Privacy and data protection notice

Last updated: 30 September 2026.

Article 10 of the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, “KVKK”) requires a data controller, at the time personal data is collected, to inform you of the identity of the controller and of its representative if it has one, the purposes for which the data will be processed, to whom and for what purpose it may be transferred, the method and legal ground of collection, and the other rights listed in Article 11. This notice covers each of those, in that order. It is written to be read, not to be agreed to.

1. Who is responsible for your data

The data controller is Istanbul Attorneys, an office of advocates registered with the Istanbul Bar Association (İstanbul Barosu), working in strategic partnership with Lexin Legal. There is no separate representative.

• Address: Gürsel Mah. Karataş Sk., SNS Plaza, Kat 3 No 6, 34413 Kağıthane / İstanbul, Türkiye
• E-mail: info@istanbulattorneys.com
• Telephone and WhatsApp: +90 544 809 1942

Any request about your personal data can be sent to either the e-mail address or the postal address above. Section 10 explains what happens next and how long it takes.

2. What this notice covers, and what it does not

It covers the personal data processed through this website — the contact form, the links that open your telephone, e-mail or WhatsApp application, and the data your browser sends when you open any page — together with what you send us directly by those routes.

It does not replace the engagement terms and the professional confidentiality that apply once you instruct this office. Those are agreed with you directly and they go further than this notice; section 9 explains why.

3. What is collected, and where it comes from

What you type into the contact form. Your name, your e-mail address, your telephone or WhatsApp number, the matter type you pick from the list, and the message you write. The form also carries one field that is hidden from you and visible only to automated scripts; anything filled into it causes the submission to be discarded, and it is used for nothing else.

What you send directly. Whatever you choose to write in an e-mail or a WhatsApp message, or say on a call. People often write the whole of a sensitive matter in a first message. That is treated as described in section 9, but you are not obliged to include detail before you know who you are writing to.

What your browser sends. Standard request data — IP address, the address requested, the time, and the browser and operating-system string — is recorded by the hosting provider so the pages can be served and so abuse can be identified. This happens on every website you open and does not depend on your cookie choice.

Usage data, and only if you accept. Described in section 4.

What is not collected. The two calculators on this site — the property purchase cost calculator and the foreign judgment enforcement checker — run entirely inside your browser. The figures and answers you enter are never sent to this office or to anyone else, they are not stored, and they are gone when you close the tab. This website carries no advertising, no social-media tracking pixel, no embedded map, no comment system, no chat widget and no third-party font: the typefaces are served from this domain. The only external script the site is permitted to load is the Google Analytics tag described next, and that only after you accept it.

4. Cookies, analytics, and how to change your mind

Nothing is stored on your device until you choose. On a first visit a banner asks you to accept or decline analytics cookies. Until you answer, and also if you answer Decline, this site sets no cookie of any kind — that was measured in a clean browser on 30 September 2026, and it is the reason the banner blocks nothing while it waits for an answer.

If you accept, Google Analytics 4 (measurement identifier G-ER3DEFB89B) sets the two cookies below. They hold a randomly generated identifier and a session counter. They do not hold your name, your e-mail address, your telephone number or anything you wrote.

Your answer to the banner is not itself a cookie. It is kept in your browser’s local storage under the key ia_consent so that you are not asked twice. It never leaves your device and it is not sent to this office.

Advertising is switched off at the tag, not merely unused. Under Google Consent Mode the signals ad_storage, ad_user_data and ad_personalization are set to denied before the Analytics tag loads, and accepting the banner changes only analytics_storage. The content-security policy this site is served with does not permit any advertising or tag-management domain other than the one that delivers the Analytics tag itself, so a marketing tag cannot be added to a page without that policy being changed first.

Changing or withdrawing your choice. Use the control below. It takes effect immediately, it can be used as often as you like, and declining also deletes the two cookies in the table from this domain. Nothing on this website is withheld, delayed or degraded because you declined.

5. Why the data is processed, and on what legal ground

Article 5(1) of Law No. 6698 states the rule the whole statute is built on: personal data cannot be processed without the explicit consent of the data subject. The grounds in Article 5(2) are the exceptions that make consent unnecessary. Analytics is not one of them, which is why it is the one purpose above that waits for you to say yes.

6. Who else handles it

Personal data is not sold, and it is not shared for anyone else’s marketing. Apart from the lawyers and staff in this office who need to see a matter, it reaches only the providers that run this website and carry its mail:

• Vercel — hosts the site and runs the small server function that handles the contact form. It keeps standard request logs.
• Brevo — delivers the contact-form message to the office mailbox as an e-mail. The form is not written to any database: the server function forwards the message and keeps no copy, and the content of your message is never written to a log.
• Google Workspace — the mail service on which info@istanbulattorneys.com is received and kept.
• Google, for Google Analytics 4 — measures site usage, and only after you accept.
• WhatsApp, and your telephone or e-mail provider, if you reach us by those routes. Those services are run by third parties under their own terms and their own notices; a WhatsApp message is handled on their infrastructure, not on ours, before it reaches us.

Data is also disclosed where a law, a court or a competent authority requires it. Article 8 of Law No. 6698 sets the conditions for transfers inside Türkiye; transfers abroad are dealt with next.

7. Transfer outside Türkiye

Article 9 of Law No. 6698, as replaced on 2 March 2024 by Article 34 of Law No. 7499, governs transfers abroad. It allows a transfer where one of the conditions in Article 5 or Article 6 is met and the Personal Data Protection Board has issued an adequacy decision for the destination country, sector or international organisation. Where there is no adequacy decision, the transfer is allowed if one of the appropriate safeguards listed in Article 9(4) is provided — among them the standard contract published by the Board, which has to be notified to the Authority within five working days of signature — and provided you are able to exercise your rights and to seek effective legal remedies in that country. Where neither route is available, Article 9(6) permits a transfer only on an incidental basis and only in the cases it lists, which include your explicit consent given after you have been informed of the possible risks, and necessity for the performance of a contract between you and the controller.

In practice: Google operates its Analytics infrastructure outside Türkiye, so accepting analytics cookies involves a transfer abroad. That transfer rests on the explicit consent you give through the banner, and it stops when you withdraw it in section 4. The hosting and mail providers listed in section 6 also operate servers outside Türkiye, so a message you send reaches the office across a border. If you want to know which provider holds what, or the basis relied on for a particular transfer, ask and you will be told.

8. How long it is kept

• An enquiry that does not become a file. Kept in the office mailbox for as long as it takes to deal with it and to answer any follow-up. Deleted earlier if you ask.
• A file this office acts on. Article 39 of the Advocacy Act No. 1136 obliges an advocate to keep the documents entrusted to them for three years from the end of the mandate; where the client has been asked in writing to collect the documents, that obligation ends three months after the notice. The file is kept for that statutory period and for any longer period another law or a professional obligation requires, then deleted or anonymised.
• Analytics data. Google deletes the user-level and event-level data automatically at the end of the retention period set on the property. On the standard, non-360 version of Google Analytics that this site uses, the periods Google offers for user-level data are two months and fourteen months; nothing longer can be selected. The cookies themselves expire as shown in section 4, or sooner if you delete them.
• Server logs. Kept by the hosting provider under its own retention policy. This office keeps no separate copy.

Article 7 of Law No. 6698 requires personal data to be erased, destroyed or anonymised — on the controller’s own initiative or at your request — once the reasons that made the processing necessary have gone, even where the processing was lawful when it happened.

9. Professional secrecy sits above this notice

What you write to a lawyer is not protected only by data-protection law. Article 36 of the Advocacy Act No. 1136 prohibits advocates from disclosing matters entrusted to them or learned by reason of their duties. It makes their ability to give evidence about such matters conditional on the client’s consent, and provides that even with that consent the advocate may still decline to testify — and that exercising the right to decline gives rise to no civil or criminal liability.

That duty applies from your first message, whether or not you go on to instruct this office, and it does not end when a matter does. Where it and this notice would point in different directions, the duty of secrecy governs.

10. Your rights, and what to do to use them

Article 11 of Law No. 6698 gives you the right to apply to the data controller and:

• learn whether your personal data is being processed;
• request information about it, if it has been processed;
• learn the purpose of the processing, and whether the data is being used in accordance with that purpose;
• know the third parties, in Türkiye or abroad, to whom the data has been transferred;
• have the data corrected if it has been processed incompletely or inaccurately;
• have it erased or destroyed, within the conditions set out in Article 7;
• have a correction or an erasure notified to the third parties the data was transferred to;
• object to a result reached against you through analysis carried out solely by automated systems;
• claim compensation if you have suffered loss because the data was processed in breach of the law.

How to apply. Write to info@istanbulattorneys.com, or to the postal address in section 1. Article 13 requires the controller to conclude the request as quickly as its nature allows and in any event within thirty days, free of charge; a fee from the tariff set by the Board may be charged only where carrying the request out actually costs money, and it is refunded if the request arose from the controller’s own error. You will be told, in writing or electronically, either that the request is granted or why it is refused.

If the answer does not satisfy you. Article 14 lets you complain to the Personal Data Protection Board within thirty days of learning the controller’s answer and, in any event, within sixty days of the date of your application. The Article 13 route has to be used first: a complaint cannot be made before it has been exhausted. Article 14(3) preserves your right to compensation under the general law where your personality rights have been infringed.

If the GDPR applies to you — for instance because you are in the European Economic Area when you write — then alongside the rights above you have those Regulation (EU) 2016/679 gives: access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21), and the right to lodge a complaint with a supervisory authority (Article 77). Where processing rests on your consent, you may withdraw it at any time; withdrawal does not make earlier processing unlawful.

11. Security

The site is served only over an encrypted connection, with HTTP Strict Transport Security set for two years, and a content-security policy restricts what any page is allowed to load: framing and plug-in content are blocked outright, forms can only post back to this domain, and no inline script is permitted to run at all — which is why the analytics and consent code on this site lives in separate files rather than inside the pages.

The contact form is delivered to the office mailbox and is not stored in a database on this site. No transmission over the internet is completely secure. If a matter is sensitive, say so before you send the detail and a route can be agreed first.

12. Children

This website and its form are intended for adults. Personal data is not knowingly collected from children. If you believe a child has sent personal data through this site, write to the address in section 1 and it will be deleted.

13. Changes to this notice

This notice is updated when the practice or the law changes — Article 9 above, for one, was rewritten by statute in March 2024. The date at the top of the page identifies the current version. Earlier versions are not kept online, so if you need to know what the notice said on a particular date, ask.