Privacy & cookies

1. In short

On this site, visit measurement (Google Analytics 4) runs only if you allow it; that is why your choice is asked on your first visit. If you do not allow it, the measurement code is not loaded, no measurement cookie is written and no measurement request is sent to Google Analytics. There is no advertising, remarketing or profiling tag.

This site embeds no third-party content: no video player, no map, no social widget and no external font or script service (§4). The server's technical logs (§5) are kept regardless of your choice. You can change your decision at any time using the Privacy choices control at the bottom of every page.

2. Data controller

The data controller for this website is GalataAssets (galataassets.com) — the party that operates this site and decides for what purpose and by what means personal data is processed here. This section informs you under KVKK art. 10.

Stated openly — partial compliance. “GalataAssets” is a brand name; in the sense of KVKK art. 3/1(ı) it is neither a natural nor a legal person. The identity element of art. 10 is therefore not fully satisfied by this text. A verified trade name, registration or MERSİS number and registered address are not published on this site, and none has been invented here — no guessed or fabricated information is used. This text does not claim full legal compliance; this section will be updated once the gap is closed.

You may send requests and applications under the KVKK to info@galataassets.com — your application is answered within 30 days at the latest under KVKK art. 13 (details in §9).

The most frequently needed right — withdrawing your permission — requires no application at all: the Privacy choices control at the bottom of every page switches measurement off immediately, and the measurement cookies are deleted.

3. Cookies and similar technologies

If you allow it, first-party measurement cookies are used for Google Analytics 4: _ga and _ga_FT50XL4P2Y. Their lifetime is 90 days — this is not a legal limit but our voluntary data-minimisation choice; the period is not restarted on each visit. If you do not allow it, these cookies are not written and no measurement request is sent to Google Analytics; the default state is declined. Measurement ID: G-FT50XL4P2Y.

Advertising personalisation and Google signals are switched off in code. Google's “Consent Mode – denied” state is not used: in that mode a request would still reach Google for a visitor who declined, so on this site measurement is simply not loaded until you allow it.

Measurement data is not anonymous; it is pseudonymous. Google Analytics assigns your browser a random client identifier, and that data is legally regarded as pseudonymous. Your identity is never requested and no name-level profile of you is built.

What is measured — including Enhanced Measurement

Google Analytics 4's “Enhanced measurement” feature is on by default, so measurement is not limited to page views. When you allow it, the following are counted:

• page views;
• first visit and session start;
• engagement time;
• reaching about 90% of the page (scroll depth);
• outbound link clicks — the external destinations on this site are tugravarlik.com, varlikalsat.com, vatanseverbilisim.com, pagespeed.web.dev and, on this page, kvkk.gov.tr and tools.google.com (six external domains in total);
• file downloads — the three brand-kit archives on the Brand resources page.

This site has no search box and no embedded video, so site-search and video events never occur.

The record of your choice

Your choice — your decision, the date it was made, its expiry date and the consent-scope version — is stored in this browser for 12 months in a local record that is not a cookie and is never sent to a server.

Field	Value
Technical record name	ga-riza
Location	Your browser's localStorage area (on this device only)
Contents	measurement decision (allowed / not allowed), decision date, expiry date, consent-scope version (analytics-scope-01)
Lifetime	12 months — allowing and not allowing are stored for the same period. When it expires you are asked again; if you delete it, or your browser clears site data, the record is gone.

Wording, design or explanation updates do not reset your choice. You are asked again only if the scope of measurement expands materially: a new provider, a new data category, a new recipient, a new purpose, advertising or Google signals, matching with a user identifier, cross-site tracking, or a significant extension of the retention periods.

The galataassets-consent record left by this site's previous consent layer is deleted once from your browser the first time the new version runs, so two separate records do not remain on your device.

4. Third-party embedded content

This site embeds no third-party content: there is no iframe, no video player, no map, no social widget, no external font service and no content-delivery network. The typefaces are served from this site's own server. When a page opens, this site's own code makes no request to any third party — the only exception is Google Analytics, and only if you have allowed measurement (§3).

Links to other sites (§3) are ordinary links: nothing is requested from the linked site unless you click. Once a link opens you have left this website, and the data processing, cookie and privacy practices of the site you reach are governed by its own published texts.

5. Server access and security logs

When the site is accessed, standard technical information such as IP address, access time, requested page, browser or device information and server response code may be processed on the hosting infrastructure in order to serve the website and keep it secure. These records are not used for advertising or marketing, no behavioural user profile is built from them, and they are not fed into a separate visit-measurement system.

No additional aggregated visit counting is carried out on the server logs. If such counting is ever introduced, a written legitimate-interest balancing test will be prepared first and this text updated beforehand.

Stated plainly, not yet verified: the hosting provider's full legal name, the actual retention period of the server logs, and the country or countries in which those logs are processed have not been verified by us. Until these three facts are verified this section is not considered complete; uncertain information is not written here by guesswork and will be added once verified.

6. Purposes of processing and their legal bases

• Visit measurement (only with your permission): understanding which content is of interest and improving the site — legal basis: explicit consent (KVKK art. 5/1).
• Correspondence about enquiries and applications: if you write to the address above, your email address and message are processed solely in order to reply to you — legal basis: legitimate interest (KVKK art. 5/2-f).
• Server access and security logs: operating the site, ensuring information and system security, detecting faults and outages, preventing unauthorised access — legal basis: legal obligation (KVKK art. 5/2-a) and the applicable legislation.

Legitimate interest is not claimed for measurement. These three activities rest on different legal bases and do not substitute for one another. This site is a static publication: there is no membership, account, form, comment, payment or order function.

7. Transfers abroad (KVKK art. 9)

If you allow measurement, your visit data is transferred to Google (Google Ireland Ltd. / Google LLC) and may be processed outside Türkiye on Google's infrastructure. The legal basis for this transfer is your explicit consent.

We state this openly: this transfer is regular in nature, and the Law additionally requires an appropriate safeguard for regular transfers (for example the Board's standard contract); no such contract has been concluded with Google. The site owner has chosen to run measurement on the basis of explicit consent while this gap persists. This text therefore does not claim full legal compliance. If you do not allow it, no transfer takes place.

The server access logs are a separate flow and are not part of the measurement transfer described above. For those logs, the recipient's legal name, the country in which they are processed and any cross-border transfer mechanism are not stated in this text; these three facts have not been verified by us and have not been written by guesswork (§5).

8. Retention periods

• Measurement cookies (_ga, _ga_FT50XL4P2Y): 90 days (voluntary minimisation).
• User- and event-level data on Google Analytics servers: 2 months — this is GA4's default setting and it has not been increased.
• Consent record (ga-riza): 12 months.
• Server access and security logs: the period is set by the hosting provider; the actual period has not yet been verified by us (§5).
• Correspondence relating to KVKK applications: for the periods required by the applicable legislation and for possible disputes.

9. Your rights under the KVKK

Under art. 11 of Law No. 6698 you have the right to: learn whether your personal data are processed; request information if they have been processed; learn the purpose of processing and whether the data are used in accordance with that purpose; know the third parties to whom the data are transferred in Türkiye or abroad; request rectification if the data are incomplete or incorrectly processed; request erasure or destruction where the statutory conditions are met; request that rectification and erasure be notified to the parties to whom the data were transferred; object to a result that arises against you exclusively from automated analysis; and claim compensation if you suffer damage due to unlawful processing.

You may withdraw the permission you gave for measurement at any time, without giving a reason, using the Privacy choices control at the bottom of every page; when you withdraw it the measurement cookies are deleted and no new measurement request is sent to Google Analytics.

Send applications to info@galataassets.com; they are answered within 30 days at the latest (KVKK art. 13). If your application is refused, answered inadequately or not answered in time, you may lodge a complaint with the Turkish Personal Data Protection Board: kvkk.gov.tr. If you are visiting from the European Economic Area or the United Kingdom you may also complain to the data-protection authority of your own country under GDPR art. 77.

10. How the privacy choices work

On your first visit three equal options are offered: Allow measurement · Continue without measurement · Review settings. The default state is declined; no measurement request is sent to Google Analytics before you allow it. In the “Review settings” panel the measurement category is not pre-ticked; you confirm your choice with Save choice and step back with Back.

If your browser blocks local storage (private mode and similar), your choice cannot be recorded in a verifiable way, so measurement is never started and you are told this on screen.

If a page of this site is displayed inside a frame (iframe) on another site, the consent banner is not shown there and measurement never starts in that framed view — even if you previously allowed measurement.

Other ways to turn measurement off:

1. The panel on this site (recommended and primary route): the Privacy choices control at the bottom of every page.
2. Browser settings: you can delete or block cookies and site data in your browser.
3. Google's add-on: tools.google.com/dlpage/gaoptout disables Google Analytics measurement browser-wide.

11. Changes

When this text is updated, the last updated date above changes. Wording and explanation corrections do not reset your choice. If the scope of measurement expands materially (the cases listed in §3) the consent-scope version is raised, your stored choice is treated as invalid and the choice banner is shown again. This is not merely a promise — it is a rule enforced by the software.

Legal & scope