Scope and site owner
This is a personal profile, technical journal and contact website operated individually by İsa Öztürk. Its configured website address is https://isaozturk.com. It is not presented as an official communication channel of an employer, client or other organisation.
This policy explains how information about visitors, people who make contact and authorised administration users is handled. The Personal Data Notice separately describes processing purposes, legal grounds and rights under Turkish Law No. 6698 (KVKK). Visiting the website is not treated as blanket consent to every form of processing.
Privacy and personal data request contact: bilgi@isaozturk.com. This channel is used to assess and respond to requests.
Information you provide
When the contact feature is enabled, it collects your name, email address, selected subject and message. Please do not send identity documents, health information, financial records, passwords, access keys or confidential workplace documents that are unnecessary for the conversation. If you need to share information about another person, ensure that you are authorised to do so. Contact messages are not published publicly or turned into visitor comments.
Administration is limited to authorised accounts. An account may have an email address, display name, role, status and access-related records. Passwords should not be stored in readable form; sessions are time-limited and permissions should reflect the task. When invitations or password recovery are enabled, their links are used for the relevant account operation.
Technical records and security
Request times, requested resources, error codes, session information and necessary technical connection data may be processed to deliver the website, investigate errors and limit misuse. These records are not used to build general visitor advertising profiles. Data minimisation applies to security information, and routine error logs should not contain message bodies or service passwords.
Absolute security cannot be promised for internet communication. Access control, updates, secure transport, logging and backups must be considered together. If a security incident is identified, its scope is assessed, protective steps are taken and any legally required notifications are considered.
Email, hosting and service providers
If email delivery is enabled for contact notifications, invitations or password recovery, the configured Resend or SMTP provider may process sender and recipient addresses and information necessary for delivery. Notifications should avoid unnecessary personal data. A contact message does not subscribe you to a newsletter or authorise marketing messages.
Hosting may use Cloudflare or a Docker/Dokploy environment selected by the site owner. The actual providers and their locations depend on the deployed configuration. A provider causing processing or access outside Türkiye requires assessment of the applicable transfer mechanism under Article 9 of KVKK. Publishing this policy does not establish that the necessary contracts have been signed or transfer conditions automatically met.
Cookies, external links and the technology radar
Advertising and behavioural tracking tools are not enabled by default. Necessary administration session functions and local preference records are explained in the Cookie Policy. If a consent-based analytics or third-party feature is added, it must not run before the appropriate notice and choice mechanism are in place.
GitHub, LinkedIn and other social profiles are presented as ordinary outbound links. Linking a profile does not itself embed the platform's tracking plugin. Once you follow a link, the destination service applies its own rules. The technology radar displays information such as source names, headlines, dates and original links. It does not automatically republish full articles or send visitor information to those sources merely because the listing is displayed; following an outbound link is a separate action.
Retention, deletion and backups
The configured ordinary retention target for general contact records is 180 days, and 30 days for security and error records. These are not unconditional statutory retention periods for every type of information. An ongoing conversation, protection of rights or an applicable legal duty may justify retaining a limited relevant record for longer. When the need ends, deletion, destruction or genuine anonymisation is considered.
If backups are created, access and retention of those copies must also be limited. Deletion records and restore procedures should prevent removed information from returning to routine use when an older backup is restored. Removing a message from the main system does not mean every retained backup is physically rewritten at the same moment. Backups are not a source for ordinary browsing or use for new purposes.
Your choices and policy updates
You can submit information, correction and other requests using the procedure on the Personal Data Requests page. Cookie preferences can be changed from the footer. This policy is updated if new purposes or providers affect its explanations, with additional notice before processing where required. Continued website use is not treated as consent for a new purpose requiring a separate choice.
Last updated: 4 November 2026.