Privacy and Data Protection

Data controller and contact

The data controller is Yusuf Kaan Gültaş. This site uses the name ykg.digital.

Office address: Akyazı Mahallesi, 874 Nolu Sokak, No: 1, Kat: 1, Daire: 2, Altınordu/Ordu
Email: ykg@ykg.digital
Telephone: +90 850 302 15 91

You can submit requests about your personal data through these channels or the contact form.

What information do we receive?

When you visit the site, the following information is processed electronically and automatically: your IP address, browser and device information (browser type, language and screen size), the address and title of the page you open, the address of the page that brought you to this site, and your measurement and advertising preferences.

When you use a form, we receive your name, the email address or telephone number you provide, and your message directly from you. Please do not include identity numbers, payment details or sensitive information unnecessary for your request.

Contact form

We use the information you share to read and answer your request, assess what you need and continue the conversation you started. We do not add your contact details to a separate marketing list.

Messages are processed through Google services and Google Workspace so we can receive and answer them.

AI conversation

You can write your first message in the AI conversation before selecting the separate consent checkbox. Your message is not sent to the conversation service or AI provider until you select that checkbox.

When you start a conversation, we record the messages you send, AI and team replies, message times and the conversation status. We use them to understand your needs, answer your questions, prepare a short internal needs summary and allow a team member to join when needed. The ykg.digital team can view the conversation live; team replies are identified. AI replies do not create a price, delivery date or service commitment.

If you would like our team to contact you, the separate request within the conversation requires your name, email address and contact permission. Company and phone details are optional. You can submit the request before writing your first message. You can continue the AI conversation without a contact request. Please do not include identity numbers, payment details or special-category personal data in your messages.

We use Cloudflare infrastructure for the conversation and optional contact request, and the OpenAI API for AI replies, reply review and needs summaries. Relevant conversation text may be sent to these providers for those purposes. Cloudflare may process your IP address and verification signals for security and abuse prevention. This processing may take place outside Türkiye.

We delete our conversation records no later than 90 days after the last message. This period is separate from the retention periods for contact and ATLAS application forms described below. Access to a conversation in the same browser lasts no more than seven days from when it begins. OpenAI may retain abuse-monitoring records, potentially including message content, for up to 30 days in ordinary cases; legal or safety exceptions may extend that period. Those provider records are separate from our 90-day conversation retention.

Separate consent text for the AI conversation

This page does not collect consent. Consent is collected through a separate checkbox in the AI conversation; reading this page does not mean that you consent.

Consent to processing abroad: I consent to the messages I write in this AI conversation and the context needed to generate replies being processed outside Türkiye through Cloudflare and OpenAI to provide the conversation. I understand that I cannot use the AI conversation without this consent and can use other contact channels.

ATLAS beta application

Applications are intended only for people working in real estate. We use your name, contact details and message to assess your application, understand your needs relating to ATLAS and contact you about the beta process. Applying does not guarantee acceptance or immediate access.

We do not add your application details to marketing lists. Messages are processed through the same Google services as the contact form.

Form security

We use a daily submission limit through Cloudflare to protect the contact and ATLAS beta forms from abuse. The first two submissions from an internet connection do not show a bot verification screen; Turnstile verification is required from the third submission onward. Your IP address is processed for the daily limit, and browser/device signals are processed when verification is required. Your name, contact details and message pass through Cloudflare to the Google mail service.

The two forms share a daily limit of 5 submission attempts per internet connection. The day resets on Türkiye time. Our daily counter stores a keyed, day-specific digest rather than the IP address itself; records are deleted within approximately 25 hours. Your name, contact details and message are not stored in counter records. People sharing an office or Wi-Fi connection may share the daily limit.

This security check is separate from measurement and advertising preferences. See Cloudflare’s Turnstile privacy notice for information about its processing.

Legal bases

For contact, hosting and legal obligations, we process data under the following bases in Article 5 of the Turkish Personal Data Protection Law (KVKK):

• Contact form and ATLAS beta application: the conversation initiated by your request being directly related to establishing a contract (Article 5/2-c), and our legitimate interest in responding to your request (Article 5/2-f).
• The hosting provider’s access logs: our legitimate interest in delivering the site securely (Article 5/2-f).
• Legal retention duties and responding to your KVKK requests: our legal obligation (Article 5/2-ç).

The Google Analytics, advertising tools and Cloudflare Web Analytics data flows that start on the first visit are described below.

Retention

The retention period begins when a message is received. We retain irrelevant messages for one week, answered messages for one month, and messages relating to ongoing conversations or work for up to one year; we delete them when the period expires. If a legal retention duty or dispute applies, the relevant record is retained for as long as that requirement continues.

Analytics cookies and the preference record in your browser are valid for 180 days.

Site measurement and advertising

We measure page visits with Google Analytics 4. Measurement and Analytics cookies are enabled from the first visit, before you make a choice; page-view, IP address, browser and device information reach Google. If you turn measurement off, new page-view events stop, Analytics cookies are removed and Analytics measurement will not start on subsequent pages. An already loaded tag may still send technical consent signals.

On the site’s general pages we send only page-view events to Google Analytics; no separate Analytics events are sent for watching the film or submitting an application. On customer-specific quote pages, which only people who receive the link see, we also send interaction events in addition to page views, such as section views, scroll depth, time on page, option changes, opening the sample site and clicks on contact links; these events never include a name, phone number, email address, note, search text or form value. Google Analytics may also process technical session and usage signals.

On customer-specific quote pages, while the Measurement switch in the preferences panel is on, Microsoft Clarity also records heatmaps and sessions: mouse movement, clicks, scrolling and how the page looks are recorded; the content of form fields is masked and not recorded. This data is transferred abroad to Microsoft. If you turn Measurement off, Clarity is not loaded, or is stopped if already loaded, and Clarity cookies are removed. Clarity is not used on other pages.

We use Google Ads and Meta Pixel to measure advertising performance, successful contact requests and ATLAS beta applications, and to use visit information for ads relevant to your interests, including on Facebook and Instagram. Advertising is off by default; Google Ads and Meta Pixel do not load unless you explicitly allow them. You can turn it on or off separately from measurement. Turning advertising off stops new application advertising events and removes the site's Google Ads and Meta cookies. An already loaded Google tag may still send technical consent signals. This site setting does not delete cookies on Meta's own domains. You can change your measurement and advertising preferences on the Cookies and Measurement page.

Conversion events are sent only after the server confirms a successful submission. These events do not include your name, email address, telephone number or message; they use the submission type and a random transaction identifier. Meta receives one page-view event per actual page load and the application type and a random transaction identifier after a successful submission. Google and Meta may process IP address, visited page address, browser and device information. Enhanced matching and Meta's automatic form events are not used.

Cloudflare Web Analytics collects page load and performance information from the first visit. It works independently of the measurement and advertising preferences and cannot be turned off through this panel.

We measure visits with Umami, without cookies, to improve the site. This covers pages opened, the referring address, device and browser type, language and location (country or city), and on-site actions such as clicks and scrolling; your IP address is also used in this process. What you write in forms and chat is not included in this measurement. The data is kept on our own server in Türkiye. This measurement is not tied to the switches in the preferences panel.

Service providers and international transfers

We share your data only with the following service providers and for the purposes listed. Their servers are outside Türkiye (primarily in the United States and European Union countries), so your data is transferred abroad. We do not share your data with anyone else, except in response to requests from legally authorised bodies.

• Google (Google Workspace and Google Apps Script): receiving, storing and answering form messages.
• Cloudflare (DNS, Workers, Turnstile and Web Analytics): DNS management, hosting and delivering the site; security, bot verification, the daily submission limit and securely forwarding form messages to Google. Accessing the site may involve processing your IP address, the requested page or file address and technical connection information. Cloudflare Web Analytics measures visits and page performance from the first visit, independently of the measurement and advertising preferences in the panel. See Cloudflare’s privacy policy for details.
• Google (Google Analytics): measuring page views and, on customer-specific quote pages, interaction events.
• Microsoft (Microsoft Clarity): only on customer-specific quote pages and only while Measurement is on, for heatmaps and session recordings; form content is masked.
• Google (Google Ads) and Meta (Meta Pixel): advertising measurement, attribution of successful applications and ads relevant to visit interests.

Your rights under the KVKK

Under Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether your data is used for that purpose.
• To know the third parties to whom your data is transferred within Türkiye or abroad.
• To request correction of incomplete or inaccurate data.
• To request deletion or destruction of your data under the conditions set out in the law.
• To request that corrections, deletions and destruction be notified to third parties receiving your data.
• To object to a result against you arising from analysis of your data solely through automated systems.
• To seek compensation if you suffer damage because your data was processed unlawfully.

How to submit a request

You can submit a written request to the office address above or email ykg@ykg.digital. The telephone and contact form can be used for initial contact; we may need to verify your identity for a formal request.

Requests are free of charge and are answered as soon as possible, within 30 days at the latest. If providing a response incurs an additional cost, a fee may be charged under the tariff determined by the Turkish Personal Data Protection Board. If your request is rejected, you find the response inadequate, or you receive no response within the required period, you may lodge a complaint with the Board.