Controller and contact
I, Ali Cem Bozma, run this site under the Grafikcem name. Where I process personal data through the site, I am the data controller.
You can send questions about your personal data or this notice to [email protected].
Information in a project enquiry
The contact form asks for your name, email address, optional brand or company name, type of need, target timeframe, optional budget and currency, optional reference link, and message. The form language, source page and enquiry context are also recorded; the subject line is generated on the server from these details.
I use this information to read your enquiry, assess the need and possible scope, reply to you, prevent the same enquiry being submitted again within a short period, and limit abuse. I do not add enquiry details to a marketing list.
Do not put health data, identity numbers, passwords or other sensitive information in the free-text field; the form does not ask for them.
When you submit the form, your enquiry is saved in the site's database and an email notification is sent to me. These are separate steps: a saved enquiry does not mean the notification has been delivered.
Resource access and email preferences
When you ask for a resource or sign up for the newsletter, the flow records your email address, selected language, requested resource or campaign, and the version of the notice shown to you. A one-use link is sent to your address so you can confirm newsletter membership; the raw verification token is not written to the record.
Resource delivery and marketing email are separate choices. The marketing box starts empty; if you select it, the preference is recorded as a separate consent event. You can later withdraw the preference through the unsubscribe route in an email.
The resource opens right after you enter your email address. You join the newsletter only if you confirm through the link in the email; without that confirmation, no announcement emails are sent.
Technical security and operational records
The forms use required-field validation, an invisible field that separates automated submissions, rate limits and duplicate checks. The duplicate check creates a one-way digest from the email address and enquiry fields; the message cannot be recovered from that digest.
Request origin is used for rate limiting. Application logs do not write the enquirer's name, email address or message body.
Requests to the site pass through Cloudflare's security layer and then the server the site runs on. Both may create standard access logs, such as IP address, browser details and the requested address. Their scope and lifetime follow the hosting configuration and applicable security obligations.
Google Maps, review summary and appointment link
The map on the contact page is the site's own drawing; it does not load from Google, and no request is sent to Google when the page opens.
If you follow the page's "Open in Google Maps" link, Google Maps opens in a new tab. Google handles data and storage in that tab under its own terms.
The 5.0 rating and review count on the site are a summary observed on the Google business record on 19 September 2026; they are not fetched live when the page opens. This observation does not re-verify the authors or text of individual reviews recorded earlier.
Once appointments are enabled, the site will use an external link to a separate Google scheduling page, with no form or embedded calendar on this site. No appointment details leave the site until you follow the link. Information you provide on Google's page is governed by Google's notices.
Purposes and legal bases
Project enquiries and delivery of a resource you request are processed to take steps at your request and carry out the requested action. Security, duplicate and abuse checks protect the site and its enquiry routes.
Marketing email is enabled only by a separate optional choice. When you withdraw it, I stop using the preference for new marketing messages; the opt-out record may remain so that I can carry out the request and avoid adding you again.
Steps taken at your request and performance of an established relationship are assessed under the grounds directly related to establishing or performing a contract; site and enquiry security under legitimate interests where your fundamental rights are not harmed; and marketing preference under explicit consent.
Service providers and international transfers
I run the site with the service providers below. Each one accesses data only for the work it performs.
Hostingdünyam: the virtual server (VDS) in Türkiye that the site runs on.
Cloudflare: domain name system (DNS), content delivery (CDN) and security layer. Requests to the site pass through it first.
Supabase: database, sign-in and file storage. Enquiry, subscriber and consent records, Learn accounts and resource files are kept here.
Resend: transactional email such as verification, notification and account emails, and announcement emails if you opted in.
Some of these providers' systems may be located outside Türkiye, so part of the data may be processed abroad. This is a cross-border transfer under Article 9 of the Turkish Data Protection Law (KVKK) and is made only when an applicable condition and safeguard under that article is in place.
When you open a Google link, information may also reach systems outside Türkiye.
Retention and deletion
A verification link works for 48 hours, an email-preference unsubscribe link for 180 days, and the resource-access cookie for 24 hours after the request or confirmation. These are link and cookie lifetimes, not the retention periods for enquiry or consent records.
Enquiry, subscriber, consent-event, email-job and security records are kept only as long as their purpose and applicable obligations require, then erased, destroyed or anonymised.
Cookies and browser storage
On an ordinary page visit the site sets no cookie of its own, and no analytics or advertising cookie is used at all. Technical cookies are written only when you use a feature such as resource access, a Learn account or password recovery. What you type into the contact form is kept only in that tab's temporary storage, so it is not lost when you switch language.
Cookie names, purposes and lifetimes are described in the separate Cookies and Browser Storage notice.
Your rights and how to make a request
Under Article 11 of the Turkish Data Protection Law, you may ask whether your personal data is processed; request information; learn the purpose and whether it is used accordingly; know the recipients; request correction, erasure or destruction where the conditions apply and notification of those actions to recipients; object to a result against you based solely on automated analysis; and seek compensation for damage caused by unlawful processing.
Send your request to [email protected]. I may ask for information proportionate to the request so that I can verify your identity.
Updates and language versions
This notice was updated on 12 October 2026. If the data flow or providers change, the notice will be updated before the new processing goes live.
The Turkish and English versions describe the same flows. If their meaning differs, the Turkish text governs.