Privacy Notice (KVKK)

Last updated: October 16, 2026

Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is Av. Kaan Karanfiloğlu (Karanfiloglu Law Firm), registered with the Istanbul Bar Association under no. 58270. Address: Mecidiyeköy Mah. Büyükdere Cad. No:67-71 Alba İş Merkezi Kat:8, 34387 Şişli / İstanbul. Email: karanfiloglu.lawyer@gmail.com. Phone: +90 532 659 35 11. Office for client meetings (by appointment): Merkez Mah. Hasat Sk. No:12, 34384 Şişli / İstanbul.

Personal data we process

When you contact us through the contact form, by email, phone or WhatsApp:

identity and contact data: full name, email address, phone number (optional);
the content of your request and anything else you choose to include in your message (this may include special categories of data);
transaction security data: the page you sent the form from, the date and time, the consents you gave;
if you accept analytics cookies: page views, device and browser data (Google Analytics).

Please share only what is needed to describe your request at first contact; documents and sensitive data can be sent securely once an engagement has been agreed.

Purposes

to assess your request and reply to you;
if an engagement follows, to carry out the preparatory steps and a conflict-of-interest check;
to meet our obligations under the rules of the legal profession;
with your consent, to measure and improve the use of the website.

Legal bases

We process your data under KVKK art. 5(2): (c) steps directly related to entering into or performing a contract, (ç) compliance with a legal obligation, (e) establishing, exercising or protecting a right, and (f) legitimate interest. Analytics cookies and the transfers abroad described below are based on your explicit consent (KVKK art. 5(1) and art. 9).

How we collect it

Electronically, partly by automated means, through the website contact form, email, phone and WhatsApp.

Recipients and transfers abroad

Your data is transferred to the following infrastructure providers:

Amazon Web Services EMEA SARL: website and contact form infrastructure (servers in Frankfurt, Germany);
Google Ireland Limited / Google LLC: email; Google Analytics if you consent; Google Maps if you open the map;
WhatsApp (Meta Platforms Ireland Limited): only if you choose to write to us on WhatsApp.

Their servers are outside Türkiye, so these are transfers under KVKK art. 9, based on the explicit consent you give in the contact form. If you do not wish to consent, you can reach us by phone or at our office instead of using the form. We do not share your data with other third parties, except public authorities entitled by law, and we do not use it for marketing.

Retention periods

We keep personal data only for as long as the purpose requires:

Enquiries that do not lead to an engagement (message content and contact details): at most 1 year after the last correspondence;
A minimal conflict-of-interest record (name, opposing party, subject and date): 10 years (the professional duty to avoid conflicts of interest and legitimate interest; Turkish Code of Obligations art. 146);
Engagement files: 10 years after the engagement ends (Code of Obligations art. 146; for financial records, Turkish Commercial Code art. 82 and Tax Procedure Law art. 253);
Records of the consents you gave: together with the related enquiry record;
Server and security logs (AWS): 14 days;
Analytics data (only if you consented): 14 months.

When a period ends, the data is erased, destroyed or anonymised in the periodic destruction carried out at least every 6 months under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. If a dispute or an official request is pending, the data concerned may be kept until it is resolved.

Data security

All communication with the website is encrypted (HTTPS/TLS). Form messages reach the lawyer only, and the mailbox is protected with two-step verification. Our infrastructure providers operate under international information security standards (ISO/IEC 27001). Access to personal data is covered by the lawyer's duty of professional secrecy.

Your rights (KVKK art. 11)

to learn whether your data is processed and to request information about it;
to learn the purpose of processing and whether it is used accordingly;
to know the third parties in Türkiye or abroad to whom it is transferred;
to request correction of incomplete or inaccurate data, erasure or destruction under KVKK art. 7, and notification of these to recipients;
to object to a result against you arising solely from automated analysis;
to claim compensation for damage caused by unlawful processing;
to withdraw your consent at any time.

How to apply

Send your request in writing to Mecidiyeköy Mah. Büyükdere Cad. No:67-71 Alba İş Merkezi Kat:8, 34387 Şişli / İstanbul, or by email to karanfiloglu.lawyer@gmail.com, in line with the Communiqué on the Procedures for Applications to the Data Controller. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Board.

Persons under 18

This site is not directed at persons under 18. Please have a parent or guardian contact us on behalf of a minor.

Changes

We may update this notice to reflect legal or technical changes. The current version is always published on this page with its last-updated date.