Privacy.

This page explains what data is collected when you visit yusufbaykalbozkurt.com, who processes it, on what legal basis, how long it is kept, and how to exercise your rights. Written in plain English. If anything here is unclear, email info@yusufbaykalbozkurt.com and I will explain it personally.

1. Who is responsible (data controller)

Yusuf Baykal Bozkurt, operating through Beonbrand Inc., Toronto, Ontario, Canada. For any privacy question or request, contact: info@yusufbaykalbozkurt.com.

2. What data is collected and why

2.1 The site itself

The site is a static HTML page hosted on Netlify. Loading the page does not require an account, does not set first-party cookies, and does not log identifying information beyond what your browser sends in standard HTTP request headers (IP address, user agent, referrer). Netlify holds these access logs for security and abuse prevention. The retention period is set by Netlify, not by me — see their privacy notice for it. I do not receive, query or analyse these logs.

2.2 Contact form

If you submit the contact form, your name, email address, and message are sent via Netlify Forms to info@yusufbaykalbozkurt.com. That address is forwarded by Cloudflare Email Routing into a Microsoft 365 mailbox I personally check. The form collects exactly three fields — name, email address and message — plus a hidden anti-spam field that real visitors never fill in. Netlify stores the submission so I can read it, and applies Akismet spam filtering to it. Writing to me does not subscribe you to anything. There is no newsletter, no mailing list and no marketing automation on this site; your address is used to reply to you and nothing else.

2.3 Embedded LinkedIn feed (off unless you turn it on)

The "Live from LinkedIn" section can embed a widget from Elfsight that displays public posts from my LinkedIn profile. It does not load unless you ask for it. Until then the page carries no Elfsight script, no widget container and no connection to either company — only a placeholder with a "Load LinkedIn feed" button and a plain link to my LinkedIn profile.

If you load it, your browser contacts Elfsight and LinkedIn directly. They can then see your IP address and the page you are on, and set their own cookies under their own domains, governed by their privacy policies. I have no access to that data and cannot delete it for you.

2.4 Embedded YouTube videos (off unless you turn it on)

The "On camera" section can play videos from YouTube. Nothing is requested from Google — not even a preview image — until you enable YouTube. Until then each video shows a first-party placeholder with an "Enable YouTube videos" button and a normal link that opens the video on YouTube in a new tab, which you can use without enabling anything here.

Once enabled, preview images are fetched from i.ytimg.com and the player is embedded from youtube-nocookie.com. The "no-cookie" domain withholds some cookies until playback begins, but it is still a Google server: the request itself discloses your IP address and which page you are on. That is why it sits behind the same choice as any other embed rather than being treated as cookie-free. Once you play a video, Google's privacy policy applies.

2.5 Analytics and advertising

There is none. No Google Analytics, no Google Tag Manager, no Plausible, no Facebook Pixel, no advertising or marketing pixels of any kind, and no A/B testing tools. Nothing on this site profiles you or measures your behaviour. If that ever changes, this notice will be updated, the effective date at the top will change, and any such tool would be off by default under the same choices described in section 4.

2.6 Fonts

The Montserrat typeface is served from this site, not from Google Fonts. The font files were downloaded once when the site was built and are delivered from yusufbaykalbozkurt.com alongside the page. Your browser makes no request to fonts.googleapis.com or fonts.gstatic.com. An earlier version of this notice said fonts were delivered by Google; that was accurate for this privacy page and the 404 page at the time, and both have since been changed to the self-hosted files.

3. Cookies and browser storage

This site sets no cookies of its own — no session cookie, no analytics cookie, no advertising cookie. It stores exactly one item in your browser, and only after you make a choice:

The ybb-privacy entry holds only your choices and a timestamp. It contains no identifier, is never sent to a server, and is not readable by any other site. Clearing your browser storage removes it, and the site returns to its default: everything optional switched off.

Cookies set by Elfsight, LinkedIn or Google live on their domains. Turning a provider off here stops any further loading and clears what that provider wrote under this site, but I cannot reach or delete cookies held on their own domains — use your browser settings or their own controls for that.

4. Your choices

Every optional embed is off until you switch it on. Ignoring the privacy notice leaves everything off; there is no timer, no "continuing to browse means consent", and no activity is recorded and replayed later.

You can change your mind at any time:

• Open the controls with the Privacy settings link in the footer of any page, or here:
• Switch either provider on or off individually — enabling LinkedIn does not enable YouTube, and the reverse is equally true
• Choose Reject optional to switch everything off at once

When you switch a provider off, the site stops loading it, clears what it stored in your browser under this site, and reloads the page if that provider is already on screen, so the vendor's code is actually unloaded rather than merely hidden.

You can also block these providers in your browser's privacy settings or with an extension. The site works either way; only the LinkedIn feed and the video previews will not appear.

5. Legal basis for processing

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies:

• Contact form submissions are processed on the basis of your consent (you chose to fill the form) and my legitimate interest in replying to enquiries about my work.
• Server-side access logs (held by Netlify) are processed on the basis of legitimate interest in operating a secure site.
• Optional embeds (Elfsight/LinkedIn, YouTube) are loaded only on the basis of your consent, given by switching that provider on. Nothing is loaded from them before that. Once loaded, each company processes your data under its own legal bases as described in its privacy policy.

6. International data transfers

Netlify, Elfsight, LinkedIn, YouTube/Google and Microsoft are headquartered in the United States and process data globally. For Elfsight, LinkedIn and YouTube/Google no transfer happens at all unless you switch that provider on. If you are in the EEA, UK, or Switzerland, your data may be transferred to and processed in countries that do not have an adequacy decision; the providers above use Standard Contractual Clauses and other safeguards as described in their respective notices.

7. How long data is kept

• Contact form messages: kept in my mailbox for as long as they are useful for our correspondence. I have not set a fixed deletion schedule; if you ask me to delete your message, I will, and I will confirm when it is done.
• Netlify Forms submissions: stored by Netlify for the period set in their policy. I can delete an individual submission from the Netlify dashboard on request.
• Netlify server logs: the period is Netlify's, not mine — see their privacy notice.
• Your privacy choice (ybb-privacy): stays in your browser until you change it or clear your browser storage. It never reaches a server.
• Cookies set by optional embeds: controlled entirely by that provider. I cannot see or delete them.

8. Security

The site is served exclusively over HTTPS with HSTS preload. A Content Security Policy restricts which origins may load scripts, frames, images, and fonts. Form submissions are validated server-side by Netlify and protected with a honeypot field plus Akismet spam filtering. No payment data, health data, or government identifiers are collected.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data I hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent for any future processing
• Lodge a complaint with your local data protection authority

To exercise any of these, email info@yusufbaykalbozkurt.com. I will respond within 30 days. No fee unless your request is manifestly unfounded or excessive.

Supervisory authorities:

• Canada: Office of the Privacy Commissioner of Canada
• EU/EEA: your national data protection authority (list at edpb.europa.eu)
• UK: Information Commissioner's Office
• California: California Attorney General

10. Children

This site is not directed at children under 13 (or under 16 in the EU/UK depending on member state). I do not knowingly collect data from children. If you believe a child has submitted their data, email info@yusufbaykalbozkurt.com and I will delete it.

11. Third parties used

• Netlify (hosting + forms) — Privacy policy
• Cloudflare Email Routing (forwards info@yusufbaykalbozkurt.com to my mailbox) — Privacy policy
• Microsoft 365 (the mailbox forwarded mail lands in) — Privacy statement
• Optional — loaded only if you turn it on
  Elfsight (LinkedIn feed widget) — Privacy policy
• Optional — loaded only if you turn on the LinkedIn feed
  LinkedIn (source of embedded posts) — Privacy policy
• Optional — loaded only if you turn on YouTube
  YouTube / Google (video embeds) — Privacy policy
• Akismet (form spam filter via Netlify) — Privacy policy

12. Changes to this notice

If anything changes — a new embed, an analytics tool, a change of hosting provider — this page is updated and the effective date and version at the top are bumped. A material change also raises the version number stored with your privacy choice, so the choices are presented to you again rather than a new provider inheriting consent you gave for a different one.

13. Contact

Privacy questions or requests: info@yusufbaykalbozkurt.com. I read every message.

← Back to home ·