1. Data Controller

Under the Law on the Protection of Personal Data No. 6698 (“KVKK”), your personal data is processed by KCD Law Firm (the “Firm”), acting as data controller, within the scope described in this notice.

Address: Eminoğlu Plaza, Mansuroğlu Mah. 288/4 Sk. No:14, Floor 1, Office 11, 35800 Bayraklı/İzmir, Türkiye
Phone: +90 530 923 28 17
E-mail: info@kcdhukuk.com
Website: kcdhukuk.com

This Privacy Notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform visitors to the kcdhukuk.com website, persons who contact us through our communication channels, and our clients and prospective clients.

2. Categories of Personal Data Processed

Identity: first name and surname; where a power of attorney relationship is established, Turkish ID number and the information on your identity document.
Contact: e-mail address, phone number, address; if you write to us via WhatsApp, your phone number and profile name.
Client transaction: the content of requests and messages you send via the contact form, e-mail, phone or messaging, information and documents relating to the legal matter, correspondence records, attorney fee and payment information.
Transaction security: IP address, browser and device information, form submission time, and IP addresses and log records of failed login attempts to the website administration panel.
Cookie data: your cookie preference; and, only if you give explicit consent, statistical data on website usage obtained through Google Analytics 4.

The Firm does not process personal data for marketing purposes and does not send commercial electronic messages.

Where the nature of a legal matter so requires, special categories of personal data, such as health data or data relating to criminal convictions and security measures, may also be processed. Such data is processed only under the conditions set out in Article 6 of the KVKK and with the adequate measures determined by the Personal Data Protection Board.

3. Purposes of Processing

Receiving, assessing and responding to your contact requests and enquiries,
Establishing and performing the attorney engagement agreement, and providing legal advice and representation services,
Conducting litigation, enforcement, mediation and administrative proceedings, and carrying out actions before judicial authorities and public institutions,
Fulfilling legal obligations, including those arising from the Attorneyship Law and the rules of professional conduct,
Tracking attorney fees and expenses, and carrying out accounting and financial transactions,
Ensuring the security of the website and information systems, detecting and preventing unauthorised access attempts, and performing backups,
Where you have given explicit consent, measuring website usage statistics and improving the website.

4. Legal Grounds

Your personal data is processed on the following legal grounds set out in Article 5(2) of the KVKK:

Processing is necessary, provided that it is directly related to the establishment or performance of a contract, for the personal data of the parties to that contract (Art. 5(2)(c)),
Processing is mandatory for the data controller to fulfil its legal obligations, in particular under Attorneyship Law No. 1136 and the duty of professional secrecy (Art. 5(2)(ç)),
Processing is mandatory for the establishment, exercise or protection of a right (Art. 5(2)(e)),
Processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject; for example, website security and responding to contact requests (Art. 5(2)(f)).

Processing through analytics cookies relies solely on your explicit consent (Art. 5(1)). Special categories of personal data are processed in the cases listed in Article 6(3) of the KVKK, in particular where processing is mandatory for the establishment, exercise or protection of a right or is expressly provided for by law, and, where none of these conditions applies, with your explicit consent.

5. Method of Collection

Your personal data is collected, by fully or partly automated means or by non-automated means forming part of a data filing system, through the contact form on the website, e-mail, phone and WhatsApp correspondence, face-to-face meetings and documents you provide, as well as through cookies and server records during your visit to the website.

6. Transfer of Personal Data

6.1. Transfers Within Turkey

Within the purposes and legal grounds above and to the extent necessary, your personal data may be transferred to:

Judicial authorities such as courts, enforcement offices and public prosecutors, and authorised public institutions and organisations,
Service providers from which we obtain hosting, backup and e-mail services,
Third parties such as court experts, mediators, notaries and financial advisers, where necessary to fulfil legal and financial obligations.

Our website is hosted by a service provider established in Turkey.

6.2. Transfers Abroad

In the course of the operation of the website and the use of communication channels, certain data may be transferred to service providers established abroad:

Google Analytics 4 (Google): only if you give cookie consent, data on website usage and online identifiers,
Google Fonts (Google) and jsDelivr: IP address and browser information when font and script files are loaded in your browser,
WhatsApp (Meta): if you correspond with us via WhatsApp, your phone number, profile information and message content.

Transfers abroad are carried out in accordance with Article 9 of the KVKK as amended by Law No. 7499. Accordingly, where there is no adequacy decision, transfers are based, to the extent applicable, on appropriate safeguards such as the standard contract announced by the Personal Data Protection Board; where this is not possible and the transfer is incidental, they are based on your explicit consent under Article 9(6) of the KVKK, provided that you have been informed of the possible risks.

7. Retention Periods

Your personal data is retained for as long as required by the purposes of processing and for the periods prescribed by applicable legislation. Data relating to client files is kept for the duration of the obligations arising from the Attorneyship Law and the rules of professional conduct and the limitation periods set out in applicable legislation, notably Turkish Code of Obligations No. 6098 (the general limitation period is 10 years). Contact requests that do not result in an engagement are retained only for as long as needed to conclude the request and for the limitation periods relating to potential disputes. Security log records are kept for a limited period as required by the security purpose.

Data whose retention period has expired is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

8. Notice on Professional Secrecy and Special Categories of Data

Information sent to us via the contact form, e-mail or other channels before an attorney-client relationship is established is also kept confidential under the duty of professional secrecy. Nevertheless, we recommend that you do not send special categories of personal data, such as health information or information relating to criminal investigations, via channels such as the web form or WhatsApp unless necessary, and that you share such information during a meeting or by a secure method.

9. Rights of the Data Subject

Under Article 11 of the KVKK, everyone has the right, by applying to the data controller, to:

Learn whether their personal data is processed,
Request information if their personal data has been processed,
Learn the purpose of processing and whether the data is used in accordance with that purpose,
Know the third parties in Turkey or abroad to whom their personal data is transferred,
Request rectification if their personal data is processed incompletely or inaccurately,
Request erasure or destruction of their personal data under the conditions set out in Article 7 of the KVKK,
Request that rectification, erasure or destruction be notified to third parties to whom the personal data has been transferred,
Object to a result to their detriment arising from the analysis of the processed data exclusively through automated systems,
Claim compensation for damage suffered due to unlawful processing of their personal data.

10. How to Apply

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning your rights:

In writing, by a wet-signed petition delivered by hand or by post to Eminoğlu Plaza, Mansuroğlu Mah. 288/4 Sk. No:14, Floor 1, Office 11, 35800 Bayraklı/İzmir, Türkiye,
Through a registered electronic mail (KEP) address,
Signed with a secure electronic signature or mobile signature, or from an e-mail address you have previously notified to the Firm and which is registered in our system, to info@kcdhukuk.com.

Your application must include your name, surname and, for written applications, signature; Turkish ID number for Turkish citizens, or nationality and passport number or ID number, if any, for foreign nationals; your residential or business address for notification; your e-mail address, phone or fax number for notification, if any; and the subject of the request.

Your application will be concluded free of charge as soon as possible according to the nature of the request and within 30 (thirty) days at the latest. If the action requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.