Privacy Policy

1. Publisher and data controller

NESET BAYRAM DİJİTAL İÇERİK ANONİM ŞİRKETİ operates Metatime and determines the purposes and means of the personal information processing described here. Its address is Altınşehir Mah. Zeynepkamil Sok. No: 279, Kat: 1, Daire: 3, 34494 Başakşehir, İstanbul, Türkiye. Privacy correspondence is received at [email protected].

This notice explains the publisher's processing under Türkiye's Personal Data Protection Law No. 6698 (KVKK), including the information required by Article 10. The General Data Protection Regulation (GDPR) also applies to processing that meets its territorial and material conditions. Hosting in Germany does not by itself determine which law applies to the publisher. The practices described here concern public reading, optional appearance preferences, correspondence and clearly identified direct advertisements.

2. Information involved in reading the publication

Reading a page sends connection information to the publisher's server and network infrastructure. This can include an internet protocol address, requested address, time, protocol and browser connection information. Server access and error logs record information needed for delivery, fault investigation and proportionate security monitoring. Email transport logs record delivery metadata, such as sender and recipient addresses, time and delivery outcome. These infrastructure records are separate from the browser preferences described below.

Connection information and browser preferences are collected electronically through page requests and the preference controls, using automated means. Correspondence is received electronically by email or, for a formal rights request, through the applicable written or electronic request channel. The publisher handles correspondence and rights requests within its filing arrangements, with human review of the matter.

The public publication has no registration, reader profiles, contact forms, comments, analytics tags or behavioral advertising. Its direct advertisement placement does not add an audience identifier, impression pixel or click-measurement script. Reading articles does not require a personal submission. An external destination opened through a link has its own data practices after navigation.

3. Browser preferences and correspondence

A cookie preference selection creates a signed receipt stored in the browser. It contains a random receipt identifier, the preference-policy version, a value identifying the publisher and policy context, the choice about preference storage, a recorded date and time, and an expiry. Acceptance and refusal use the same receipt mechanism. The application checks the signature, context and expiry on requests that present the cookie. The receipt contains no name, email address, internet protocol address, browser fingerprint, user-agent string or browsing history. Its random identifier is not used to follow article reading.

The application does not retain a separate server archive of preference selections or create its own technical error files or persistent request-correlation records. The current browser receipt provides the choice information used during a request. Replacing or clearing it leaves no historical selection in an application archive. Hosting and network infrastructure can still produce the separate connection records described above.

When optional preferences are allowed, an additional browser cookie stores the selected light or dark appearance. Email correspondence contains the sender's address, message and any information the sender chooses to include, together with the ordinary metadata handled by the email system.

4. Purposes and legal bases

Processing under Law No. 6698

• Delivering pages, investigating technical faults and maintaining proportionate security rely on Article 5(2)(f): necessary processing for the publisher's legitimate interest in operating the publication, provided that the individual's fundamental rights and freedoms are not harmed.
• Remembering the optional light or dark appearance relies on explicit consent under Article 5(1). The preference controls request that permission separately from essential storage.
• Storing and checking the active acceptance or refusal receipt rely on Article 5(2)(f), for the legitimate interest in respecting the choice and preventing optional storage without permission. Information necessary for a specific legal claim is handled under Article 5(2)(e), concerning the establishment, exercise or protection of a right.
• Considering ordinary editorial comments, corrections, rights enquiries and sponsorship enquiries relies on Article 5(2)(f). If correspondence is necessary to negotiate or perform a separate sponsorship agreement with the person concerned, Article 5(2)(c) applies to that contractual purpose.
• Handling a statutory privacy request and complying with a legally required disclosure rely on Article 5(2)(ç), concerning the publisher's legal obligations. Processing necessary for a particular legal claim relies on Article 5(2)(e).

The publication does not request the special categories of personal data listed in Article 6, such as health, biometric or religious information. Please omit unrelated sensitive information from correspondence. Receiving such information does not make it available for ordinary editorial or advertising use: any necessary processing requires a separate applicable condition under Article 6 and its safeguards, and an applicable Article 9 condition where the GDPR applies.

Processing where the GDPR applies

Page delivery, proportionate security, ordinary correspondence and checking the active preference receipt rely on the legitimate interests described above under Article 6(1)(f). Necessary information for a particular legal claim is processed under Article 6(1)(f) for the interest in establishing, exercising or defending that claim. Optional appearance persistence relies on consent under Article 6(1)(a), together with any applicable electronic communications consent requirement. Necessary pre-contractual or contractual correspondence relies on Article 6(1)(b). Handling a statutory request relies on Article 6(1)(c). Checking the signed browser receipt supports the consent accountability duties in Articles 5(2) and 7(1); the application does not maintain a historical consent archive.

Optional storage is not a condition of reading. A preference choice does not authorize another purpose. There is no sale of reader information, audience profiling or decision based solely on automated processing that produces legal or similarly significant effects.

5. Retention and review

Browser preferences and editorial correspondence

Record	Period or review rule
Browser preference receipt	6 calendar months from the selection, unless replaced or removed earlier
Optional appearance cookie	Expires with the current authorized preference receipt
Routine editorial correspondence	Up to 12 calendar months after the matter closes

The application accepts an unexpired receipt only for its matching publisher and policy context. It does not restore a choice from a server archive after a browser removes the receipt. The correspondence period is the publisher's administrative retention policy, applied separately to its email filing arrangements.

The table does not establish a deletion period for infrastructure access logs, mail transport records or recovery copies. Their schedules depend on the publisher's server and mail configuration and any contracted recovery service. These records are managed separately from browser preferences. Their configured rotation and recovery-copy periods have not been verified for this notice; the publisher's privacy contact can receive a request for the schedule applicable to a particular record. The providers' public website notices do not establish those customer-specific periods.

A legal hold is separate from routine retention. It concerns only information necessary for an identified legal obligation or legal matter and ends when that obligation or matter no longer requires it. Access and continued retention must be limited to that purpose.

6. Hosting, email and network processing

The publisher administers its website environment on infrastructure provided by ITENOS GmbH, based in Germany. Email uses the same provider. The network provider is Cloudflare, Inc.. Providers acting on the publisher's behalf are subject to the applicable processing instructions and contractual terms. Processing for a provider's own purposes is distinguished in its published privacy information.

The publisher administers its publication application on its own server. Hosting and email infrastructure process the connection and message information needed to deliver pages and correspondence. The network provider performs network delivery and connection diagnostics. The application does not add audience profiling, personalized advertising or cross-site reader tracking.

The network provider operates internationally. Its published privacy information describes storage primarily in the United States and the European Economic Area, with processing possible in other countries. Its customer Data Processing Addendum provides standard contractual clauses for relevant restricted transfers; its privacy information also describes the European Union–United States Data Privacy Framework where applicable. The hosting provider’s location does not mean that every subsequent processing operation remains in that country.

For information processed on a customer's behalf, the network provider's Data Processing Addendum, Annex 1, specifies the earlier of the service agreement's expiry or termination and the point when processing is no longer needed to perform that agreement. Section 3.1(i) provides for deletion or return, at the customer's choice, after agreement expiry, termination or service completion, subject to applicable legal retention. These are the provider's published contractual criteria, not a fixed lifetime for every network record or confirmation of the publisher's individual contract arrangements.

For its own processing, the network provider's Privacy Policy, section 11, considers the collection purpose, the information's volume and sensitivity, potential harm, whether less information would meet the purpose, and legal or contractual requirements. Its notice distinguishes this processing from customer-directed services. The hosting provider's public privacy notice concerns its own web portal; its portal log period is not represented as the period for this publication's hosting, email or recovery copies.

Network Error Logging can send failed-connection diagnostics from compatible browsers to the network provider. Its observed browser declaration lasts 7 days and does not request successful-connection reports. That instruction lifetime is separate from report retention. The provider's Network Error Logging documentation states that the client address remains in volatile memory only while the reporting request is processed and is then dropped, without being logged in that pipeline. This does not describe retention of every network-service record. The Cookie Policy explains this function separately from theme preferences.

Hosting and email in Germany and international network delivery involve recipients outside Türkiye. Transfers subject to Law No. 6698 require an Article 9 route in addition to an Article 5 or 6 processing condition. The available routes include an applicable adequacy decision or a valid safeguard, such as the Turkish Board's standard contract; incidental-transfer exceptions have their own limits. An EU standard contractual clause or Data Privacy Framework reference does not by itself establish a Turkish Article 9 route. This notice does not assert that a particular Turkish standard contract has been signed or notified. Information about the arrangement applicable to a particular transfer can be requested from the publisher.

Access is limited to the relevant publication task. A legally required disclosure is limited to its purpose. Direct sponsors receive no preference receipts or correspondence merely because an advertisement appears. Provider safeguards and the applicable transfer arrangements can be requested through the publisher's email.

7. Cookie choices and withdrawal

The Cookie Policy describes the essential preference receipt and optional appearance storage. Cookie preferences opens the current choices. Refusal preserves access to publication content. Withdrawing permission stops optional persistence and removes the appearance cookie; it does not change the lawfulness of earlier consent-based processing.

A recorded refusal replaces the browser's earlier receipt and may remain to remember that refusal. The application keeps no separate copy of the earlier selection. A browser that clears or blocks cookies may no longer present a recognizable choice, in which case optional persistence remains disabled until a new affirmative choice is recorded. Clearing a browser receipt does not delete separate correspondence or infrastructure records.

8. Individual rights

Rights under Law No. 6698

Article 11 allows an individual to ask whether the publisher processes their personal data and obtain information about that processing; understand its purpose and whether use matches that purpose; and identify recipients in Türkiye or abroad. Individuals may request correction of incomplete or inaccurate data, erasure or destruction when Article 7's conditions are met, and notice of those corrections or deletions to recipients. They may also challenge a detrimental result produced solely through automated analysis and seek compensation for damage caused by unlawful processing. These rights remain subject to the law's applicable conditions and exceptions.

A formal Article 13 request can be delivered in writing to NESET BAYRAM DİJİTAL İÇERİK ANONİM ŞİRKETİ at Altınşehir Mah. Zeynepkamil Sok. No: 279, Kat: 1, Daire: 3, 34494 Başakşehir, İstanbul, Türkiye. It can also be sent to [email protected] from an email address previously supplied to and recorded by the publisher, or using an applicable secure electronic or mobile signature. Ordinary privacy questions and assistance with the request process are welcome at the same mailbox.

The Turkish request rules require formal requests in Turkish. They specify the requester's name, signature for a written request, Turkish identity number for a Turkish citizen or nationality and passport or other identity number for a foreign national, an address for notification, available email, telephone or fax details, and the subject of the request. Include relevant supporting information without unrelated records or copies of identity documents. The publisher uses verification information only to the extent required to handle and authenticate the request.

Article 13 requests are resolved as promptly as their nature permits and within 30 days. The publisher responds in writing or electronically, acts on an accepted request and explains a refusal. Requests are generally free; only an additional cost permitted by the Board's tariff may be charged, and a fee is refunded where the request resulted from the publisher's error.

Rights where the GDPR applies

Individuals may request access, correction, deletion or restriction, and may object to legitimate-interest processing for reasons relating to their situation. Portability applies to automated processing based on consent or contract where its conditions are met. A request can be sent to the privacy mailbox above. Verification must be proportionate; the publisher does not collect additional information merely to identify an otherwise unidentifiable reader. GDPR requests are handled without undue delay and normally within one month. Any permitted extension is explained within that initial month. Requests are generally free, subject to the narrow rules for manifestly unfounded or excessive requests. These GDPR rights and procedures are not limited by the separate Turkish formal-request requirements.

9. Complaints and safeguards

For Law No. 6698, the relevant authority is Türkiye's Personal Data Protection Authority and its Personal Data Protection Board. The Article 13 request to the publisher must be made before the Article 14 complaint route is used. If the request is refused, the answer is insufficient or no answer arrives within 30 days, an individual may complain to the Board. The complaint deadline is 30 days after learning of a timely answer and in all cases no later than 60 days after the original request. Where no timely answer is received, the individual need not wait beyond the publisher's 30-day response period; the 60-day outer deadline still applies. The authority explains these rules in its complaint-deadline guidance. Available compensation and judicial remedies remain unaffected.

A supervisory authority in the European Union or European Economic Area may receive a complaint where the General Data Protection Regulation applies, particularly in the country of habitual residence, work, or the alleged infringement. For a GDPR complaint, contacting the publisher first is optional and does not limit a complaint or judicial remedy.

Encrypted transport, signed preference receipts, restricted script access to application cookies and controlled operator access form part of the technical and organizational measures. Preference validation limits optional storage to a valid current choice. The publication does not make an absolute security guarantee. Any applicable personal data incident obligations are assessed against the relevant law and circumstances.

10. Policy updates

The effective date above identifies the current public policy. A material change to optional processing requires an updated explanation and, where required, a new consent choice. Changes do not retrospectively expand an existing permission.

The Turkish authority publishes an English translation of Law No. 6698; the Turkish legal text controls where the translation differs. This notice does not treat an editorial purpose as a blanket exception for the publisher's administrative processing.