Privacy policy

1. Controller

The controller responsible for data processing on this website is:

2. Principles

Protecting your personal data matters to me. I process your data solely on the basis of the applicable law (GDPR, German BDSG, DDG). This policy tells you the nature, scope and purpose of the processing and your rights. The site is deliberately data-minimal: without your consent, no cookies are set for analytics or marketing. Audience measurement is cookieless by default; an optional, consent-based tool is only loaded after you agree (see section 10).

3. Hosting and server log files

This website is hosted on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) via Cloudflare Pages. When the pages are accessed, Cloudflare processes technically necessary access data in server log files, including your IP address, the date and time of access, the resource requested, the referrer, and browser and operating-system information. This processing serves the secure, stable and efficient operation of the website and the prevention of attacks.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation). A data-processing agreement is in place with Cloudflare. As processing may also take place in the USA, it is safeguarded by the EU Standard Contractual Clauses.

4. Fonts

The fonts used are served locally from this server (self-hosting). No connection is made to third-party font services (such as Google Fonts) and your IP address is not transmitted to such providers.

5. Contact form

When you use the contact form, I process the data you provide — depending on your enquiry, in particular your first and last name, email address, your message and the context-specific fields (e.g. organisation, topic, format, location). For technical reasons your IP address and browser identifier are also recorded. This information is used solely to handle and answer your enquiry.

The legal basis is your consent under Art. 6 (1) (a) GDPR (confirmed via a checkbox) and, insofar as your enquiry is aimed at a contract, Art. 6 (1) (b) GDPR. A double-opt-in procedure is used to confirm your enquiry: you receive an email with a one-time confirmation link, and only after you click it is your enquiry marked as confirmed. The data is stored in a database (Cloudflare D1) and kept for as long as necessary to process it, or until you request its deletion. Statutory retention obligations remain unaffected.

6. Spam protection (Cloudflare Turnstile)

To protect the forms against automated abuse, I use Cloudflare Turnstile. Technical characteristics of your access (including your IP address and browser signals) are transmitted to Cloudflare and evaluated to distinguish humans from bots. Turnstile works without cookies and without cross-site personal tracking. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse and spam).

7. Email delivery (Brevo)

To send the confirmation and notification emails I use the service Brevo (Brevo / Sendinblue, processing within the EU). Your email address and the content of the respective message are processed for this purpose. A data-processing agreement is in place with the provider. The legal basis is Art. 6 (1) (a) or (f) GDPR.

8. Newsletter

If you subscribe to the newsletter, I process your email address to send you occasional pieces. Subscription uses a double-opt-in procedure: you receive a confirmation email and are only added to the list after you click the confirmation link. The subscription is logged so that it can be proven. The legal basis is your consent under Art. 6 (1) (a) GDPR. You can unsubscribe at any time via the link at the end of every email; your consent is thereby deemed withdrawn.

9. Appointment booking (Cal.com)

For certain enquiries you can optionally book a conversation directly. The booking is handled via Cal.com (Cal.com, Inc., USA) and is only triggered if you actively start the booking process. The data required to arrange the appointment (name, email address and the reason for the conversation) is transmitted to Cal.com. The legal basis is your consent and/or the initiation of a conversation under Art. 6 (1) (a) and (b) GDPR. As processing takes place in the USA, it is safeguarded by the EU Standard Contractual Clauses. Booking is voluntary; your contact enquiry is stored regardless.

10. Analytics and consent

Cloudflare Web Analytics (cookieless)

To measure page views I use Cloudflare Web Analytics. This method works without cookies, without cross-device tracking and without profiling; only aggregate metrics are collected. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimal audience measurement).

Microsoft Clarity (only with your consent)

With your consent I additionally use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA) to better understand how the site is used — for example through session recordings and heatmaps. This sets cookies (e.g. _clck, _clsk) and transmits interaction data to Microsoft. Clarity is only loaded after you agree in the consent banner; without consent there is no transmission to Microsoft and no cookie is set. The legal basis is your consent under Art. 6 (1) (a) GDPR. As processing may take place in the USA, it is safeguarded by the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

Storing your choice

Your choice in the consent banner is stored locally in your browser (localStorage) as strictly necessary, so the banner does not reappear on every visit. No cookie is set for this.

11. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise your rights, a message to sinan@isoglu.com is sufficient.

12. Right to complain

You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your data infringes the GDPR. The competent authority is that of your habitual residence or that of the controller.

13. Retention

I store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. The data is deleted thereafter.

---

Status of this privacy policy: 2026. It will be updated if the website or the services used change.