Last updated: 1 November 2026

This policy explains which personal data are processed when you visit the website at holoworld.info (the “Site”), for what purpose and for how long. It serves as the privacy notice required under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) as well as Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

In short: the Site has no accounts, comments, forms, ads or analytics, and sets no cookies of its own. Only the minimum technical records needed to run and protect the Site are kept.

1. Data controller

The Site is a personal, non-commercial publication hosted on the data controller’s own server in Türkiye. (Under Article 27(2) of the GDPR, the appointment of an EU representative is not required given the non-commercial nature of the site and the low-risk, occasional processing.)

2.1. Server logs

When a page is requested, the web server (Nginx) automatically records:

  • IP address,
  • date and time,
  • requested address and HTTP method,
  • response status code and amount of data transferred,
  • referring page (referrer),
  • browser and operating system information (user agent).

Requests for static files such as images, stylesheets and scripts are not logged.

  • Purpose: keeping the Site secure, detecting and preventing attacks and abuse, fixing technical errors.
  • Legal basis: the data controller’s legitimate interest, provided it does not override your fundamental rights and freedoms (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Retention: 30 days, after which the logs are deleted automatically. Specific records may be kept longer only for as long as needed to investigate a security incident or to comply with a lawful order from competent authorities.

The logs are not used for profiling, are not combined with other data and are not shared with third parties, except where required by law.

2.2. Cloudflare

The Site is reached through Cloudflare Tunnel and the content delivery network of Cloudflare, Inc. (USA). Cloudflare provides the encrypted (HTTPS) connection, forwards traffic to the server and protects the Site against attacks. Your requests to the Site, including your IP address, request details and browser information, are therefore processed by Cloudflare.

To distinguish malicious traffic, Cloudflare may set strictly necessary, security-only cookies (e.g. __cf_bm, cf_clearance). They are not used to identify you or for advertising.

  • Purpose: delivering the Site reliably, quickly and securely.
  • Legal basis: the data controller’s legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • International transfer: Cloudflare operates servers globally, so data may be processed outside Türkiye or the EEA. Transfers are conducted in compliance with KVKK Art. 9 and GDPR Chapter V (Standard Contractual Clauses / EU-U.S. Data Privacy Framework).
  • Details: Cloudflare Privacy Policy

2.3. Embedded videos (YouTube, Vimeo)

Some posts contain YouTube (Google) or Vimeo videos. They are displayed using a click-to-load method:

  • Opening a page makes no connection to YouTube or Vimeo. The preview image you see is served directly from this Site’s own server.
  • The provider’s player is loaded only after you click the play button. From that moment, your IP address, browser information and the current page URL are transmitted to the provider, which may use cookies or tracking technologies.
  • YouTube videos are loaded in Google’s “privacy-enhanced mode” (youtube-nocookie.com), and Vimeo videos with “Do Not Track” enabled (dnt=1).
  • With JavaScript disabled, clicking the preview takes you to the video’s source webpage directly.

Any processing that occurs after the player is loaded is the responsibility of the respective provider:

  • Google Privacy Policy

  • Vimeo Privacy Policy

  • Legal basis: your explicit consent, granted by clicking the play button (KVKK Art. 5(1); GDPR Art. 6(1)(a)). Not playing a video means no consent is given. You may withdraw your consent at any time by refreshing the page or clearing your browser cookies. The remainder of the Site remains completely usable without playing any video.

  • International transfer: Loading the player may transfer data to countries outside the EEA/Türkiye where provider servers are located (GDPR Art. 49(1)(a)).

2.4. Social media content

Posts may link to social media posts (e.g. Instagram, X/Twitter, TikTok, Spotify). These are plain hyperlinks: no information is sent to third-party services unless you click the link. If social media content is ever embedded directly in a page in the future, the same click-to-load principles will apply and this policy will be updated.

2.5. Contact by email

If you email me, your name, email address and the message contents are processed solely to reply to your inquiry.

  • Legal basis: the data controller’s legitimate interest in communicating with correspondents (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Retention: as long as necessary for the correspondence. Emails are deleted upon request.
  • Emails are stored on the servers of the email service provider in use, which may be located outside Türkiye or the EEA.

3. Cookies and local storage

The Site does not set any first-party cookies and uses no analytics, advertising or tracking tools.

If you use the light/dark theme toggle, your preference is saved in your browser’s local storage (localStorage, key theme). This value stays strictly on your device, is never transmitted to any server, and can be deleted anytime via your browser settings.

Third-party cookies may only be set under the specific circumstances described above: Cloudflare’s strictly necessary security cookies, and video providers’ cookies once you play an embedded video.

The Site contains links to external websites. HoloWorld.info is not responsible for the privacy practices of third parties; please review the privacy policies of any site you visit.

5. Security

Connections to the Site are encrypted using HTTPS. The server cannot be accessed directly from the public internet; traffic only arrives through the encrypted Cloudflare Tunnel. Only the data controller has access to the server logs.

6. Your rights

6.1. Rights under the KVKK (Türkiye)

Under Article 11 of the KVKK, you have the right to:

  • learn whether your personal data are processed,
  • request information about the processing,
  • learn the purpose of the processing and whether the data are used accordingly,
  • know the third parties in Türkiye or abroad to whom your data are transferred,
  • request correction of incomplete or inaccurate data,
  • request erasure or destruction of your data under the conditions of Article 7 of the KVKK,
  • request that third parties to whom your data were transferred be notified of such correction, erasure or destruction,
  • object to any result to your detriment arising exclusively from automated processing,
  • claim compensation for damages arising from unlawful processing.

6.2. Rights under the GDPR (European Union / EEA / United Kingdom)

If you are located in the European Economic Area or the United Kingdom, under the GDPR (and UK GDPR) you have the following rights:

  • Right of access (Article 15): Request confirmation of processing and a copy of your personal data.
  • Right to rectification (Article 16): Request correction of inaccurate or incomplete data.
  • Right to erasure / Right to be forgotten (Article 17): Request erasure of your personal data under certain conditions.
  • Right to restriction of processing (Article 18): Request that the processing of your data be restricted.
  • Right to data portability (Article 20): Receive personal data you provided in a structured, commonly used, and machine-readable format.
  • Right to object (Article 21): Object at any time to processing based on legitimate interests (e.g. server security logs) on grounds relating to your particular situation.
  • Right to withdraw consent (Article 7(3)): Withdraw consent at any time where processing is based on consent (e.g. embedded video playback).
  • Right not to be subject to automated decision-making (Article 22): Be free from decisions based solely on automated processing or profiling (the Site does not perform profiling).

6.3. Exercising your rights and complaints

You may submit your requests by emailing [email protected]. For inquiries concerning server logs, please specify your IP address and the approximate date and time of your visit so the relevant record can be identified.

  • Response time: Requests are answered free of charge within 30 days (or 1 month under the GDPR) at the latest.
  • Right to lodge a complaint: If your request is refused or not answered within the legal timeframe:
    • Users residing in Türkiye may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
    • Users residing in the EU/EEA or the UK may lodge a complaint with their local Supervisory Authority (Data Protection Authority - DPA).

7. Changes

This policy may be updated when the Site or applicable laws change. The current version will always be published on this page, with the date at the top revised accordingly.

A Turkish version of this policy is also available. In case of any discrepancy, the Turkish version prevails.