Privacy Policy & Data Notice

1. Data Controller Identification & Scope

This Privacy Policy defines the personal data processing protocols of Heybeliada Tours (accessible at heybeliada.tours), an independent digital maritime advisory and historical archive edited by naval researcher Deniz Yılmaz. We are dedicated to ensuring that your privacy is protected when consulting our ferry timetables, architectural essays, and tour comparisons.

For the purposes of the General Data Protection Regulation (Regulation EU 2016/679 - GDPR) and the Personal Data Protection Law of Türkiye (Law No. 6698 - KVKK), the designated data controller responsible for the governance of this platform is the editorial office of Heybeliada Tours, reachable electronically at privacy@heybeliada.tours.

2. Principles of Lawful Data Processing (KVKK Art. 4 & GDPR Art. 5)

In strict compliance with statutory frameworks in both the Republic of Türkiye and the European Union, all processing of technical metadata conducted by our servers is governed by six fundamental principles:

• Lawfulness, Fairness, and Transparency: Data is handled in accordance with the rule of law and in a manner clear and understandable to the data subject.
• Purpose Limitation: Information is collected solely for specified, legitimate technical delivery and analytical purposes and is not processed incompatibly.
• Data Minimization: We restrict server requests strictly to what is adequate, relevant, and necessary to deliver static HTML assets.
• Accuracy: All reasonable measures are implemented to ensure technical connection records remain accurate.
• Storage Limitation: Identifiable connection headers are maintained only for the duration required for operational cybersecurity, then purged.
• Integrity and Confidentiality: Server data is safeguarded against unauthorized modification, destruction, or compromise using state-of-the-art encryption protocols.

3. Categories of Information Collected Automatically

When you browse Heybeliada Tours, our edge hosting infrastructure (Cloudflare Pages) automatically logs routine technical connection headers necessary to route digital packets, defend against DDoS botnet attacks, and maintain regional caching performance across the Marmara basin:

• IP Address: Truncated or masked at the edge level wherever technologically feasible to prevent individual identification.
• Date and Timestamp: The exact chronological moment of page retrieval to evaluate server capacity during peak summer ferry travel periods.
• Requested Uniform Resource Identifier (URI): The specific URL or graphic asset viewed (such as /ferry.html or /assets/css/style.css).
• HTTP Response Status Code: Diagnostic server return codes (e.g., 200 OK, 301 Redirect, or 404 Not Found).
• User-Agent String: Browser version, operating system, and screen resolution parameters used to deliver optimized responsive layouts across mobile smartphones and desktop screens.
• Referring URL: The external search result or sister website hyperlink that directed you to our publication.

4. Cookie Directives & Local Storage Governance

Cookies are compact data text strings stored on your device by web browsers. Heybeliada Tours maintains an exceptionally lightweight technical footprint, deliberately avoiding invasive third-party cross-site advertising networks or behavioral profiling cookies.

• Strictly Necessary Technical Cookies: Transient security tokens generated by our CDN (Cloudflare) to distinguish authentic human readers from malicious automated scraping bots. These cookies expire automatically and contain no personal identity information.
• Functional Preference Storage: Client-side local storage entries that remember your preference choices (such as collapsing interactive FAQ accordions) between pages.
• Privacy-Preserving Analytics: Aggregated measurement tools that calculate daily visitor counts without placing persistent tracking cookies or harvesting device fingerprints.

You retain the absolute statutory right to block, reject, or erase cookies via your web browser settings at any time without compromising your ability to view our historical monographs or ferry schedules.

5. Commercial Affiliate Partnerships & Tracking Telemetry

To support ongoing archival research, field inspections, and maintenance of our digital guides without placing content behind paywalls or hosting disruptive banner ads, Heybeliada Tours participates in verified travel affiliate programs with GetYourGuide (Partner ID: FY0PT2P) and Viator / Tripadvisor (Partner ID: P00271667).

When you click an outbound link to reserve a ferry ticket, book a guided island cruise, or secure hotel lodging:

• An anonymized campaign identifier (e.g., partner_id=FY0PT2P&cmp=heybeliadatours&campaign=heybeliadatours) is appended to the destination URL.
• The merchant vendor places a temporary referral cookie on their domain to credit our publication if a booking is completed.
• We do not receive, store, or have access to your payment card details, billing address, or passport information. All commercial transactions occur under the proprietary encryption and privacy policies of GetYourGuide Deutschland GmbH or Viator Inc.
• Utilizing affiliate links incurs no extra cost or markup; prices remain identical to or lower than direct standard rates.

6. Data Retention, Security Standards & Global Edge Hosting

Our static site infrastructure is delivered globally over TLS 1.3 cryptographic protocols with modern HTTPS encryption and strict HTTP Strict Transport Security (HSTS) headers. Because our website operates entirely on pre-rendered, serverless static HTML architecture, there are no dynamic relational databases connected to the public internet capable of suffering SQL injection vulnerabilities or customer credential leakage.

Anonymized server transmission logs captured by our content delivery network are automatically purged on a rolling 30-to-90 day schedule in accordance with industry security best practices, after which only aggregated, unidentifiable statistical metrics are preserved for annual historical readership reporting.

7. Statutory Rights of Data Subjects (GDPR Articles 15–22 & KVKK Article 11)

As a valued reader of Heybeliada Tours, regardless of your geographic residency, you are entitled under European GDPR legislation and Turkish KVKK statutory provisions to exercise the following legal entitlements:

• Right of Access: You may request confirmation as to whether personal data relating to you is being processed and obtain a copy of such data.
• Right to Rectification: You may demand the correction of inaccurate, incomplete, or outdated personal data held in our correspondence records.
• Right to Erasure (Right to Be Forgotten): You may request the irrevocable deletion of your personal contact records when they are no longer required for the purpose for which they were supplied.
• Right to Restriction of Processing: You may request the temporary suspension of processing under circumstances prescribed by law.
• Right to Object: You possess the absolute right to object at any time to the processing of your data for direct marketing, promotional correspondence, or algorithmic profiling.
• Right to Data Portability: You may request the transmission of your data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: You maintain the statutory entitlement to submit formal grievances to national supervisory bodies, including the Personal Data Protection Authority of Türkiye (Kişisel Verileri Koruma Kurumu - KVKK) or your domestic European Data Protection Authority (DPA).

8. International Cross-Border Data Transfers

To deliver sub-second page rendering speeds to readers browsing from Istanbul, Athens, Berlin, London, or New York, static website files are mirrored across a decentralized global edge content delivery network (CDN). Consequently, technical connection headers may be transmitted through secure server facilities situated outside the European Economic Area (EEA) or Türkiye. All such transit channels rely on Standard Contractual Clauses (SCCs) certified by the European Commission or equivalent adequacy determinations under KVKK Article 9.

9. Links to External Sister Sites & Third-Party Platforms

Throughout our monographs, you will encounter hyperlinks directing you to external resources, including municipal transit portals (such as Şehir Hatları at sehirhatlari.istanbul), institutional heritage bodies (such as the Ecumenical Patriarchate), as well as our specialized sister island publications:

• Princes' Islands Archipelago Portal (princesislandsistanbul.org)
• Büyükada Island Guide (buyukada.tours)
• Burgazada Island Guide (burgazada.tours)
• Kınalıada Island Guide (kinaliada.tours)
• Sedef Island Guide (sedef.tours)

Please recognize that upon clicking an external hyperlink, you depart our digital domain. We bear no administrative control over, nor assume legal liability for, the data processing practices, privacy disclosures, or content reliability of external third-party internet sites. We encourage readers to inspect the privacy notices of each external domain visited.

10. Policy Amendments & Historical Revision Ledger

We may periodically revise this Privacy Policy to reflect technological upgrades, regulatory enactments by the Turkish KVKK Board, or modifications in our publishing architecture. Any amendments will become effective immediately upon posting to this URL, marked with an updated revision date.

11. Privacy Contact Inquiries & Data Requests

If you have questions, feedback, or statutory requests regarding this Privacy Policy, your personal data entitlements, or our technical security measures, please contact our editorial desk: