Privacy Policy | Bilal Köse

General

By continuing to use the site you acknowledge this policy and our cookie preferences (granted by default; change via the footer link). We may update this page; the date below reflects the latest revision.

Data controller

The data controller for this site is Bilal Köse (personal/professional website owner). For requests regarding your personal data and questions about this policy, please use the form on the contact page.

Google Analytics 4 (GA4)

We use Google Analytics 4 (Google LLC) for audience measurement. This may include page views, sessions, approximate geography, device/browser summaries, and traffic sources. Google processes data according to its own policies.

Google Signals and demographics

Where enabled in GA4, Google Signals may allow demographic and interest reporting for signed-in Google users and use Google identity signals for cross-device insights. Processing follows Google's eligibility and aggregation rules.

Cookies and storage

Cookies and similar storage may be used for measurement and, if you consent, advertising-related features. For example, Google Analytics may set identifiers such as _ga and _gid. This site loads GA via gtag.js and aims to follow Google Consent Mode v2; denied storage types remain off by default.

Name	Purpose	Duration	Provider
`_ga`	Anonymous user distinction (GA4)	~2 years	Google LLC
`_ga_*`	GA4 session state (per property)	~2 years	Google LLC
`bk_ga_consent_v1`	Stores your cookie preference locally	localStorage (until you clear it)	This site
`bk_consent_v1`	Stores server-side GA/cookie choice (bk_consent_v1 — strictly necessary)	~1 year	This site
`__cf_bm`	Cloudflare bot management (automated traffic filtering — strictly necessary)	~30 minutes	Cloudflare, Inc.
`cf_clearance`	Cloudflare security clearance record (after challenge)	~30 days – 1 year	Cloudflare, Inc.
`.AspNetCore.Antiforgery.*`	CSRF form protection token (strictly necessary)	Session	This site
`.AspNetCore.Culture`	Stores your preferred language (TR/EN/AR) — strictly necessary	~1 year	This site

Advertising data and personalization

With default consent, analytics and advertising storage may be enabled under Consent Mode (for example analytics_storage, ad_storage, ad_user_data, ad_personalization). If you use “Manage cookie preferences” and reject those categories, tags operate with denied storage and limited measurement behavior.

Purpose and legal basis for processing

Processing for site analytics and basic statistics relies on legitimate interest under GDPR Art. 6(1)(f) and KVKK Art. 5(2)(f). Storage for advertising and personalization is enabled only with your explicit consent under GDPR Art. 6(1)(a) and KVKK Art. 5(1); you can withdraw consent at any time via the "Manage cookie preferences" link at the bottom of any page.

Data retention

Google Analytics 4 event data is retained according to property-level settings (default maximum 14 months). Browser cookies are deleted according to their own lifetimes — for example _ga and _ga_* persist for about two years; the consent record (bk_ga_consent_v1) remains in local storage until you clear your browser or this site's site data. Messages sent through the contact form are processed for a reasonable time to respond, then deleted or anonymized.

International data transfers

Google Analytics infrastructure may be processed by Google LLC on servers in the United States and other countries. Such transfers occur under GDPR Art. 44+ and KVKK Art. 9, relying on Google's Standard Contractual Clauses and your explicit consent. Advertising-related storage is transferred only with consent; if you reject, tags operate in a restricted (cookieless) measurement mode.

Fonts and third-party CDNs

The site loads the Inter and Noto Sans Arabic typefaces from the Google Fonts CDN (fonts.googleapis.com, fonts.gstatic.com). During this request your IP address may be transmitted to Google LLC; per the Google Fonts privacy notice, no cookies are set and request logs are retained only for anonymous performance analysis. The site also uses Cloudflare for DDoS protection and content delivery; their respective privacy policies apply.

Your rights

Depending on applicable law (including GDPR where relevant), you may have rights such as access, rectification, erasure, or objection. Please reach us via our contact page.

IP address storage (site analytics)

The cookie bar is not shown by default; measurement and (where applicable) advertising storage default to granted, and you can open preferences via the “Manage cookie preferences” link in the footer and choose “Reject” to limit them. On the server-side analytics table (PageHits), your connection IP address (RawIp) is stored for every eligible request, together with a daily HMAC-SHA256 visitor digest (VisitorHash). If you choose “Reject”, Google Analytics storage categories move to “denied” under Consent Mode and the ConsentGranted field in the database reflects that rejection; the IP row is still retained for operations and security review. Stored IP addresses are kept for at most 90 days and then automatically deleted; you may request earlier deletion via the contact form.

Security logs (mandatory — no consent required)

To protect site security, requests indicating attack or malicious scanning activity (e.g. attempts to access secret files, SQL injection patterns, log4shell payloads, telltale signs of automated scanning tools) are logged with raw IP address, requested path, user-agent, geographic location (country/city/ASN/ISP), and classification. This processing relies on KVKK Art. 5(2)(f) legitimate interest (system security) and Art. 12 (data security obligation), and on GDPR Art. 6(1)(f) legitimate interest and Art. 32 security of processing — explicit consent is not required. IP addresses with a high threat score are automatically blocked for 24 hours; this block is enforced both at the application layer and at the network edge via the Cloudflare WAF (Web Application Firewall). Cloudflare, Inc. (USA) processes these security logs in its own infrastructure, which involves an international transfer of personal data (KVKK Art. 9 legitimate-interest exception, GDPR Art. 49(1)(f) legitimate interest). Security logs are retained for at most 90 days and then automatically deleted; they may be shared with judicial/legal authorities under Turkey's Law No. 5651 if requested. If you believe you are a legitimate user blocked from a banned IP, please reach us via the contact form.

Withdrawing consent

You can withdraw your cookie consent at any time via the "Manage cookie preferences" link at the bottom of any page or through your browser's privacy settings. Withdrawal affects future processing only; processing performed before withdrawal remains lawful. If you reject, analytics and advertising storage revert to "denied" under Consent Mode.