Privacy Policy

1. Controller

Muhammed Talha Aslan (sole proprietor, Türkiye)
Address: Barbaros Mah. Begonya Sk. Nidakule Ataşehir Batı No:1 İç Kapı No:2, Ataşehir / Istanbul, Türkiye
E-mail: info@talhaaslan.com · Phone: +90 507 992 55 95

Where this policy says "we" or "us", it means Muhammed Talha Aslan and the team working under his responsibility. The controller within the meaning of Art. 4(7) GDPR is the natural person named above. Company details are set out in the Legal Notice.

2. Overview

talhaaslan.com is the website of a digital marketing business (consulting, web design, advertising) serving clients worldwide, including the EU/EEA, the United Kingdom and the United States. Personal data is processed only for the purposes described below:

• operating the website securely (server logs, session cookie);
• answering requests sent through the contact form and the quote wizard, and preparing quotes;
• concluding and performing contracts, taking payments and issuing invoices;
• measuring the results of our Google Ads campaigns, only with your consent;
• anonymous first-party page statistics;
• running the free online tools you choose to use.

We do not run a newsletter, we do not use Google Analytics, the Meta pixel or any other third-party tracker, and we do not sell personal data.

3. Hosting and server logs

The website runs on a server located in France (OVH data centre, EU). The server is operated for us by a hosting provider established in Türkiye, which acts as our processor and on our instructions. Form submissions and orders are stored in the administration database on the same server. E-mails from the site are sent from this server; no third-party mailing service is involved.

When you visit the site, the hosting provider's usual server log files record technical data such as your IP address, the requested URL, date and time, HTTP status, browser type and referring page. These logs are used to keep the site secure and stable and to investigate abuse; they are kept briefly for that purpose. Legal basis: our legitimate interest in the security and availability of the website (Art. 6(1)(f) GDPR).

4. Contact form and quote wizard

When you use the contact form or the quote wizard, we process the data you enter: name, e-mail address, phone number, company or website, your message, the services you select and service-specific details you provide (for example an Instagram username, a Google Business Profile link or trademark details). Purpose: answering your request, preparing a quote and taking the steps you ask for before a contract is concluded. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request); where you contact us without a contract in view, our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR).

Your request is kept while it is being handled and then for up to 3 years for follow-up questions and as evidence of our correspondence, unless a contract follows (see section 12). For the Google review removal, Instagram account recovery and Instagram username services, case files (screenshots, evidence, report documents) are deleted 30 days after the case is closed. We never ask for copies of identity documents or for account passwords.

5. Orders, payment and invoicing

Payments are processed by iyzico Ödeme Hizmetleri A.Ş., Istanbul, Türkiye, a licensed payment institution. Cards are charged with 3D Secure in TRY, USD or EUR; bank transfer is also possible. Payment links are created individually for each order. Card data is entered on iyzico's secure payment page; we never see or store your card details. iyzico processes your payment data under its own responsibility as a payment service provider; its privacy notice is available on its website.

For each order we process your name (or company name), billing address, contact details, the service ordered, the amount and the payment status, and we issue a Turkish e-invoice. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (Turkish tax and commercial bookkeeping obligations). Consumer terms are set out in the Distance Sales Agreement and the Delivery & Refund Terms.

6. Google Ads conversion tracking (with your consent)

We advertise on Google Ads and use Google Ads conversion tracking (tag ID AW-11048847422) to find out whether an ad click led to a lead form submission or a purchase. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for visitors from the EEA and the UK; otherwise Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The tag runs in Google Consent Mode. Its default state on this site is "denied": the Google script is not even loaded, no advertising cookies are set and no conversion events are sent until you accept them in the cookie banner. Only after you consent does Google set cookies such as _gcl_au and receive conversion events (lead form, purchase) together with technical data such as your IP address and browser information. Google may transfer this data to servers in the USA; Google LLC is certified under the EU-US Data Privacy Framework and uses the European Commission's standard contractual clauses for other transfers.

Legal basis: your consent (Art. 6(1)(a) GDPR, and, for storing and reading information on your device, the national rules implementing Art. 5(3) of the ePrivacy Directive). You can withdraw your consent at any time with effect for the future through the "Cookie settings" link in the footer, which reopens the banner. Your choice is stored in your browser (localStorage key ta_consent) for 12 months. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

7. First-party page statistics

To understand which pages are read and where visitors come from, the site sends a small request to our own endpoint (/api/hit.php) on each page view. It records the page path, the referrer, the UTM source of a campaign link and the device class (desktop or mobile). No cookies are used. Your IP address is not stored; it is replaced by a hash computed with a salt that changes daily, so that no person can be identified and visits cannot be linked across days. Legal basis: our legitimate interest in measuring the use of our own website (Art. 6(1)(f) GDPR). The data does not leave our server.

8. Cookies and local storage

The site uses only the following cookies and browser storage entries:

Name	Type	Purpose	Duration
Session cookie	Strictly necessary	Protects the forms against cross-site request forgery (CSRF) and keeps your form session working.	Until you close your browser
ta_theme	Strictly necessary (localStorage)	Remembers your light or dark display preference.	Until you delete it
ta_consent	Strictly necessary (localStorage)	Stores your cookie banner choice so that it is not asked again.	12 months
_gcl_au and related Google cookies	Advertising, only after consent	Google Ads conversion tracking (section 6).	Set by Google; _gcl_au currently 90 days

Strictly necessary entries are used on the basis of our legitimate interest in a functioning website (Art. 6(1)(f) GDPR) and are exempt from the consent requirement. You can delete cookies and local storage at any time through your browser settings; the site remains usable, although your theme and cookie choice will be asked again.

The Poppins web font is served from our own server; no connection to Google Fonts is made. We embed no videos. The contact page offers a Google Maps map (Google Ireland Limited) that loads only after you click "Load map"; only then are your IP address and browser data sent to Google, possibly including the USA (Google LLC, EU-US Data Privacy Framework). Legal basis: your consent given by that click (Art. 6(1)(a) GDPR). Without the click the map stays a static placeholder with a link to Google Maps. The WhatsApp (wa.me, a service of Meta Platforms Ireland Limited) and phone buttons are plain links: no data is shared with WhatsApp or anyone else until you click a button and leave our site.

9. AI tools (Caption Finder, Bio Generator)

The Caption Finder and Bio Generator tools work without any account. Each has an optional AI step that you trigger yourself. When you do, only the topic or description text you typed is sent to Groq, Inc. (USA) or, if Groq is unavailable, to Cloudflare, Inc. (USA, Workers AI) to generate the result. The Bio Generator sends only your profession, interests and product; it never sends a name, city or business name. Please do not type personal data into these fields.

Results are cached on our server for 24 hours under a hash key derived from the input text, so that identical requests are not sent twice; the cache holds no identifier that links a result to you. Legal basis: your consent, given by actively triggering the AI step after the notice shown next to the button (Art. 6(1)(a) GDPR); you withdraw it simply by not using the function again. The transfer of your input to the USA takes place only on that explicit action and is based on Art. 49(1)(a) GDPR together with the providers' contractual data protection commitments. Cloudflare, Inc. is additionally certified under the EU-US Data Privacy Framework.

10. Free online tools

Our free tools (for example whois, SSL check, website history, page speed) send the domain name or URL you enter to the public services needed to produce the result: RDAP and whois servers, the Internet Archive, the Google PageSpeed Insights API and similar services. No user accounts exist, and we do not link the query to you. Results are cached briefly on our server so that repeated queries are answered faster. If the domain or URL you enter contains personal data (for example a name in a domain), that data is processed only to run the check you requested (Art. 6(1)(f) GDPR).

11. Recipients and international transfers

We share personal data only with the following recipients and only to the extent necessary:

• our hosting provider (Türkiye), as processor, for the server in France;
• iyzico Ödeme Hizmetleri A.Ş. (Türkiye), for payment processing;
• Google Ireland Limited / Google LLC, for Google Ads conversion tracking, only after your consent;
• Groq, Inc. and Cloudflare, Inc. (USA), only for the AI step you trigger in the tools named in section 9;
• the public services named in section 10, for the free tools;
• our accountant, for invoicing and tax obligations, and public authorities where we are legally required to disclose data.

We are established in Türkiye. Türkiye is not covered by an adequacy decision of the European Commission or the UK Government. When you contact us or order from us, you provide your data directly to us as the controller; we protect it under Turkish data protection law (Law No. 6698) and apply the standards described in this policy. Data is stored on a server in France (EU); our hosting provider, established in Türkiye, accesses it only for server administration and is bound to confidentiality. Your payment data goes to iyzico in Türkiye because it is necessary to perform the contract with you (Art. 49(1)(b) GDPR). Transfers to the USA occur only in the consent-based cases described in sections 6, 8 and 9.

12. Retention

• Server logs: normally removed within a month by the hosting provider's log rotation, or after a security incident has been investigated.
• Requests and correspondence: while the request is handled, then up to 3 years.
• Order, contract and invoice data: 10 years (Turkish tax and commercial law).
• Case files for review removal, account recovery and username services: deleted 30 days after the case is closed.
• Page statistics: contain no personal data (daily salted IP hash).
• AI and free-tool caches: short-lived, not linked to you.
• Cookie consent record: 12 months in your browser.

When the retention period ends, the data is deleted or anonymised.

13. Your rights

Under the GDPR and the UK GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data rectified (Art. 16);
• have your data erased (Art. 17);
• have processing restricted (Art. 18);
• receive the data you provided in a portable format (Art. 20);
• withdraw any consent at any time, with effect for the future.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise these rights, write to info@talhaaslan.com or to the postal address in section 1. We may ask for information needed to confirm that the request comes from you. We answer within one month; where a request is complex, this period may be extended as permitted by law, and we will tell you if that is the case. Exercising your rights is free of charge.

14. Complaints

If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In the EU/EEA this is the data protection authority of the country in which you live, work or where the alleged infringement took place. In the United Kingdom it is the Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first, so please consider contacting us at info@talhaaslan.com before you do so.

15. Information for residents of the United States

We do not sell personal information and we do not share it for cross-context behavioral advertising, other than the consent-based Google Ads conversion tag described in section 6, which you can decline or switch off at any time via "Cookie settings" in the footer. If you would like to know what personal information we hold about you, or want it corrected or deleted, contact us at info@talhaaslan.com and we will handle your request as described in section 13.

16. Changes to this policy

We update this policy when our services, the tools we use or the legal requirements change. The current version is always published on this page with its "last updated" date. For contracts already concluded, the version in force at the time of the order applies to that order's processing unless a later version gives you more protection.