Privacy and Cookies

1. Short summary

Visit measurement (Google Analytics 4) on this site runs only if you allow it, which is why you are asked on your first visit. If you do not allow it, the measurement code is not loaded, no measurement cookie is written, and no measurement request is sent to Google Analytics. There is no advertising, remarketing or profiling tag, and the site embeds no third-party content. The server's technical logs (below) are kept at all times. You can change your choice at any time using the Privacy choices button at the bottom of any page.

2. Data controller

For this website the data controller is AdFlowHQ (adflowhq.com). You may send your requests under Turkish data protection law (KVKK) to info@adflowhq.com; requests are answered within 30 days at the latest, as required by KVKK art. 13.

An acknowledged gap — we are not hiding it. KVKK art. 3/1(ı) defines a data controller as a “natural or legal person”. “AdFlowHQ” is a product and brand name; it is neither. No verified trade name, registered address or VERBİS record is published on this site, and none has been invented. This line improves transparency but does not fully satisfy the identity element of art. 10; on this point the notice makes no claim of full statutory compliance. Once a legal identity is published this section will name it.

3. Cookies and similar technologies

If you allow it, first-party measurement cookies are used for Google Analytics 4: _ga and _ga_H6EBV559D2 (lifetime 90 days — not a statutory limit but our own voluntary data-minimisation choice; the period is not extended on each visit). If you do not allow it, these cookies are not written and no measurement request is sent to Google Analytics; the default state is refused. Ad personalisation and Google signals are switched off in code; measurement data is not anonymous but pseudonymous. Besides page views, first visit and session start, engagement time, reaching about 90% of the page and outbound-link clicks are also counted. The site has no downloadable files, no site search and no embedded video, so the corresponding events do not occur.

Your choice — your decision, the decision date, the expiry date and the consent scope version — is stored in this browser for 12 months in a local record that is not a cookie (technical record name: adflowhq-riza). Wording, design or explanatory updates do not reset your choice; you are asked again only if the measurement purpose, data categories, provider, recipients or the measurement features used expand substantially. There is no advertising, remarketing or user-profiling tag.

4. Server access and security logs

When the site is accessed, standard technical information such as the IP address, the time of access, the requested page, browser or device information and the server response code may be processed in the hosting infrastructure in order to deliver the website and to keep it secure. These records are not used for advertising or marketing, no behavioural user profile is built, and the site owner does not feed them into a separate visit-measurement system. No separate aggregated visit count is produced from the server logs; should that ever be done, a written legitimate-interest balancing test will be prepared first and this notice will be updated.

What is not yet confirmed, stated plainly: the hosting provider's full legal entity name, the actual retention period of the server logs and the country or countries in which they are processed have not yet been verified by us. Until those three facts are verified this section is not complete; uncertain information is not written down by guesswork and will be added here once verified.

5. The hosting provider's script

The hosting server is able to inject its own performance or monitoring script into the HTML pages it serves and to write the related cookies without asking the visitor; such an injection is not part of the site package, is performed on the server side, and cannot be blocked by our consent gate. In an inspection carried out on the live site on 31 August 2026 — covering the address with and without www, the Turkish and English pages and a non-existent address — neither such a script injection nor any related Set-Cookie header was observed. If the provider changes this behaviour, this section will be updated. That is why we do not make the absolute claim “no cookie is written” — the accurate statement is: unless you allow it, the site package writes no cookie at all.

6. Product versus this website, and external requests

The wording on the home page about “cookieless serving and measurement”, “no raw IP is stored” and “consent-aware measurement” describes the architecture of the AdFlowHQ product (the ad management software you install on your own server); it does not describe the behaviour of this website. The behaviour of this website is declared only in this notice and in its Turkish counterpart.

This site embeds no third-party content (iframes, video, maps), uses no external fonts and no CDN; the typefaces come from your own operating system. Google Analytics is the only external call this site makes, and only once you allow it. No request is sent to the external addresses linked in these texts (for example those of the Board or of Google) unless you click them; when you do, you leave this site and the practices of the site you open are governed by its own notices.

7. Purposes of processing

Visit measurement (only with permission): to understand which content is of interest and to improve the site — legal basis: explicit consent (art. 5/1). Contacting us by e-mail: handling the correspondence — legal basis: legitimate interest (art. 5/2-f). Technical access and security logs: operating the site; ensuring information and system security; detecting errors and outages; preventing unauthorised access and misuse; and, where applicable, legal obligations. If legitimate interest is to be relied on for the server logs, a concrete balancing test will be prepared first — that test has not yet been prepared.

8. Transfer of personal data

If you allow measurement, your visit data is transferred to Google and may be processed outside Türkiye in Google's infrastructure (KVKK art. 9). The legal basis for this transfer is your explicit consent. We state it plainly: this transfer is of a regular nature and the Law requires an additional appropriate safeguard for regular transfers (for example the Board's standard contract); no such contract has been concluded with Google. The site owner has chosen to run the measurement on the basis of explicit consent while that gap persists. For this reason this notice makes no claim of full statutory compliance. If you do not allow it, no transfer takes place at all. For the hosting provider and sub-processors that handle the server access logs, verification of recipient, role, country and mechanism is still in progress.

9. Retention periods

• Measurement cookies (_ga, _ga_H6EBV559D2): 90 days (voluntary minimisation); retention of user and event data on Google Analytics servers is 2 months — the GA4 default, which has not been increased.
• Consent record (adflowhq-riza): 12 months.
• Server access and security logs: the period is determined by the hosting provider; the actual period has not yet been confirmed by us.
• Correspondence about data protection requests: for the periods set by the applicable legislation and by potential disputes.

10. Your rights under KVKK

Under article 11 of Law no. 6698 you have the right to: learn whether your personal data is processed; request information if it has been; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom it has been transferred; request correction if it is incomplete or inaccurate; request erasure or destruction where the statutory conditions are met; request that correction and erasure be notified to the parties to whom the data was transferred; object to a result reached against you solely through automated analysis; and claim compensation for damage.

You may withdraw the permission you gave for measurement at any time, without giving a reason, using the Privacy choices button at the bottom of any page; when you withdraw it, the measurement cookies are deleted and no new measurement request is sent to Google Analytics. This requires no formal request.

You may send your requests to info@adflowhq.com; they are answered within 30 days at the latest. If a request is refused, answered insufficiently or not answered in time, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr). If you visit from the European Economic Area you may also contact your own national data protection authority.

11. How the privacy choices work

On your first visit three equal options are offered: Allow measurement · Continue without measurement · Review settings. The default state is refused; no measurement request is sent to Google Analytics until you allow it. In the settings panel the measurement category is not pre-selected. If your browser blocks local storage, your choice cannot be recorded in a provable way and therefore measurement is never started. When this site is displayed inside another site's frame (iframe), the consent banner is not shown and measurement is never started — even if you allowed it before. You are asked again after 12 months, or if the scope of the measurement expands substantially.

Ways to turn measurement off, starting with the most direct: (1) the Privacy choices button at the bottom of every page — the primary route; (2) deleting or blocking this site's cookies in your browser settings; (3) Google's browser add-on (tools.google.com/dlpage/gaoptout).

Measurement ID: G-H6EBV559D2 · Consent scope version: analytics-scope-01 — stored together with your choice; you are asked again only if the measurement scope changes substantially. Corrections to the wording do not reset your consent. This notice is for information purposes and is not legal advice.