Privacy and personal data

Controller and scope

The controller for this website and contact form is Av. Rabia Şeyda Sıkıer KARA. Address: İstiklal, Mustafa Kemal Atatürk Cd No:122 K:1 D:2, 26010 Odunpazarı/Eskişehir; telephone: 0553 703 26 00. This notice concerns visitors and contact requests. Client, party and third-party data within legal or mediation matters require information appropriate to that role.

Data and collection

Submitting the form electronically records your name, email, selected topic, message, submission time and notice version. Network processing necessarily involves IP and connection information. Language is determined by the URL. The general form does not accept identity documents or case-file uploads; provide only relevant initial information.

Purposes and legal grounds

Details are used to assess and answer your request. Depending on its nature, KVKK Art.5/2-c covers steps directly related to contracting and Art.5/2-f a proportionate legitimate interest in responding. Legal duties and establishing or protecting rights require their respective conditions under Art.5/2-ç and e. Security processing requires proportionality. Acknowledging this notice is neither blanket consent nor marketing permission.

Sensitive data and confidentiality

Do not include unnecessary health, criminal-conviction, children’s or third-party data in the initial message. Special-category data needed for a matter require an applicable KVKK Art.6 condition and additional safeguards. Legal-claims necessity must be assessed separately. Professional confidentiality under Attorneyship Law Art.36 does not automatically end with representation.

Recipients and access

Authorised office administrators can access form submissions. Hosting and maintenance providers, and email or CRM providers when enabled, may process information only as needed for the relevant service. Disclosures to competent authorities require an appropriate legal basis. Data is not used for advertising targeting, collecting client testimonials or publicly showcasing case files.

International transfers

Provider location, storage countries and remote access require assessment. A transfer abroad needs an applicable mechanism under KVKK Art.9; cookie permission is not blanket authorisation for all transfers. Google Maps loads after external-content permission and may receive IP and browser information. A directions link opens Google’s own service.

Contact-record retention

For requests that do not become a mandate, retention depends on handling the request and a continuing, documented legal need. Unnecessary content should not be retained. Protecting evidence of a dispute requires a separate justification. There is no automatic ten-year retention rule for every contact message.

Mandate documents

Attorneyship Law Art.39 provides for keeping entrusted documents for three years after the mandate ends, subject to its rule concerning written notice to retrieve documents and the following three-month period. This is not unlimited retention of all digital copies or a universal deletion date. Ongoing proceedings, document delivery and other lawful grounds require individual assessment.

Limitation and financial records

Limitation periods and mandatory retention are different. Attorneyship Law Art.40, claims arising from mandates under TBK Art.147 and other special rules require individual assessment. VUK Art.253 concerns five-year retention of covered books and records from the calendar year following the relevant year. Pending proceedings and events affecting limitation must also be considered.

Access, delivery and erasure

Ending a mandate does not itself end a client’s information or data rights. Revoking staff access is different from responding to a client’s document request. Working files, archives and backups require purpose-based access. Once all processing grounds cease, erasure, destruction or anonymisation obligations arise. Any refusal based on lawful retention must be explained.

Cookies and choices

mrs_privacy remembers the decision, version and time for 180 days. mrs_session is only for administration and has an eight-hour session lifetime. No advertising or analytics tool runs; fonts and images are served locally. External maps start disabled. You can withdraw permission through cookie preferences without losing access to contact information. Withdrawal cannot undo previous transfers or remove third-party cookies retrospectively.

Rights under KVKK

KVKK Art.11 covers information about processing, purposes and recipients; correction; erasure or destruction where statutory conditions apply; notification to recipients; objection to adverse outcomes based solely on automated analysis; and compensation for unlawful processing. A purchase of legal services is not a general condition for exercising these rights.

Making a request

Send a signed written request to the office address. Electronic applications must use a method permitted by the relevant Communiqué; ordinary email requires an address previously supplied and recorded in the controller’s system. [email protected] is the proposed privacy channel; if delivery cannot be confirmed, use a written application. Include the required identity, nationality/identification, notification address and request details. Verification must be proportionate; do not upload identity copies to the general form.

Response and complaint

KVKK applications are answered promptly and within thirty days, normally free of charge subject to the Board’s permitted cost tariff. A complaint to the Board follows an application to the controller. The thirty-day period after learning the response and the overall sixty-day period after applying must be assessed with the rules for late or absent responses.

When GDPR applies

GDPR applicability depends on Art.3, including EU establishment, directing services to people in the EU or monitoring their behaviour there. Language or nationality alone is not decisive. Where applicable, Arts.6, 9, 10 and Chapter V require separate assessment. Conditional rights include access, correction, erasure, restriction, portability, objection and complaint. The usual response period is one month; a necessary two-month extension and its reasons must be communicated within the first month. Consent can be withdrawn for consent-based processing.

Security and updates

Validation, rate limits, administrator permissions and session controls form part of security. Application request logs exclude message bodies and passwords; hosting, backups and access practices need separate management. No absolute security guarantee is given. Incident duties are assessed under KVKK Art.12 and decision 2019/10, and GDPR Arts.33–34 where applicable. Changes to processing require updated information. Notice version: 2026-09-v3.

Relevant legislation and official sources

KVKK requests: [email protected]

Email: [email protected]

Your personal data and rights.