# KVKK Privacy Notice

Privacy notice on the personal data, cookies and advertising measurement processed through the Arslanlı Yatırım & Danışmanlık website.

*This is an English translation for information; the Turkish version prevails.*

## Data controller

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Arslanlı Yatırım & Danışmanlık ("Arslanlı") as the data controller, within the scope described below.

Authorized person: Hatice Arslan  
Tax office and number: Pendik, 303 063 8183  
Address: Starport Residence, Yenişehir Mah. Millet Cad. Sümbül Sk. No:10 D:28, 34912 Pendik / İstanbul  
Email: info@arslanlidanismanlik.com  
Phone: +90 501 699 42 77

## Personal data we process

**Contact form:** your full name, email address and the content of your message (required); phone number and subject (optional).

**Newsletter subscription form:** first name, last name, email address, phone number, province and sector (required); optionally, the topics you are interested in. In addition, your two separate consent records (that you have read the privacy notice and that you agree to receive commercial electronic messages) are stored together with the date and time at which you gave consent.

**Job application form (Careers page and job posting pages):** first name, last name, email address, phone number, the city where you live and your resume file (PDF or DOCX, up to 5 MB) (required); your LinkedIn link, the field or position you are interested in, your years of experience and your cover letter (optional). Your consent record for the privacy notice is stored with the date and time of consent; your optional retention permission is stored with its date and time if you tick it, or as "No" if you do not. If you apply from the page of a job posting, the ID and title of that posting are also recorded with your application. Details are in the "Job applicants" section.

**YTAK and Capacity Development preliminary analysis forms (advertising landing pages):** full name, company, phone number and email address (required); preliminary assessment answers such as the planned investment amount range, investment incentive certificate status, the business's sector and scale, and KOSGEB registration status, together with the answers to the eligibility check on the page. If you arrived by clicking a Google ad, the ad source information is also stored with your form record, namely the campaign parameters in the address bar (utm\_source, utm\_medium, utm\_campaign, utm\_content, utm\_term), the click IDs that Google assigns to the click (gclid, gbraid, wbraid) and the address of the page from which the form was submitted. Click IDs do not carry a person's name; however, because they are combined with your form record, they are considered personal data.

**On all forms:** the date and time of submission and your IP address (for transaction security and prevention of misuse). To tell whether a submission comes from a real person, the time taken to fill in the form, the browser type and language information reported by your browser, and the text itself are automatically assessed at the moment of submission. The information examined in this assessment is not itself stored; only for a submission found suspicious, the assessment score and brief reasons are recorded. Details are in the "Spam filter" section.

**While you browse the site:** which page you view and which site you came from are added to daily totals without identifying you; your IP address and browser information are not stored. Details are in the "Data processed while you browse the site" section.

**When you contact us directly:** information you share with us by phone, email or WhatsApp.

We do not request special categories of personal data (such as health, religion, sect, political opinion or biometric data) in our forms; please do not include such information in your messages or resume.

## Purposes of processing

We process your personal data for the following purposes: to evaluate your request and get back to you; to make a preliminary assessment of support programs that may suit your business and, if a service relationship is to be established, to hold the necessary meetings; if you give consent, to inform you about new calls, program changes and application calendars and to send commercial electronic messages; to evaluate your job application and communicate with you about it; to prevent misuse of the forms and ensure information security; to measure, without identifying you, how many people visit which pages of our site; to fulfill our legal obligations.

We do not sell your data. Unless you have given explicit consent, we do not share it with third parties for advertising purposes; when you give consent, the information shared with Google is listed in the "Cookies and advertising measurement" section.

## Collection methods and legal grounds

Your personal data is collected electronically through the forms and the visit counter on our website, and also through the phone, email and messaging channels by which you contact us directly.

Data collected through the contact form and direct communication is processed on the legal grounds of KVKK Art. 5/2-c (being directly related to the establishment or performance of a contract), Art. 5/2-ç (compliance with a legal obligation) and Art. 5/2-f (our legitimate interest, provided that your fundamental rights and freedoms are not harmed). The contact form has no separate consent checkbox.

Your contact details collected through the newsletter subscription form are processed for sending information on the basis of the consent you give, under Law No. 6563 on the Regulation of Electronic Commerce, to be informed and to receive commercial electronic messages by email, SMS and phone. You may withdraw this consent at any time, without giving a reason and free of charge; once you withdraw it, we will not send you new messages. To withdraw your consent, you can use the "Unsubscribe" link at the bottom of every email we send you or write to the email address in the "How to apply" section. The record of your consent and of its withdrawal is kept under our burden of proof and our legitimate interest (Art. 5/2-ç and Art. 5/2-f).

The date, time and IP address of a submission, and the information processed for the spam filter, form security and the visit counter, are processed under our legitimate interest in information security and in measuring how the site is used (Art. 5/2-f). The legal grounds for job applications are in the "Job applicants" section, and the legal ground for using AI assistants in administration is in the "AI assistants in site administration" section.

Data collected through advertising and analytics cookies and similar technologies (the Google tag, click IDs and, if consent is given, hashed email and phone number) is processed solely on the basis of your explicit consent (KVKK Art. 5/1); the transfer of this data to Google companies abroad is also based on your explicit consent (see "Transfer of personal data"). Consent is given through the consent banner on the site; no option is pre-ticked, and refusing does not affect your use of the site. You may withdraw consent at any time through the "Cookie preferences" link in the footer; withdrawal has effect for the future and does not make processing carried out earlier on the basis of consent unlawful.

## Storage and email delivery of submissions

When you submit a form, the information you wrote is sent by email to the company's notification email address, together with the date, time and your IP address; for a job application, your resume file is attached to the email. No automatic confirmation email is sent to you separately. The notification email is not sent for submissions that the spam filter finds suspicious (see "Spam filter").

In addition to the notification email, your submission is also stored in a log file on our server, so that the record is not lost even if the email cannot be delivered. Newsletter registrations (the source of the subscriber list), job applications and submissions found suspicious are always written to this file; writing contact form submissions to this file is a setting and can be turned off. The log file is in a folder that is closed to access from the internet; the records are seen only by our authorized employees who log in to the admin panel with a password.

The growth of the log file is limited, and it is divided into two shares. Newsletter subscription records have a separate 3 MB share; if this share fills up, no new newsletter registrations are accepted, while existing records and contact and job application records are not affected, and subscription records are not deleted automatically (they are removed only when the person requests it or when a record is found suspicious and deleted). Free text in a newsletter record is stored up to 500 characters. Contact form, job application and suspicious records use the remaining 3 MB share and up to 10,000 records; if this share is exceeded, the oldest records are deleted: first the records found suspicious and, if that is not enough, the oldest contact form and job application records (together with the application's resume file).

The resume file in a job application is stored under a random name in a folder separate from the log file; the type of the file is verified by its content, not its name. The original name of the file is written to the application record.

## Spam filter

Because forms can be filled in by programs and misused, every submission is automatically scored before a notification email is sent; one of our employees does not do this scoring individually. The filter looks at the following. A single indicator is not enough to treat a submission as suspicious; the score limit is exceeded when several come together, whereas filling in the hidden field is enough on its own:

- The time between the form being opened and submitted; whether the submission was made from a real browser (a small calculation the browser writes into the form, the browser type, language information, whether the request came from another site),
- Whether a hidden field that people cannot see was filled in,
- Whether the message contains a link (web address), and advertising patterns such as search engine optimization, data or software sales, gambling and loans,
- Whether the text is written in a language or alphabet that is foreign to the site; whether the message mentions our site's own domain name,
- Whether the name or company name consists of random letters or test names,
- Whether the phone number looks like a Turkish number,
- Whether a disposable (temporary) email address is used,
- Whether the same text was sent several times in the last 30 days, or the same email address several times in the last 24 hours (compared with previous records).

## Submissions flagged as suspicious and automated assessment

If the filter finds a submission suspicious, the submission is not deleted and no warning is shown to you: you see the usual "received" message on the screen. However, your submission is not forwarded to the company's email inbox; it is only taken into the "Suspicious" list in the admin panel, with the reason it was found suspicious. Our authorized employees review this list; if they see that it belongs to a real person, they move the record among the regular records and the notification email is sent at that moment.

Suspicious records are kept for at most 30 days and are limited to the newest 300 records; long texts such as messages and cover letters are kept to their first 1,000 characters. Expired records, together with the resume file if it is a job application, are deleted automatically; deletion takes place during the server's daily maintenance, occasionally as form submissions arrive, and when an administrator opens the Form records or Job applications list.

This assessment is fully automated. If you submitted a form but did not receive a reply, our filter may have mistakenly treated your submission as suspicious; it is enough to contact us by phone or email. Under KVKK Art. 11, if you believe the automated assessment has produced a result against you, you may object to it.

## Data processed while you browse the site

When you open a page on our site, your browser sends a small notification to our server: it contains the address of the page you opened, the site you came from and, if you came from an advertising link, the campaign information in that link (parameters such as utm\_source, utm\_medium, utm\_campaign; when a Google ad is clicked, the ID value itself is not counted, it is only known that the visit came from an ad). As with every internet request, your IP address and browser information also reach the server.

To count the same visitor once a day, your IP address and browser information are turned into a short digest together with a random value that is renewed every day; your IP address and browser information are not stored. To prevent many visitors from being recorded from a single source in one day, a separate short digest of your IP address, taken in the same way, is also kept. These digests and the random value are kept only for that day and are deleted at the first count of the next day; therefore they cannot be matched across days. The counter does not use cookies or any other persistent identifier.

Only daily totals are stored permanently: the number of daily visitors and page views, views per page, the names of the sites visitors came from (for example google.com; not the full address), the number of visitors coming from phones, tablets and computers and by browser family (such as Chrome, Safari), the number of views by hour, the number of visitors and form submissions by campaign information, and the number of visitors who completed steps on some pages (such as starting the eligibility check on the YTAK page or completing the steps of the form). Campaign parameters and on-page steps are counted as "one visitor, once" using the daily digest above, without being linked to a person. The totals cannot be associated with an individual; therefore they are kept without a time limit. Visits by search engines and other software robots, and visits from a browser logged in to the admin panel, are not counted; if JavaScript is turned off, the visit is not counted.

The signed, single-use security token used in forms contains no personal data; the digests of used tokens are kept on the server for at most two hours. To limit many submissions in a short time, a digest of your IP address and the submission times are kept on the server when you submit a form; these records are not used for any purpose other than the submission limit, and those older than one day are deleted in the server's daily maintenance.

As with every website, the server hosting our site may keep your connection information (IP address, requested address, browser information, time) in its own server logs; these logs are the responsibility of the hosting provider and are not visible in the site's admin panel. When content changes, the list of page addresses may be notified to search engines (IndexNow); this notification carries only publicly available page addresses and contains no information about visitors. The preview images that appear when a page is shared are generated on our own server from the site's publicly available content. Visitors cannot upload files to the site; uploading is only for the resume file in the job application form.

## Cookies and advertising measurement

To measure the results of Google Ads advertising, our site uses the Google tag (gtag.js) and Google Consent Mode v2. When you first open a page, you see the "Accept", "Reject" and "Preferences" options in the banner at the bottom; cookies are divided into "necessary", "analytics" and "advertising", non-necessary ones are off by default, and only what you select is permitted. Your choice is stored in your browser's local storage for 12 months and you are then asked again. The names, purposes and durations of the cookies used are listed in the [Cookie Policy](https://arslanlidanismanlik.com/en/legal/cookie-policy).

**If you give advertising permission,** Google may write advertising measurement cookies to your browser and receives the following information: your page views, your ad click IDs (gclid, gbraid, wbraid), identifiers created through cookies, your IP address and browser information, and "conversion" events: the thank-you page that opens when you submit the YTAK or Capacity Development form, and your clicking the phone number or the WhatsApp button on the site. The content of your form itself (such as your message or your investment information) is not sent to Google.

**Enhanced conversions:** if you have given advertising permission and this feature is turned on on our site, the email address and phone number you wrote in the YTAK or Capacity Development form are converted by the Google tag in your browser into an irreversible digest (SHA-256 hash) and sent to Google on the thank-you page; Google compares it with its own accounts to verify whether an ad click matches your form submission. This information is not written to the address bar or to our server; it is carried to the thank-you page only in your browser's session memory and is deleted as soon as it is used.

**If you do not give advertising permission** or you reject the banner, the Google tag does not write advertising and analytics cookies and does not store ad IDs. The tag is still loaded on pages; since your browser connects to Google servers at that time, Google sees your IP address and browser information, as with every internet request. Google states that, when consent is not given, it may receive page view and conversion information that carries no identifying details, without using cookies, and may use it for aggregated measurement and modeling; details are in the [Google Privacy Policy](https://policies.google.com/privacy) and in Google's advertising product documentation.

Click IDs (gclid, gbraid, wbraid) and campaign parameters are stored with your form record if you submit the form (see "Retention period"). These values in the address bar are also kept in your browser's session memory during your visit, so that they are not lost if you go to another page and come back.

## Newsletter subscribers and bulk email

We send emails about new calls, program changes and application calendars to people who fill in the newsletter subscription form and give consent to commercial electronic messages. Registration is a single step; no separate verification email is sent. Emails go only to people who have given this consent and have not unsubscribed; they are not sent to old form records that have no consent record. Newsletter emails are sent from the admin panel, started by one of our authorized employees. The consent text in the newsletter form lists email, SMS and phone; our site's bulk sending tool sends email only.

At the bottom of every newsletter email there are the company name, address, phone, email address, the reason you are receiving the email ("the consent you gave when filling in the newsletter form") and an "Unsubscribe" link. The link is specific to your address; the "unsubscribe" button in your email application (such as Gmail) does the same job. You can also unsubscribe by writing to us or calling us. The emails do not track whether you open them or click on the links.

Unsubscribing is permanent: after you unsubscribe, you will not start receiving emails even if you fill in the newsletter form again with the same address (someone else may also have filled in the form with your address). If you want to receive them again, it is enough to write to us; our authorized employee reopens the subscription at your request.

When you unsubscribe, your address and the date of unsubscribing are written to a separate "unsubscribed" list, in order to ensure that no more emails are sent to your address and to keep a record of your consent and its withdrawal; your record in the newsletter form (first name, last name, phone, province, sector, topics of interest, consent records) also continues to remain in the log file. If your record is deleted at your request, your preference that no more emails be sent to your address is stored not as the address itself but only as an irreversible digest taken with the site's secret key.

A record is kept for every bulk sending: the subject and text of the email, by which filter the recipients were selected, the person or access that started the sending, the time of sending, and, for each recipient, first name, last name, email address, the result of the sending (sent, error, skipped), its time and the error note, if any.

## Job applicants

When you apply through the general application form on our Careers page or through the form on the page of a job posting, your information listed in the "Personal data we process" section and your resume file are processed for evaluating your application and communicating with you. An application made from a posting page is linked to that posting; applications made from outside a posting page are general applications not linked to a specific posting. Even if the posting is later closed or deleted, the posting title recorded in your application remains in the record. We remind you not to include information such as health condition, religion, political opinion or identity document number in your resume and cover letter.

This data is processed on the legal grounds of KVKK Art. 5/2-c (establishment of a contract) and Art. 5/2-f (legitimate interest). Your application, together with your resume, is sent to our company email address and stored in the log file on our server; your resume file is kept in a separate folder. Your application is seen only by our authorized employees involved in the recruitment process; it is not shared with other companies.

The second checkbox in the application form is optional. If you tick it, you give your explicit consent for your application to be kept for suitable positions that may open in the future; if you do not tick it, your application is used only for the open evaluation process. You may withdraw this permission at any time, without giving a reason, by writing to the email address in the "How to apply" section; when you withdraw it, your application and resume are deleted.

Retention: Applications are not deleted automatically on the server; deletion is an action our authorized employees perform from the admin panel, and the resume file is deleted with that action. If you did not give retention permission, your application and resume are deleted when the recruitment process is concluded. If you did, they are kept for the duration of your permission, until you ask for them to be deleted; no separate maximum period has been set for this. That very old applications may be deleted automatically because of the size limit of the log file is explained in the "Storage and email delivery of submissions" section. The notification email in the company mailbox (including the resume attachment) is a separate copy from the record on the server; it is deleted in the same way.

## Transfer of personal data

Your personal data may be transferred, within the conditions set out in KVKK Art. 8 and 9, to the hosting (server) and email service providers from which we receive support for running the service, to legally authorized public bodies and institutions upon request, and, only if you have given explicit consent, to Google companies for advertising measurement and to AI services used in site administration (see "AI assistants in site administration"). Newsletter emails reach the email service that hosts your address.

If the registration of commercial electronic message consents in the Message Management System (İYS) is required, this registration is made separately by the company; our site is not automatically connected to İYS.

If the servers of the hosting or email service we use are located abroad, this transfer is made in accordance with the conditions set out in KVKK Art. 9. You can write to us to find out which service providers we work with.

**Transfer abroad (Google):** When you give advertising permission, the data listed above in the "Cookies and advertising measurement" section is transferred, for advertising measurement purposes, to Google LLC (USA) and Google Ireland Limited (Ireland); Google may process this data on its servers in various countries around the world. This transfer is based on your explicit consent under KVKK Art. 9, and you can withdraw your consent at any time through the consent banner. In processing this data, Google may act separately as a data controller or data processor under its own policies; for details, please see the [Google Privacy Policy](https://policies.google.com/privacy).

## AI assistants in site administration

In the administration of the site, our authorized employees may connect their own AI assistants (for example Claude or ChatGPT) to the site's administration interface. The connection is established with a separate access key for each employee; each key is created with at least "read" permission, and other permissions are ticked separately; the key can be given for a limited period if desired and can be turned off at any time. The actions performed by the assistant are recorded, stating which access key and which application they were made with.

An assistant that has been granted the "Inbox" permission can read the records coming from forms, the newsletter subscribers and the job applications; at the employee's request it can delete a record or unsubscribe a subscriber. Unless this permission is granted, the assistant cannot see any form record, subscriber information or application. The assistant cannot send newsletter emails (at most it prepares a draft); it cannot see the panel password or the access keys; the contents of resume files and your IP address are not transferred to the assistant.

The personal data read by the assistant is processed on the servers of the AI service used by the employee, according to that service's own terms, and these servers may be located abroad. For this reason, the "Inbox" permission is given only when necessary and only to our authorized employees. This processing relies on our legitimate interest in carrying out administration tasks (KVKK Art. 5/2-f); the transfer abroad is made in accordance with the conditions set out in KVKK Art. 9. You can write to us to find out which AI services are used.

The information that can be transferred to the assistant with the "Inbox" permission is as follows: first name, last name, email address and phone number; province or city, sector and topics of interest; the message or cover letter you wrote (at most its first 2,000 characters); in applications, the position, years of experience, LinkedIn link and the name of the resume file; your consents to the privacy notice, to commercial electronic messages and to retention; the status of your newsletter subscription.

## Retention period

Your personal data is kept for as long as the purpose of processing requires. A mechanism that deletes automatically on our server exists only for the records specified below; other records are deleted by our authorized employees, and for most of them no fixed retention period has yet been set. Apart from this limited mechanism, when the share for contact form and job application records is exceeded, the oldest contact form and job application records may be deleted (see "Storage and email delivery of submissions").

The information you send through the contact form is not deleted automatically after a period; it is deleted by our authorized employees. No fixed period has been set for this; you may request its deletion at any time.

Your newsletter registration is used for sending email until you withdraw your consent. When you withdraw your consent, no newsletter is sent to you; your address and the date of unsubscribing are kept as "unsubscribed", and your record in the newsletter form, together with your consent records, is kept until our authorized employees delete it. No fixed period has been set for this. If you request deletion, all newsletter records associated with your address are deleted; your unsubscribe information and your first name, last name and email address in the bulk sending records are also deleted. In this case, your preference that no more emails be sent to your address continues to be kept not as the address itself but as a keyed digest; thus no email is sent to your address unless you want the newsletter to be sent. No fixed retention period has been set for the bulk sending records themselves either.

The retention of job applications is explained in the "Job applicants" section.

Submissions found suspicious by the spam filter are kept for at most 30 days, up to the newest 300 records, and are deleted automatically when the period expires (details are in the "Submissions flagged as suspicious and automated assessment" section).

The digests of used form tokens are kept for at most two hours, and the IP digests kept for the form submission limit are kept until those older than one day are cleaned up. The daily digests of the visit counter are deleted at the first count of the next day; daily totals are kept without a time limit because they contain no personal information.

Backup files taken from the admin panel and the notification emails in mailboxes are copies separate from the records on the server; they are not deleted automatically when the record on the server is deleted. In deletion requests, these copies are also deleted separately. Data whose retention period has expired is deleted, destroyed or anonymized.

Click IDs, campaign parameters and the address of the page from which the form was submitted are kept for the same period and under the same rules as the form record they are linked to: no separate, shorter period has been set for them; when the record is deleted they are deleted with it, and if the size limit of the log file is exceeded they drop out together with the oldest records (see "Storage and email delivery of submissions"). Your preference in the consent banner is stored in your browser for 12 months. The data sent to Google and Google's cookies are subject to Google's own retention periods; you can find the cookie durations in the [Cookie Policy](https://arslanlidanismanlik.com/en/legal/cookie-policy).

## Data security

For the security of your personal data, we apply the following measures: form records and resume files are kept in a folder closed to direct access from the internet, and resume files are stored under random names; the site is configured to redirect HTTP requests to HTTPS; the admin panel is entered only with a password, login is temporarily closed after 5 failed attempts in 15 minutes, and the session ends after 8 hours if no action is taken; AI access keys are stored on the server only as digests, are specific to a person and can be turned off at any time; forms are protected with signed, single-use tokens.

Changes in the admin panel and in AI access are recorded together with who made them; the name or email address of the person concerned is not written in the record of actions such as deleting a record, deleting an application or unsubscribing.

## Your rights

Under KVKK Art. 11, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with its purpose; know the third parties to whom it is transferred at home or abroad; request correction if it is incomplete or inaccurate; request its deletion or destruction within the framework of KVKK Art. 7; request that these actions be notified to the third parties to whom the data has been transferred; object to a result against you arising from analysis exclusively by automated systems; and request compensation for the damage if you suffer harm due to unlawful processing.

For processing based on explicit consent (advertising and analytics cookies, transfer to Google), you may withdraw your consent at any time: it is enough to change your selection through the "Cookie preferences" link on the site.

## How to apply

You can submit your requests concerning your rights, together with information that allows us to identify you, to info@arslanlidanismanlik.com by email or to our address above in writing. Your application is concluded as soon as possible and at the latest within thirty days, depending on its nature; the procedure is in principle free of charge. If your application is rejected, if you find the response given insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board.

For cookies and information stored in your browser, please see the [Cookie Policy](https://arslanlidanismanlik.com/en/legal/cookie-policy).

Last updated: 27 October 2026

## Contact

- Phone: +90 501 699 42 77, +90 501 678 42 77
- Email: info@arslanlidanismanlik.com
- Address: Starport Residence, Yenişehir Mah. Millet Cad. Sümbül Sk. No:10 D:28, 34912 Pendik / İstanbul
- Contact page: https://arslanlidanismanlik.com/en/contact

HTML version of this page: https://arslanlidanismanlik.com/en/legal/privacy-notice