Privacy & cookies

Who is responsible

Data controller: GalataAssets (galataassets.com) — the party that operates this website and decides for what purpose and by what means personal data is processed here. This section informs you under KVKK art. 10.

Requests under KVKK art. 11 — access, correction, deletion, objection, withdrawal of consent — reach us at info@tugravarlik.com and are answered within 30 days as KVKK art. 13 requires. The most common request, withdrawing consent, needs no application at all: the “Measurement preferences” control in the footer of every page stops measurement immediately and deletes the analytics cookies.

Known limitation, stated rather than hidden. KVKK art. 3/1(ı) defines a data controller as a natural or legal person. “GalataAssets” is a brand name and is neither, so this line improves transparency but does not fully satisfy the identity element of art. 10. A registered legal identity (trade name, registration number, address, VERBİS entry) has not been invented here; it will be published once verified, and the consent text version raised at that time.

Measurement is off until you accept

This site uses Google Analytics 4 (measurement ID G-FT50XL4P2Y) to measure how the site is used. It is disabled by default. Until you press “Accept measurement”:

• no request is made to googletagmanager.com or to any Google server;
• no analytics cookie is written;
• nothing about your visit reaches Google.

What we cannot promise for that same moment is that nothing at all leaves your browser: our hosting provider injects its own traffic script into every page it serves, outside our control. That is set out under “A cookie we do not control” below.

Declining is exactly as easy as accepting: both choices are identical buttons, nothing is pre-selected, and closing or ignoring the notice is not treated as consent. We do not use Google Consent Mode's “denied” state, because in that mode a request would still reach Google before you decide.

What is measured, and what is not

If you accept, Google Analytics records page views: the page address and title, the referring page, an approximate location derived from your IP address at country or city level, and general device and browser type.

Google Analytics 4 also has “Enhanced measurement” switched on by default, so on this site it additionally records:

• Outbound link clicks — this site links out to four external destinations (tugravarlik.com, varlikalsat.com, vatanseverbilisim.com and pagespeed.web.dev), and clicking any of them is recorded as an event;
• File downloads — the three brand-kit archives on the Brand resources page;
• Scroll depth — when you reach the bottom of a page.

Site-search and video events are part of the same feature but never fire here, because this site has neither a search box nor embedded video.

Measurement is pseudonymous, not anonymous. Google Analytics assigns a random identifier to your browser and stores it in the _ga cookie, so repeat visits from the same browser are recognised as the same visitor. Your identity is never requested, and Google Signals and advertising personalisation are switched off in code — but calling this “anonymous” would overstate it.

We do not use advertising, remarketing or conversion tags, and we build no advertising or interest profile of you. Google Analytics does keep a per-browser record so that repeat visits are recognised, as described above; we do not enrich that record, combine it with any other source, or sell or share it with anyone other than the processor named below.

Cookies

Before consent no measurement cookie is set by this site and nothing reaches Google. If you accept measurement, Google Analytics sets:

Name	Purpose	Typical lifetime
_ga	Distinguishes one browser from another	up to 2 years
_ga_FT50XL4P2Y	Keeps session state for this property	up to 2 years

These are the only cookies this website's own code causes to be set.

A cookie we do not control

Our hosting provider injects its own traffic script (img1.wsimg.com/traffic-assets/js/tccl.min.js) into every page it serves, and that script sets its own cookies — typically _tccl_visitor, _tccl_visit and _scc_session — without asking for consent.

This script is not part of the published site package, it is added by the server after our files leave our hands, and the consent gate on this page cannot block it. We state it here rather than claim a cleanliness we cannot deliver. Removal has been requested from the hosting provider; until then, blocking it requires a browser-side content blocker.

Your consent record

Your choice is kept in your own browser using localStorage under the key galataassets-consent. It is not a cookie and is never transmitted to us or to anyone else. The record holds three things: your decision, the date and time you made it, and the version of this text you were shown. It stays until you change it or clear your browser storage. If your browser blocks site storage — in private mode, for example — we say so, and measurement stays off.

Transfer to Google, including outside Türkiye

If you accept, measurement data is transmitted to Google acting as our processor, and may be stored and processed on servers outside Türkiye, including in countries whose data-protection regime differs from Turkish law. Under KVKK this is a cross-border transfer, and it rests on your explicit consent.

Open point: the Board-approved standard contract for continuous transfer under KVKK art. 9 has not been completed. Until it is, your explicit consent is the only basis relied on, and you can withdraw it at any time.

How long measurement data is kept

Google Analytics retains user- and event-level data for a limited period configured in the property; ours is set to at most 14 months, after which those records are deleted automatically. Aggregated reports may persist longer in Google's systems. Your consent record in this browser lasts 12 months, after which you are asked again.

Aggregated counting from server logs

Separately from Google Analytics, we produce an aggregated count from the access records the web server keeps anyway: how many pages were viewed per day, roughly how many distinct visitors that represents, which pages were read most, and which external sites linked here.

Why this does not ask for consent. It reads records the server already holds. Nothing is written to your device and nothing is read from it, so it falls outside the rules that govern cookies and similar storage. Because an IP address is personal data, the processing rests on our legitimate interest (KVKK art. 5/2-f) in knowing whether the site is read at all.

In plain terms: if you decline measurement or choose “Essential only”, a server record of your visit still exists and you are still included in this aggregated count. That does not mean data goes to Google — it does not. Nothing about your visit reaches Google unless you accept.

What is kept and what is not. The report contains no IP addresses. To count a visitor once per day without identifying anyone, the address and browser string are hashed with a random value that is generated fresh on every run and never saved, so the finished report cannot be traced back to a person. Automated crawlers are filtered out, no per-person profile is built, and nothing is combined with data from other sites.

The retention period for the raw server logs themselves is set by the hosting provider as part of its own legal obligations, not by us.

Legal bases are separate

• Measurement data — your explicit consent. Withdrawing it stops all measurement.
• Messages you send by email — legitimate interest in answering you.
• Server access logs kept by the hosting provider — legal obligation and security.
• Aggregated counting derived from those logs — legitimate interest (KVKK art. 5/2-f). No consent is required and declining measurement does not remove you from it.

These are not merged into one basis; withdrawing consent for measurement does not affect the other two.

How to turn measurement off

1. Use the preference panel on this site — the “Measurement preferences” control in the footer of every page. This is the primary route: declining there stops measurement immediately and deletes the _ga cookies.
2. Your browser's cookie and site-data settings.
3. Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

Your rights

Under KVKK art. 11 and, where it applies to you, the GDPR, you may ask what data relates to you, request correction or deletion, object to processing, and withdraw consent. Withdrawal takes effect from the moment you make it and does not affect processing already carried out.

Requests reach us at info@tugravarlik.com, and we answer within 30 days as KVKK art. 13 requires.

You also have the right to complain to a supervisory authority. In Türkiye this is the Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr). If you are in the European Economic Area or the United Kingdom, you may instead complain to your own national data-protection authority.

Changes

If measurement, cookies or transfers change, this page and the consent text version are updated in the same release as the code — the site never runs measurement that this page does not describe. The consent text version currently in force is 2026-08-21. Your stored choice is tied to this version: if the text changes, you are asked again rather than being held to a decision you made about different wording.

Legal & scope