Privacy Policy & Data Protection

1. Identification of Data Controller

This website, located at https://princesislandsistanbul.org ("the Service"), is an independent digital travel publication edited and operated by Kerem and Elena Demir ("Demir Heritage Publications"), based in Burgazada, Adalar, Istanbul, Republic of Turkey. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") and the Turkish Personal Data Protection Law (Law No. 6698 - "KVKK"), the operator acts as the Data Controller responsible for the processing of any technical metadata collected during your navigation of this domain.

2. Technical Data Collected Automatically

Our infrastructure operates on high-performance static JAMstack architecture distributed globally through Cloudflare’s Edge Content Delivery Network. Whenever you access any page, stylesheet, image asset, or document on our servers, certain standard connection parameters are automatically logged in technical server log files. These parameters include:

• The Internet Protocol (IP) address of the requesting computer or proxy gateway;
• The specific Uniform Resource Identifier (URI) or file path accessed;
• The date, exact Greenwich Mean Time (GMT) timestamp, and duration of the server request;
• The Hypertext Transfer Protocol (HTTP) status response code returned by the server (e.g., 200 OK, 301 Redirect, 404 Not Found);
• The volume of digital payload transferred in bytes;
• The referring website URL from which your browser initiated the visit;
• The User-Agent string providing browser family, software build version, operating system architecture, and device category.

This technical data is processed strictly based on legitimate interest (GDPR Art. 6(1)(f)) to maintain server stability, prevent distributed denial-of-service (DDoS) disruptions, identify broken internal hyperlinks, and ensure responsive page rendering across diverse mobile and desktop devices. This technical information is never combined with any personal identifiers.

3. Cookie Governance & Browser Storage

A cookie is a small alphanumeric text file placed on your hard drive or browser cache by web servers to record session state or technical preferences. Our static website maintains a strict minimal-footprint philosophy:

• Essential Technical Cookies: Distributed by Cloudflare (such as __cf_bm and cf_clearance) to manage bot detection, secure SSL encryption tunnels, and prevent malicious automated scraper attacks. These cookies do not store personally identifiable data and expire automatically within hours or days.
• Absence of Behavioral Profiling Cookies: We do NOT deploy third-party advertising retargeting pixels (such as Meta Pixel, TikTok Pixel, or invasive programmatic display ad exchanges) that track your browsing habits across unrelated internet domains.

You can configure your browser settings to reject all cookies, alert you when a cookie is placed, or delete historical cookies. If you choose to disable cookies, all core travel information, itineraries, timetables, and historical essays on this website will remain fully accessible without impediment.

4. Affiliate Marketing & Outbound Partner Platforms

To fund our intensive fieldwork, ongoing ferry schedule audits, and server costs without paywalls or intrusive banner popups, our website includes commercial affiliate tracking links to authorized ticketing vendors, specifically:

• GetYourGuide Deutschland GmbH: Sonnenburger Straße 73, 10437 Berlin, Germany. Partner identifier: FY0PT2P.
• Viator, Inc. (Tripadvisor Group): 400 1st Avenue, Needham, MA 02494, United States. Partner identifier: P00271667.

When you click an outbound link to purchase a round-trip Princes' Islands ferry ticket, catamaran sailing, or walking excursion, your browser transmits a technical referral parameter (such as partner_id=FY0PT2P&campaign=princesislandsistanbulorg) to the partner platform. The vendor stores a transient affiliate tracking cookie to record that the booking originated from our recommendation.

Important Financial Clarification: We do NOT receive, handle, store, or view your banking credentials, credit card details, billing address, or customer name. All checkout procedures, payment authorizations, ticket issuance, and customer support inquiries are handled exclusively through the secure, PCI-DSS compliant checkout portals of the respective ticketing partners.

5. Legal Rights Under GDPR & KVKK

Under Chapter III of the European Union GDPR and Article 11 of the Turkish Law on the Protection of Personal Data (KVKK), visitors whose personal data may be processed have legally enforceable rights:

• Right of Access (GDPR Art. 15 / KVKK Art. 11(a)): You have the right to request written confirmation as to whether personal data concerning you is being processed and obtain a copy of such data.
• Right to Rectification (GDPR Art. 16 / KVKK Art. 11(d)): You have the right to obtain without undue delay the correction of inaccurate personal data.
• Right to Erasure / Right to be Forgotten (GDPR Art. 17 / KVKK Art. 11(e)): You may request the prompt deletion of personal correspondence or inquiries stored in our email archives.
• Right to Restriction of Processing (GDPR Art. 18): You may request the temporary suspension of processing while a verification claim is resolved.
• Right to Lodge a Complaint: You maintain the right to submit a formal complaint to your national data protection supervisory authority (e.g., the Turkish Kişisel Verileri Koruma Kurumu (KVKK) in Ankara or the relevant EU member state data protection authority).

6. Data Retention and Security Architecture

Any correspondence sent to our editorial desk via email is retained for a maximum duration of 24 calendar months to resolve follow-up inquiries or historical citations, after which messages and associated email addresses are permanently purged from secure local mailboxes.

Our website is deployed using strict HTTPS/TLS 1.3 cryptographic transport security protocols, enforcing end-to-end data encryption between your web browser and our edge servers. We regularly inspect our build systems and hosting environment against contemporary OWASP vulnerability standards.

7. Revisions to This Privacy Charter

We reserve the right to revise this Privacy Policy periodically to reflect technological advancements, updates to our hosting infrastructure, changes in affiliate partnership configurations, or legislative amendments to Turkish or European privacy law. Material updates will be documented on this page with an amended revision timestamp.

8. Contacting the Privacy Officer

For any formal requests regarding personal data access, rectification, deletion, or technical governance inquiries, please reach out directly to our designated data officer: