Privacy Notice
Last updated: 27 October 2026
This site counts every visit with a counter that uses no cookies, and runs Google Analytics only if you allow it. The notice below explains in plain language where data comes from and where it goes. The same facts in legal language sit in the KVKK notice.
The short answer
If you read nothing else, this is the whole of it:
- Cloudflare Web Analytics counts every page load. It uses no cookies and does not recognise you from one visit to the next.
- Google Analytics loads only if you choose Accept in the cookie banner. If you reject it, or never choose, no request goes to Google.
- No advertising and no targeting. No social plugins or embedded players either. The one external widget is Cloudflare Turnstile, which protects the contact form against bots.
- Fonts come from the site’s own server, so loading them sends no request to another company.
- Two places ask you for anything: the newsletter form, which wants only your email address, and the contact form, which wants what an answer requires.
- When you want to leave, CDR Türkiye deletes your record rather than flagging it.
If you subscribe to the newsletter
The only required field is your email address. CDR Türkiye stores three pieces of context beside it: the language you were reading in, the page you signed up from, and the time. Without the language the newsletter cannot go out in the right one; the source page shows which piece of writing brings readers in.
When you tick the consent box, CDR Türkiye records the consent itself: that the box was ticked, which version of the wording you agreed to, and when. The record is there to prove consent was given, not to ask you again.
CDR Türkiye sends no confirmation email to your address. Submitting the form notifies the CDR Türkiye team, not you, so nobody can use this form to send mail to a stranger.
The contact form
The form on the contact page works. It takes who you are writing as, your name, your email address, a subject and your message; the organisation field is optional. Four pieces of context go with it: the language and the page you wrote from, your consent record, and the reference code CDR Türkiye assigns to your message. The form asks for no phone number, no job title and no address; answering a question does not need them.
The reference code appears on screen when you send the message and sits in the subject line of the notification. Its only job is to make an exchange traceable by code rather than by address: quote it when you write again.
After a message reaches CDR Türkiye, the team adds three more things to the record: which stage it has reached, who took it on, and any internal note kept while answering. You do not send those, but they are part of your data, which is why they are named here.
What happens as you browse
Opening a page runs Cloudflare Web Analytics: it counts which page opened, where you came from, your country, browser, operating system and device type, and how long the page took to load, and it leaves no cookie or other record in your browser. Cloudflare hosts the site, and as with any internet request, connection details land in the host’s technical logs. CDR Türkiye does not pull those logs to its side and does not read them per person.
If you choose Accept in the cookie banner, Google Analytics loads as well. It leaves two cookies whose names start with _ga and links visits from the same browser through a random identifier stored in them. That is how CDR Türkiye sees which articles are read, where readers come from and how long they stay on a page. Google signals and advertising features are switched off. Google states that Google Analytics 4 does not log or store IP addresses. The reference code that appears in the address after you use the contact form is not sent to Google.
To limit abuse of the two forms, the system counts attempts from the same source. The key for that counter is not your IP address but a SHA-256 hash of it that changes daily. CDR Türkiye makes no attempt to get back to the address from the hash, and the rows expire after an hour.
The contact form also uses Cloudflare Turnstile. To confirm that a submission comes from a person, your browser sends some technical signals and connection details, including your IP address, to Cloudflare, and CDR Türkiye passes your IP address on when it asks Cloudflare for the result. Turnstile does not read what you type into the form and sets no cookie on this domain.
Cookies
Two cookies are strictly necessary: cdr-lang carries your language choice, cdr-cerez carries your answer to the cookie banner. If you allow Google Analytics, two measurement cookies whose names start with _ga join them. There are no advertising cookies.
With JavaScript switched off the site works fully apart from the contact form, sets no cookies and runs no counter, because browser-side scripts start both. The contact form’s security check needs JavaScript; without it, write to contact@cdrturkiye.com.
Who else sees your data
CDR Türkiye does not sell the list, rent it, or open it for marketing. Your data passes through at most three providers: Cloudflare for the database that holds the records and for the cookieless counter, Resend to deliver notifications and messages to the team, and Google (Google LLC) for measurement if you have allowed it. Notifications go to three people on the CDR Türkiye team, and the recipients are hard-coded.
All three companies run their servers outside Türkiye, so your data is transferred abroad. This notice does not yet name the legal ground for that transfer, because the assessment is not finished; naming a ground before it is would make CDR Türkiye appear to offer a safeguard it has not put in place. The KVKK notice explains why in full.
How long records stay
Your newsletter record stays until you want out. Replying to any issue is enough: CDR Türkiye deletes the record, and the consent record goes with it.
Contact messages have no automatic deletion period, and this notice says so plainly: once answered, a message stays so the exchange remains traceable. Write in with your reference code and CDR Türkiye deletes it together with the handling notes and correspondence.
The abuse counter lives for a one-hour window. The cookies live in your browser: a year for the language choice, 180 days for the cookie choice and for the Google Analytics cookies. Google Analytics deletes user-level and event-level records after two months; aggregate counts stay in the reports.
Visit paths: a copy of the Google Analytics event records is kept in Google’s BigQuery service for at most 60 days so that the order in which pages are visited can be counted in aggregate. CDR Türkiye takes only aggregate results from this copy (for example, how many sessions followed a path); visitor identifiers never enter these results.
Your rights
KVKK Article 11 gives you the right to learn what CDR Türkiye holds about you, have it corrected or deleted, and know where it has gone. The KVKK notice sets out the channels and the deadlines step by step.
Who runs this site
Where this notice says “CDR Türkiye”, it means the team that runs the initiative. The initiative is independent today, with no company behind it, so the controller is the people who run it. Once a company exists it becomes the controller, and the team updates both notices that day.
Write to contact@cdrturkiye.com with any request about your data. CDR Türkiye has no postal or KEP address today; this is the one channel that works, and requests come here. The KVKK notice has the detail.
If this notice changes
The date at the top marks the last change. If CDR Türkiye adds something, it writes it here first and does it second.