Privacy policy and KVKK information notice

Last updated: 2 November 2026

🇹🇷 Gizlilik politikasının Türkçesi → The Turkish text is the binding version.

This notice explains how personal data is processed on the gelibolu.net website (the "Site"), in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data controller

Data controller

Gelibolu.NET

Address

Gelibolu / Çanakkale

E-mail

info@gelibolu.net

2. In short

• The Site has no membership. No new memberships have been accepted since 25 October 2026. You are not asked for your name, e-mail address or any other identifying information to use the Site.
• The Site has no forms for entering personal data. Questions can be asked in the Q&A section without membership by passing through Google; only the name is received from Google and published with the question as "Ahmet A.", and nothing else is stored (3.6). Photos, news, business listings, advertising enquiries and correction requests are accepted by e-mail only. The form on the add your business page is not sent to us; it only opens a ready message in your own e-mail app.
• No advertising or tracking cookies are used and no visitor profiles are created. Personal data is not sold or shared with anyone for marketing.
• The Site runs on the infrastructure of service providers located abroad. Section 6 sets out which data goes to whom.

3. Personal data processed, purposes and legal bases

3.1. When you visit the Site

Data: IP address, browser and device information, the page address requested, time of the request.

Purpose: delivering pages to you, protecting the Site against attacks and misuse, fixing technical errors. This processing is carried out by the Cloudflare infrastructure that hosts the Site. We do not store your IP address in our database; Cloudflare's technical logs are kept for a short time.

Legal basis: KVKK Art. 5(2)(f) (legitimate interest of the data controller).

3.2. Visit statistics

Data: the landing page and pages viewed, the site you came from, approximate country and city derived from the IP address, device type (including, for this, whether the screen is a touch screen), whether notifications are on, time of visit. To tell repeat visits on the same day apart, a one-way digest is generated from the IP address and browser information using a key that changes every day. Visits on the same day with the same digest are recorded under the same visitor number; the next day a new number is given, so the number does not recognise a person from one day to the next. The digest and the number are pseudonymous data; the IP address itself is not stored. No cookies are used.

Purpose: understanding how the Site is used and improving its content.

Legal basis: KVKK Art. 5(2)(f).

Retention: visit records are deleted automatically after 30 days, daily digests after 40 days. After that only totals that cannot be linked to a person remain.

3.3. Links to news sources

When you click a link to the source of a news item, the news item, the source, the time of the click and the page the link was on are recorded. No IP address or identifying information is recorded. The purpose is to understand which news items and sources are read. Records are kept for 3 years, then archived for 5 years, then deleted.

3.4. Notifications

Only if you tap "Turn on notifications" and allow it in your browser, the subscription address created by your browser and your language preference are stored. Notifications are sent as a content-less signal through your browser's notification service (Google on Android and Chrome, Apple on iPhone, Mozilla on Firefox); the text of the notification is fetched directly from our Site. You can turn notifications off at any time in your phone or browser settings; subscriptions that become invalid are deleted automatically.

Legal basis: explicit consent (KVKK Art. 5(1)). You can withdraw your consent by turning off the notification permission.

3.5. When you e-mail us

Data: your name, e-mail address, your message and any photos, documents or information you attach (e.g. business name, address, telephone).

Purpose: replying to your request; assessing the photo, news, question, business listing, advertising enquiry or correction request you send; publishing content under your name on the Site where you have expressly allowed it.

Legal basis: KVKK Art. 5(2)(f) for replying to your request; explicit consent (KVKK Art. 5(1)) for publishing your content under your name. If you withdraw your consent the content is removed. Publishing business details in the business directory is based on the request of the person authorised for that business. What you type on the add your business page, including your name, stays only in your browser until you send the e-mail yourself. Entries may also be added from information a business has published itself on its own website (name, address, business telephone, opening hours); the legal basis is KVKK Art. 5(2)(d) (data made public by the data subject), the information is used only so that people can reach the business, and the source page is shown on the entry. If the business asks for a correction or removal, the entry is corrected or removed.

Location (GPS) and other camera information is removed from photos before they are published; the exact location where a photo was taken is never published. E-mails are held on the servers of our e-mail provider Google (Google Workspace).

Retention: published content for as long as it stays published; other correspondence for at most 2 years after your request has been concluded.

3.6. When you ask a question or write an answer in the Q&A section

Data: the title and details of your question or the text of your answer, the topic you choose, its language and time; and a short name made of your first name and the initial of your surname (e.g. "Ahmet A.").

Sign-in with Google: to send a question or an answer you pass through your Google account; the purpose is to stop robots from sending content. Only your name is requested from Google, not your e-mail address. Your name is turned into the short name at once; your Google account ID, e-mail address, IP address and session data are not stored, and no membership record is created on the Site. The short name stays in a cookie in your browser for 30 minutes so that you can ask another question in the same visit.

Publication: the short name is published with your question or answer only if you tick the box on the form (the box is not ticked in advance); on an answer without the tick it says "A reader". Your question and answer are screened automatically for inappropriate content with Cloudflare Workers AI. A question that passes is published at once; a doubtful one is published or not after review by the site administration. Answers are always read by the site administration before they are published or not. Since 31 October 2026 readers can also answer questions through the same pass; answers from the site administration ("Gelibolu.net") and the "Gelibolu.net assistant" are marked separately.

Daily limit: to stop more than 3 questions or 3 answers a day from the same person, and repeated taps on "I want to know too", a one-way trace is made from the Google account, or from the connection and browser details, with a random key valid only for that day. The key and the traces are deleted the next day, after which a trace cannot be linked to anyone. Who voted for which question is not recorded.

Browser storage: the numbers of the questions you asked and your "I want to know too" choices are kept only on your own device ("My questions"); the question or answer you wrote waits only in your browser while you pass through Google.

Purpose and legal basis: publishing your question with your short name: KVKK Art. 5/2-d (made public by the data subject); preventing abuse: KVKK Art. 5/2-f. Retention: the question and short name as long as they stay published; daily trace 1 day. You can ask for your published question to be removed by sending its link through the channels in section 11. The question and short name are kept on Cloudflare's infrastructure (abroad); when our server in Türkiye is ready, short names will be moved there.

3.7. Records from the membership period (14–25 October 2026)

Between 14 and 25 October 2026 the Site accepted memberships with a Google account. The following data of people who became members during that period is kept; no new data is added to these records, old sessions have been invalidated and the data is not used for any other purpose:

• Name, e-mail address, profile photo link, Google account identifier and language preference received from Google; first and last sign-in time, number of sign-ins and visits.
• Photos sent (the name entered, where the photo was taken, the photo's location data), questions, answers, ratings and votes.
• News source links clicked while signed in, and connection digests kept to prevent misuse.

Published photos and Q&A entries stay published; since 26 October 2026 the sender's name is not shown on the site (for questions asked after 27 October 2026, see 3.6). The invitation campaign records were deleted on 26 October 2026. If you ask for these records to be deleted, your account and all records linked to it are deleted.

Legal basis: during membership, KVKK Art. 5(2)(c) (establishment and performance of a contract); after membership closed, KVKK Art. 5(2)(f).

3.8. Site administration and invited columnists

The site administrator and the columnists invited by the site management sign in to the Site. To limit failed attempts at the administration login, a one-way digest of the connection is kept for 1 day.

Invited columnists: the site management adds the Gmail address of a person it invites as a columnist, and the name to be shown on the Site, to an invitation list. When the person first signs in with Google, Google sends us their name, e-mail address, Google account ID, profile photo link and language. These, the sign-in times, the columns they write and the images they upload are kept. The writer panel opens only after the columnist gives explicit consent, by ticking an unticked box, to this data being kept abroad (Cloudflare, USA); a columnist who does not consent can send columns by e-mail. Columns are published under the columnist's name; the e-mail address is never shown on the Site.

Legal basis: establishing and carrying out the columnist relationship, KVKK Art. 5(2)(c); explicit consent for the transfer abroad under KVKK Art. 9(6)(a). Retention: the e-mail address on the invitation list until the person signs in or the invitation is withdrawn; account data while the person remains a columnist. When that ends, or on request, the account is deleted; published columns stay online unless the person asks otherwise. When our server in Türkiye is ready, these accounts will be moved there.

4. How personal data is collected

Personal data is collected automatically through your browser and the servers when you visit the Site, through your browser when you use the notification button, and by you when you send us an e-mail.

5. Automated processing

• Questions and answers you send to the Q&A section are screened automatically before publication so that content breaking the community rules is not published. The same content is translated automatically so it can be shown on the Turkish and English pages of the Site. Cloudflare, Inc. carries out this processing as a data processor (section 6).
• Purpose: preventing unlawful content and content that breaks the rules from being published (Law No. 5651) and publishing your content in both languages. Legal basis: KVKK Art. 5/2-f.
• If you paste a link on the add your business page, that page is read automatically to fill in the form and draft a description (Cloudflare, Inc.; section 6). Only the link and the public text of that page are sent; neither the link nor the result is stored. To stop more than 10 tries a day from the same device, a one-way trace is made from your connection and browser details with a random key valid for that day only; the trace is deleted after 1 day. You check and change the form as you like before sending it.
• Content flagged as doubtful, and every reader answer, is held until a person decides whether to publish it. No decision that affects you legally is taken solely on the basis of automated processing. If you believe an automated analysis has produced a result against you, you may object under KVKK Art. 11/1-g (section 11).

6. Recipients and transfer abroad

• Cloudflare, Inc. (USA): hosting, content delivery, database, file storage, security and the automated processing in section 5. The data in section 3 is processed on this infrastructure.
• Google (USA): e-mail service (Google Workspace), sign-in of the site administrator and invited columnists, the Google pass for the Q&A section (only your name reaches us from Google), and delivery of notifications on Android and Chrome.
• Apple Inc. and Mozilla Corporation (USA): delivery of notifications on iPhone and Firefox (content-less signal).
• OpenStreetMap Foundation: on pages with a map, map images are loaded from OpenStreetMap servers; your IP address reaches those servers.
• YouTube (Google): video preview images on some pages are loaded from YouTube servers. Videos open only when you play them, from YouTube's cookie-less address (youtube-nocookie.com).
• Authorised public bodies: only where expressly required by law and to fulfil a legal obligation (KVKK Art. 8 and Art. 5(2)(a), (ç)).

Because the servers of the service providers above are outside Türkiye, personal data passed to them is transferred abroad within the meaning of KVKK Art. 9. Your location, used for "nearest taxi rank" on the taxi page, is processed only on your phone and is not sent anywhere.

7. Cookies and browser storage

• Session cookies (gn_oturum, gn_giris, gn_yonetim, gn_saymama): used only on the devices of the site administrator and invited columnists (gn_oturum and gn_giris for 30 days).
• Question pass (gn_soru): valid for 30 minutes after passing through Google; carries only your short name and the daily trace.
• Q&A (gn_sorularim, gn_bende, gn_soru_taslak, gn_cevap_taslak): the numbers of the questions you asked, your "I want to know too" choices and the question or answer draft waiting while you pass through Google; kept only on your device.
• Browser storage: settings such as whether the app suggestion has been shown, your notification preference and the club you selected are kept on your device and not sent to our server. When you tap "This worked" on written directions, only a counter goes up; the device it came from is not recorded.

No advertising, analytics or social media tracking cookies are used. You can delete cookies and browser storage in your browser settings.

8. Legal compliance and data security

• Data minimisation (KVKK Art. 4): the Site has no membership; only a short name is published instead of your name, no e-mail address is asked for, IP addresses are not stored, and statistics are kept without cookies and with a key that changes every day. Location data in photos is removed before publication.
• Technical measures (KVKK Art. 12): the Site runs only over an encrypted connection (HTTPS); pass and session cookies are signed; only the site administrator can access the admin panel and failed sign-ins are limited; expired records are deleted automatically every hour.
• Organisational measures: every decision affecting data processing is recorded with its reasons and legal basis and reviewed at least once a year; changes in the relevant legislation are followed regularly in the Official Gazette.
• Data breach: if we learn that personal data has been obtained by others unlawfully, the Personal Data Protection Board and the people concerned are notified as soon as possible and within 72 hours at the latest, under KVKK Art. 12/5.
• Transfer abroad (KVKK Art. 9): the data transferred to service providers is listed in section 6. Preparations are under way to keep membership data on a server located in Türkiye.

9. Retention periods

Records whose period has ended are deleted or anonymised automatically.

10. Your rights

Under KVKK Art. 11 you have the right, by applying to the data controller, to:

1. learn whether your personal data is processed,
2. request information about it if it has been processed,
3. learn the purpose of processing and whether the data is used in line with that purpose,
4. know the third parties in Türkiye or abroad to whom the data is transferred,
5. request correction if the data is incomplete or inaccurate,
6. request deletion or destruction under the conditions in KVKK Art. 7,
7. request that the actions under (5) and (6) be notified to third parties to whom the data was transferred,
8. object to a result against you arising from analysis of the data exclusively by automated systems,
9. claim compensation if you suffer damage because of unlawful processing.

11. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing to the address above, through a registered electronic mail (KEP) address, with a secure electronic signature or mobile signature, or from an e-mail address you have previously given us or that is registered in our system (including the Google e-mail address you used during the membership period) to info@gelibolu.net.

The application must include your name and surname, your signature for written applications, your Turkish ID number if you are a Turkish citizen or your nationality and passport or ID number if you are a foreign national, your residential or business address for notifications, your e-mail address and telephone number if any, and the subject of your request.

Your application will be concluded free of charge within 30 days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.

12. Changes

This notice is updated when the way data is processed on the Site changes. The current version is always on this page; the date of the last update is shown at the top.