Privacy Policy

huseyinonal.com is my personal portfolio site. It shows my projects and lets you contact me. There are no user accounts, no shop, no payments and no newsletter on this site.

This notice explains which personal data is processed when you visit the site or write to me, for what purposes and on which legal grounds, who receives it and which rights you have. It is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies, Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”).

Website: https://huseyinonal.com

Data controller: Hüseyin Önal (VAT ID (VKN): 6550917743, Tax office: Konya - Meram VD)

Address: ŞEYH ŞAMİL MAH. CENGİZHAN CAD. Kapı No:30 Daire No:106 SELÇUKLU/KONYA

Email: contact@huseyinonal.com · Phone: +90 501 041 68 62

Contact form. When you use the form on the contact page you send your name, email address and message. All three fields are required so that I can reply. Please do not include sensitive data (for example health information) in your message.

Email. If you write to contact@huseyinonal.com, or I reply to your form message, your email address, the content of the correspondence and its technical metadata (date, sender and recipient addresses) are processed.

Technical data when you visit. Like every website, the server receives your IP address, the date and time, the page requested, the referring site and your browser and device information (user agent). This is needed to deliver the page and to protect the site from abuse; it may be recorded in server logs for a limited time.

Visitor statistics. The HOC Site platform that runs this site counts page views and unique visitors. According to the platform’s description, unique visitors are counted with a daily, one-way hashed visitor identifier instead of cookies. I only see aggregated figures (for example page views and visitors per day), not individual visitors.

Not used on this site: cookies, local storage, Google Analytics or other analytics tools, advertising, social media pixels, embedded videos or maps, profiling or automated decision-making.

This site does not set any cookies and does not use your browser’s local storage or session storage. I checked this on 6 October 2026 on all public pages in both languages. That is why there is no cookie banner.

If this ever changes, this notice will be updated first, and your consent will be requested before any cookie that is not strictly necessary is used.

The site uses the fonts already installed on your device (system fonts); no web fonts are downloaded.

The site loads nothing from third parties: no web fonts, analytics, advertising, social media or embedded content.

• Replying to your message and, if you ask for it, preparing an offer or starting a project: KVKK Art. 5(2)(c) (directly related to the establishment or performance of a contract) and Art. 5(2)(f) (legitimate interest in answering enquiries); GDPR Art. 6(1)(b) and (f).

• Delivering the site, keeping it secure, preventing spam and attacks, fixing errors: KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).

• Aggregated visitor statistics to see how much the site is used: KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).

• Meeting legal obligations and establishing, exercising or defending legal claims: KVKK Art. 5(2)(ç) and (e); GDPR Art. 6(1)(c) and (f).

How data is collected: electronically, through the contact form and the emails you send, and automatically through the servers and the platform when you visit the site. Explicit consent is not used as a legal ground. Using the form is voluntary, but without your name, email address and message I cannot reply.

• Platform: the site runs on HOC Site, a website platform that I also operate. No separate platform company receives your data.

• Hosting: the platform’s servers and the server that receives email are rented from Hetzner Online GmbH and located in data centres in Germany (checked on 6 October 2026: the web server is in Nuremberg, the mail server in Falkenstein). Hetzner only provides the infrastructure.

• Authorities: courts and public authorities, only where the law requires it.

Your data is never sold or used for advertising.

Transfers abroad. Because the servers are in Germany, storing your data there counts as a transfer abroad under the KVKK. The Personal Data Protection Board has not yet issued an adequacy decision for any country, so such transfers are made on the basis of Article 9 KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, i.e. with the appropriate safeguards listed there (such as the standard contract published by the Authority) or, where these cannot be provided, only in the incidental cases listed in Article 9(6). Under the GDPR, hosting in Germany is not a transfer outside the EU.

• Contact messages and related emails: as long as needed to answer and follow up on your request. If a business relationship follows, for as long as it lasts and for the statutory retention periods (for example Article 253 of the Tax Procedure Law No. 213). Messages that lead to no further contact are deleted once they are no longer needed; obvious spam is deleted promptly.

• Server logs: for a short period for security and troubleshooting, then deleted.

• Statistics: only aggregated figures that do not identify you are kept over time.

When the purpose ends, data is deleted, destroyed or anonymised under Article 7 KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

Under Article 11 KVKK you have the right to:

• learn whether your personal data is processed;

• request information about it if it has been processed;

• learn the purpose of the processing and whether the data is used in line with that purpose;

• know the third parties in Türkiye or abroad to whom it is transferred;

• request correction if it is incomplete or inaccurate;

• request its deletion or destruction under the conditions of Article 7;

• request that the third parties to whom it was transferred are notified of the correction, deletion or destruction;

• object to a result against you that arises solely from automated analysis of your data;

• claim compensation for damage caused by unlawful processing.

GDPR. Where the GDPR applies (Article 3 GDPR, for example when the site offers services to people in the EU), you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, in particular to processing based on legitimate interests (Articles 15–18, 20 and 21 GDPR), and the right to lodge a complaint with a supervisory authority in the EU member state where you live or work or where the alleged infringement took place (Article 77 GDPR).

Under Article 13 KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:

• in writing, with a signed letter sent to the address in section 01;

• by registered electronic mail (KEP), secure electronic signature or mobile signature; or

• by email to contact@huseyinonal.com, sent from the email address you have previously given me and that is in my records (for example the one you used in the contact form).

Please include your name and surname, your signature for written applications, your Turkish ID number (or, for foreign nationals, your nationality and passport or ID number), an address for notification, your email address or phone number if available, and what you are requesting, with any supporting documents.

I will answer free of charge within 30 days at the latest. If answering involves an extra cost, the fee set out in the Communiqué may be charged. If your application is rejected, the answer is insufficient or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning of the answer, and in any case within 60 days of your application (Article 14 KVKK). GDPR requests can be sent to the same email address and are answered within one month (Article 12(3) GDPR).

The site is served only over encrypted HTTPS (TLS) connections. Form messages can only be accessed by me through the platform’s protected admin area. The form includes a hidden anti-spam field.

This notice may be updated when the site, the services used or the law change. The current version applies from the date it is published on this page; the date at the top shows the last update.

• Law No. 6698 on the Protection of Personal Data (KVKK), Official Gazette 7 April 2016, No. 29677; Article 9 amended by Law No. 7499, Official Gazette 12 March 2024, No. 32487.

• Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, Official Gazette 10 March 2018, No. 30356.

• Communiqué on the Procedures and Principles of Application to the Data Controller, Official Gazette 10 March 2018, No. 30356.

• Regulation on the Deletion, Destruction or Anonymisation of Personal Data, Official Gazette 28 October 2017, No. 30224.

• Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, Official Gazette 10 July 2024, No. 32598.

• Personal Data Protection Authority, Guide on Cookie Practices (KVKK Publication No. 69, July 2025).

• Tax Procedure Law No. 213, Official Gazette 10 January 1961, No. 10703.

• Regulation (EU) 2016/679 (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1.