; incorporation is not complete
• VERBİS (the Turkish controllers’ registry): not registered
• Contact and KVKK requests: contact@cdrturkiye.com

2. What CDR Türkiye collects

If you only read the site, CDR Türkiye asks nothing of you. Everything below happens in one of three ways: because you submitted something, because it is technically unavoidable, or to measure how pages are used; Google Analytics is among them only if you allow it.

• Newsletter signup: your email address, the language you were reading in, the page you signed up from, and the time.
• Consent record: that you ticked the box, which version of the consent wording you agreed to, and when.
• Abuse limit: a SHA-256 hash of your IP address that changes daily. CDR Türkiye never stores the raw IP and makes no attempt to recover it from the hash.
• Cookies: your language choice (cdr-lang) and your cookie choice (cdr-cerez) in every case, plus two measurement cookies whose names start with _ga if you allowed Google Analytics. All of them live in your browser.
• Cookieless page measurement: on every page load, Cloudflare Web Analytics counts which page opened, which address you came from, your country, browser, operating system and device type, and how long the page took to load. It leaves no cookie or other record in your browser and does not recognise you from one visit to the next.
• Google Analytics (only if you allow it): the pages you visit, where you came from, your approximate location at city level, device and browser details, how long you stay on a page, how far you scroll, clicks on outbound links and file downloads. A random identifier stored in your browser links these records together. Nothing you type into a form, and not the contact form’s reference code, goes to Google.
• Contact form: who you are writing as (the category), your name, your organisation (optional), your email address, the subject, your message, the language and page you wrote from, your consent record, and the reference code CDR Türkiye assigns to your message.
• Handling of a contact message: which stage it has reached, who took it on, its priority, a target date, and the team’s internal tags and notes. You do not send these; the team adds them after your message arrives.
• Correspondence: CDR Türkiye’s replies to your message and your answers to them, with sender and recipient addresses, subject line and time. Attachments are not stored in the record, only their count; they stay in the team’s mailbox.
• Hosting records: as with any request on the internet, connection details (IP address, browser, time of request) appear in the host’s technical logs. CDR Türkiye does not keep those logs itself and does not read them per person.

3. What CDR Türkiye does not collect

• Unless you allow it, Google Analytics does not run and no request goes to Google. The only measurement that runs without your permission is Cloudflare Web Analytics, which uses no cookies.
• No advertising or targeting cookies.
• Google signals and ad personalisation are switched off; Google Analytics data is not used for advertising and is linked to no advertising account.
• The site loads three outside scripts: Cloudflare’s counter on every page, the Cloudflare Turnstile check on the contact page, and Google Analytics if you allow it. There are no social plugins or embedded players.
• Fonts come from the site’s own server rather than a font CDN, so loading them sends no request to anyone else.
• No profiling and no automated decisions about you.
• CDR Türkiye asks for no special-category data, and the site is not aimed at children.

4. Purpose and legal basis

Each row states both the purpose and the legal ground it rests on. If CDR Türkiye ever wants to use the same data for something else, it changes this table first.

5. Who receives the data

CDR Türkiye does not sell the list, rent it, or hand it to anyone for marketing. The only recipients are the two services that keep the site running, Google for measurement if you have allowed it, and the team itself.

• Cloudflare, Inc.: hosting, content delivery, the database that holds subscriber records, contact messages and correspondence, the routing service that forwards emails sent to contact@cdrturkiye.com and supportdesk@cdrturkiye.com to the team’s mailbox, the Cloudflare Turnstile check that protects the contact form against automated submissions (browser and connection details, including your IP address, go to Cloudflare for the check), and Cloudflare Web Analytics, the cookieless page counter.
• Google LLC: the Google Analytics measurement service, which runs only if you have allowed it. What reaches Google is the measurement data listed in section 2; your name, email address and form contents do not.
• Resend, Inc.: the email service that delivers new-subscriber notifications and contact messages to the CDR Türkiye team, and the team’s replies to you. Your address appears in the notification, and if you used the form, so does your whole message; a reply carries the text the team wrote to you.
• Three people on the CDR Türkiye team: the fixed recipients of notifications and correspondence. The addresses are hard-coded; they never come from form input.
• Public authorities: only where the law requires it, and only as far as it requires.

6. Transfers outside Türkiye

All three service providers (Cloudflare, Resend and Google) run their servers outside Türkiye, so your newsletter record, your contact message, the Turnstile check on the contact form, the Cloudflare Web Analytics count and, if you allowed it, the Google Analytics data are transferred abroad within the meaning of KVKK Article 9. That is a fact, and this notice states it as one.

What this notice does not state is a name for the legal ground that transfer rests on. Choosing the ground is a legal assessment, and writing “standard contract” or “undertaking” before that assessment is done would make CDR Türkiye appear to offer a safeguard it has not put in place. When the assessment is finished, this section gets the ground and the date it was settled.

Until then nothing is missing from what you know, it is simply plainer: your records are processed in Cloudflare’s and Resend’s systems outside Türkiye, measurement data goes to Cloudflare and, only if you allowed it, to Google, and nothing goes anywhere else. If you would rather it did not, you can stay off the newsletter or have your record deleted, the contact form is never obligatory, and you can refuse Google Analytics in the cookie banner.

7. How long CDR Türkiye keeps it

CDR Türkiye keeps data for as long as the purpose lasts. When the purpose ends, the record goes.

• Newsletter record and consent record: until you ask to leave. CDR Türkiye deletes the record rather than flagging it, and the consent record goes with it.
• IP hash: for a one-hour window at most. Expired rows go on the next signup attempt.
• Cookies: one year for the language choice, 180 days for the cookie choice, 180 days for the Google Analytics cookies. If you refuse Google Analytics or your permission expires, the site deletes those cookies. You can clear all of them from your browser at any time.
• Measurement data: Google Analytics deletes user-level and event-level records after two months; aggregate counts (a page’s monthly readership, for instance) stay in the reports. Cloudflare Web Analytics records carry no identifier that points to you.
• Visit paths: a copy of the Google Analytics event records is kept in Google’s BigQuery service for at most 60 days so that the order in which pages are visited can be counted in aggregate. CDR Türkiye takes only aggregate results from this copy (for example, how many sessions followed a path); visitor identifiers never enter these results.
• Contact messages and correspondence: until CDR Türkiye has answered you, and afterwards so the exchange stays traceable. There is no automatic deletion period, and this notice says so rather than implying one. Send a request with your reference code and CDR Türkiye deletes the record together with the handling notes and correspondence. Once a period is set, this line will carry it.

8. Your rights

Article 11 of the KVKK gives you the right to:

• Learn whether CDR Türkiye processes your personal data, and ask for information if it does.
• Learn the purpose of the processing and whether the data is used in line with it.
• Know the third parties the data goes to, in Türkiye or abroad.
• Have incomplete or inaccurate data corrected.
• Ask for deletion or destruction within the conditions the law sets.
• Ask for any correction or deletion to be passed on to those third parties.
• Object to a result reached against you purely by automated analysis.
• Claim compensation if unlawful processing causes you damage.

9. How to make a request

One address, and it works: contact@cdrturkiye.com. CDR Türkiye has no postal address and no KEP address today, so requests come here; written channels join this section once the company exists.

The Turkish Communiqué on Application to Data Controllers allows a request from an email address you have already given the controller and that is on record. If you subscribed to the newsletter or used the contact form, yours is on record; send your request from it. If no address of yours is on record, write to the same place anyway: CDR Türkiye takes the request and tells you how it can verify who you are.

State plainly what you are asking for. If you wrote through the contact form, quoting your reference code makes it faster.

CDR Türkiye answers within thirty days at the latest. If the answer does not satisfy you, you can complain to the Turkish Personal Data Protection Board.

A Google Analytics record does not know you by name, so finding one person’s record is usually impossible. The shortest route is to choose Reject in the cookie banner and delete the _ga cookies; Google Analytics deletes those records on its own after two months.

To leave the newsletter you do not need any of this: reply to any issue and CDR Türkiye deletes your record.

10. If this notice changes

The date at the top is the last change. If the data CDR Türkiye collects or the services it uses change, it updates this notice first and makes the change second.

The plain-language version: Privacy Notice