Privacy Notice

This notice explains which personal data are processed when you visit this website, operated by Demirdağ Siber, for what purpose, on what legal basis and for how long. A web application security layer (WAF / bot detection) called SİPER runs in front of the site; the processing described below belongs to that layer.

This is an English translation. The Turkish text below is the binding version under Turkish law.

1. Data controller

The data controller is Demirdağ Siber. For any question or request about this notice: iletisim@demirdagsiber.com

2. Personal data processed

Your IP address is personal data. On every HTTP request to this site the security layer processes the following:

• Network identity: IP address, TLS handshake fingerprint (JA4) and connection metadata.
• Request headers: browser identity (User-Agent), accepted languages and content types, header order and protocol (HTTP/1.1 or HTTP/2) characteristics, the requested address and a timestamp.
• Browser verification telemetry: technical measurements produced in your browser by the verification page shown on your first visit (timing, rendering and API consistency) that tell automation tools apart. They are used to confirm that the request comes from a human-operated browser, not to identify your device.
• Technical cookies: short-lived, signed cookies prefixed siper_ that carry the verification result (siper_pass_g1, siper_pass_g2, siper_verified, siper_sid). These are strictly necessary security cookies; no advertising, analytics or third-party tracking cookies are used.

This site collects no name, e-mail address or form data from visitors. Contact happens only through an e-mail you choose to send, and that e-mail is used solely to reply to you.

3. Purpose of processing

The data above are processed for one purpose only: securing this site and the systems behind it. This covers:

• detecting and blocking automation tools and malicious bots,
• limiting application-layer DDoS and abuse (excessive request) attempts,
• recording and investigating security incidents and, where required, reporting them to the competent authorities.

The data are not processed for marketing, profiling or behavioural advertising, and are not transferred to any third party for those purposes.

4. Legal basis

Processing relies on Article 5/2(f) of Law No. 6698 — processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject — and on Article 5/2(a), being expressly provided for by law (obligations under Law No. 5651). Explicit consent is not sought for security data; the security layer cannot be switched off, because doing so would leave the site itself and its other visitors unprotected.

5. Retention period

• Live request records are held in the security layer’s memory, are never written to disk and are deleted when the process restarts.
• Security incident records are created only for requests that need attention and are written to the disk of the server that runs the security layer. In these records the IP address appears not in raw form but as a salted hash, and records are kept for at most 24 hours (SIPER_INCIDENT_TTL=24h). A record that expires or exceeds the capacity limit is deleted automatically within a few minutes at most, whether or not there is traffic.

6. Place of processing, hosting provider and Law No. 5651

The security layer (SİPER) is operated by the data controller on Amazon Web Services infrastructure, on a server in Frankfurt (eu-central-1), Germany. The data listed in section 2 are therefore processed outside Turkey (within the European Union). This processing falls under Article 9 of Law No. 6698, and the infrastructure provider acts as a data processor on the data controller’s instructions.

The site’s content is hosted by TurkTicaret. Under Law No. 5651 on the Regulation of Publications on the Internet, the hosting provider must keep traffic information about its service for the period set in Article 5 of that Law (not less than one year and not more than two). That obligation belongs to the hosting provider, is independent of the security layer above and does not extend our 24 hours retention limit; the hosting provider’s own records are subject to its own notice obligations. Demirdağ Siber is the content provider for this site.

7. Transfers

Your personal data are transferred only upon a duly made request from legally authorised public institutions, and only within the scope of that request. Apart from the place of processing described in section 6, they are not transferred to any third party. In the default configuration the security layer sends no data to any external service; if the optional alert channel is enabled, only summary alert texts without personal data are sent, and raw IP addresses are never sent.

8. Your rights (Article 11 of the Law)

By applying to the data controller you have the right to:

1. learn whether your personal data are processed,
2. request information about that processing,
3. learn the purpose of processing and whether the data are used accordingly,
4. know the third parties in Turkey or abroad to whom the data are transferred,
5. request correction of incomplete or inaccurate data,
6. request erasure or destruction under the conditions of Article 7 of the Law,
7. request that correction, erasure and destruction be notified to the third parties to whom the data were transferred,
8. object to an outcome against you that results exclusively from analysis by automated systems,
9. claim compensation if you suffer damage from unlawful processing.

Requests are made to iletisim@demirdagsiber.com and are concluded free of charge within thirty days at the latest. Because security records keep the IP address only as a hash and delete it within 24 hours, it is in most cases technically impossible to verify whether a past request was yours; in that case your request is answered on that basis.

9. Changes

This notice is updated whenever the data processed by the security layer or the retention period change. The retention period is read from the same source as the system’s configuration value; any difference between the period stated here and the live configuration is treated as a defect.

Last updated: 26 September 2026