Privacy and Cookie Policy

Last Update: 26.10.2026

Umut GÜRLER İç Mimarlık (the "Company") treats the privacy of its customers, suppliers, and website visitors as a standing principle. This policy explains, under Turkish Law No. 6698 on the Protection of Personal Data, why data is processed, how the infrastructure is arranged, how cookies are used, and how to apply.

1. Categories of data

The following data is processed in order to provide our services, to keep the site secure, and to conduct corporate communication.

a. Website visits

  • IP address, browser type, operating system, and device information.
  • Date and time of the visit, pages viewed, referring address, and the cookie preference.

b. Contact and project enquiry form

Information you submit yourself through the contact form on the site is processed:

  • First name, surname, and gender.
  • Mobile telephone number, your message, and the SMS verification code sent for form security.

c. Customer, supplier, and representative records

The following records may be processed for contracts, project work, and invoicing:

  • Company name, tax office, tax number, address, and corporate contact details.
  • Signature circulars and authority documents.
  • The name, profession or title, and contact details of an authorised person or representative.

2. Purposes of processing

  • Service: Design, project documentation, contracting, and custom manufacturing.
  • Communication: Answering enquiries.
  • Financial and legal duties: Invoicing, collection, and retention required by law.
  • Notices: Newsletters, project announcements, and special-day greetings, where you have given permission to be contacted.
  • Security and measurement: Protection of the site and visit statistics according to the cookie permission you give.

3. Where Data is Stored, Infrastructure, and Security

We work with global technology leaders to provide world-class service in terms of data security, speed, and accessibility.

a. Server and Data Hosting (Amazon AWS)

The server infrastructure of our website is hosted in Germany (Frankfurt) data centers within Amazon AWS, which is fully compliant with European Union data protection laws (GDPR).

b. Security and CDN Services (Cloudflare)

Cloudflare, Inc. infrastructure is used to ensure the security of our website, prevent malware, and protect against DDoS attacks. Our site traffic is processed through Cloudflare's secure global network using End-to-End Encryption.

c. Data Security Commitment

Since Germany is subject to the European Union General Data Protection Regulation (GDPR) standards, your data is protected within the framework of international law rules. By using our services, you are deemed to have accepted the processing of your data on these providers due to technical necessities and security requirements.

4. Disclosure to third parties

Personal data is not sold for marketing. Disclosure is limited to the following cases:

  • Lawful requests of competent public authorities and of judicial or administrative bodies.
  • Hosting, security, SMS, and financial-advisory providers engaged so that the service can continue.
  • The measurement providers in section 5, where statistics or advertising permission is given in the cookie panel.

5. Cookies and similar technologies

A cookie is a small text file stored in the browser by the site. In addition to cookies, pixels that measure page interaction and the browser's own storage are used.

The cookie panel offers three options. Accept grants the statistics and advertising permissions together. Reject leaves non-essential records off. Settings lets you set the categories separately. A window through which you may change your preferences is available via the Cookie Settings link at the bottom of the page.

When you change your permission preferences, the page is refreshed and information is processed in accordance with your preferences.

a. Necessary records

These are required for the site to operate, for form security, and for the display preference. They do not depend on a statistics or advertising permission.

  • Cookie preference (user_consent): Stores your choice in the panel for one year.
  • Language suggestion (sn_lang_suggest_dismiss): Remembers for 180 days that you closed the language bar. It is not created if the bar is not shown.
  • Appearance (v2-theme-mode): Light or dark theme. This is not a cookie. It remains in browser storage until you delete it.
  • Instagram window (v2-ig-seen): A record that you viewed the window. It is not created if you do not open it. It remains in browser storage.
  • Form security (Cloudflare Turnstile): Distinguishes a real visitor from an automated submission on the contact form.

b. Statistics

Where the statistics permission is granted, Google Analytics 4 is activated. Page views, scrolling, outbound links, file downloads, form submissions, video, and on-site search are processed in this scope.

  • Analytics cookies (_ga and the session cookie): Used to tell browsers apart and to keep session statistics. The retention period published by Google is two years.
  • Google signals: These are enabled. For visitors who are signed in to a Google account with ad personalization turned on, cross-device statistics may be produced.
  • Form fields: Where the statistics permission has been granted, an email address, telephone number, or address entered on the page may be processed by the Google Analytics tag.

c. Advertising and campaign measurement

Where the advertising permission is granted, the tags of the platforms below are activated. If permission is not given, or if Reject is selected, these tags do not run. Accept grants the advertising permission together with statistics.

  • LinkedIn (bcookie, li_gc, lidc): Measurement of corporate campaign interaction. The period is set by the provider.
  • TikTok (_ttp, _tt_enable_cookie, ttcsid): Measurement of visual campaign performance. The period is set by the provider.
  • OpenAI (__obref): Measurement of visits that arrive from advertising and referral links. OpenAI's documentation states a period of 365 days. If the link carries no special mark, the second cookie is not written.

The Company reserves the right to change these providers or to add new ones as measurement needs require. Any change is reflected on this page.

  • YouTube: Presentation videos are served from the youtube-nocookie address until playback starts. A YouTube cookie is not written before playback starts.
  • Social icons: The icons at the bottom of the page are links to corporate profiles. They do not contain a measurement pixel.

6. Rights under the data protection law, and contact preferences

Under Article 11 of Law No. 6698, as the data subject you have the right to:

  • Learn whether your personal data is processed and, if it is, to request information.
  • Learn the purpose of processing and whether the data is used in line with that purpose.
  • Know the third parties to whom the data is transferred, in Turkey or abroad.
  • Request correction if the data is incomplete or inaccurate.
  • Request deletion or destruction under the conditions set out in the law.
  • Object to a result against you that arises from analysis by automated systems.
  • Claim compensation if you suffer damage from unlawful processing.

Further detail is on the clarification text page.

If you do not wish to receive marketing e-mails or greeting messages, you may use the Unsubscribe link at the bottom of the message. To stop marketing and greeting SMS messages, reply RET as stated in the Sms Iptal notice at the end of the message.

7. Contact

For applications concerning this policy and the processing of your personal data: