This is the disclosure notice (aydınlatma metni) that Bayraktar Attorneys publishes under Article 10 of Turkish Personal Data Protection Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.
It is a standalone notice, separate from any consent you give. Our broader explanation of data handling, including rights under the GDPR, is in the privacy policy; the cookies involved are listed in the cookie policy.
1. Identity of the data controller
| Data controller | Bayraktar Attorneys — a law office whose attorneys are registered with the Istanbul Bar Association, led by Founding Attorney Nevzat Oğulcan Bayraktar |
|---|---|
| Address | Esentepe, Talatpaşa Cd. No:5/1, 34394 Şişli/İstanbul, Türkiye |
| [email protected] | |
| Telephone | +90 539 935 2875 |
2. Personal data processed
- Identity data — first name, surname.
- Contact data — e-mail address, telephone number where you give it, and the content of your message.
- Transaction security data — IP address, browser and device signals, the pages requested, the time of the request, and the security signals produced by our content delivery and firewall provider.
- Marketing and audience data — pseudonymous identifiers, pages viewed, clicks, scrolling, and session replay through Yandex Metrica Webvisor. Processed only if you give explicit consent through the cookie banner.
- Scheduling data — the name, e-mail address and time slot you enter when booking a consultation.
We ask you not to send special categories of personal data — health information, criminal conviction or security records, biometric or religious data — through this website. Where such data is genuinely necessary for a legal matter, it is collected within the engagement, not through a web form.
3. Purposes of processing
- Answering enquiries received through the website, e-mail, telephone or WhatsApp, and taking the preparatory steps you request before a possible engagement;
- Carrying out the conflict-of-interest check that professional rules require before the firm can act;
- Arranging and confirming consultation appointments;
- Ensuring the security of the website and its information systems, and preventing automated abuse of the contact form;
- Where you have consented, measuring how the site is used so that its guides and navigation can be improved;
- Fulfilling obligations imposed on the firm by legislation, and establishing, exercising or protecting a right where a dispute arises.
4. Method of collection and legal ground
Personal data is collected by electronic means: the contact form and appointment widget on this website, messages you send to our published e-mail address or WhatsApp number, and the automatic records produced by our servers and security provider when your browser requests a page.
| What | Legal ground under Article 5 |
|---|---|
| Contact form, correspondence, appointment booking | Art. 5/2(c) — directly related to the conclusion or performance of a contract, and necessary for steps taken at your request |
| Conflict check; retention of the enquiry record | Art. 5/2(ç) — compliance with a legal obligation; Art. 5/2(f) — legitimate interests of the controller, without prejudice to your fundamental rights |
| Server and security records | Art. 5/2(f) — legitimate interest in the security of the site |
| Establishing or defending a legal claim | Art. 5/2(e) — necessary for the establishment, exercise or protection of a right |
| Analytics, session replay and marketing cookies | Art. 5/1 — your explicit consent. Nothing here is processed until you accept it, and you may withdraw at any time |
5. To whom the data may be transferred, and why
Under Articles 8 and 9 of Law No. 6698, personal data may be transferred:
- to our hosting and e-mail service providers, so that the site can be served and your message delivered;
- to Cloudflare, which provides content delivery, firewall and bot protection for every visitor;
- to Calendly, where you use the appointment booking widget;
- to Google and Yandex, for measurement — only where you have given explicit consent;
- to courts, enforcement offices, public authorities and regulators, where legislation obliges or entitles them to receive it;
- to the firm's own attorneys and staff, each of whom is personally bound by professional secrecy.
Several of these providers operate infrastructure outside Türkiye. Transfers abroad are made in accordance with Article 9 as amended by Law No. 7499 of March 2024 — that is, on the basis of an adequacy decision, or an appropriate safeguard such as standard contractual clauses notified to the Personal Data Protection Authority, or your explicit consent for the specific transfer. Where the transfer depends on consent, declining the relevant cookie category prevents it entirely.
6. Retention
Enquiries that do not lead to an engagement are kept for two years from the last exchange and then deleted. Client file data is kept for the period required by Article 39 of Attorneyship Law No. 1136 and by the limitation periods applicable to the matter. Security records are kept only as long as the security purpose requires. Data processed on consent is deleted, destroyed or anonymised when consent is withdrawn or the purpose lapses.
7. Professional secrecy
Where personal data forms part of a client file, the attorney's duty of confidentiality under Article 36 of Attorneyship Law No. 1136 applies in addition to this notice. That duty is not overridden by a third party's request, and a request concerning such data is answered within the limits Article 28 of Law No. 6698 and the professional rules impose on an attorney holding a file.
8. Your rights under Article 11
By applying to the firm, you may:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether the data is used in accordance with it;
- know the third parties, in Türkiye or abroad, to whom it is transferred;
- request correction of incomplete or inaccurate data;
- request erasure or destruction under Article 7, where the grounds for processing no longer exist;
- request that a correction, erasure or destruction be notified to the third parties to whom the data was transferred;
- object to a result against you produced by analysing the data exclusively through automated systems;
- claim compensation for damage suffered through unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request in Turkish or English:
- as a signed written application delivered in person or by notary to Esentepe, Talatpaşa Cd. No:5/1, 34394 Şişli/İstanbul, Türkiye; or
- by registered electronic mail (KEP), secure electronic signature or mobile signature; or
- by e-mail to [email protected] from an address you have previously notified to us.
State your name and surname, your address or e-mail for the reply, the subject of your request, and — if you are a Turkish citizen — your T.C. identity number, so that we can confirm the request is really yours.
We answer within 30 days at the latest. The answer is free of charge in principle; where responding genuinely requires additional cost, the fee tariff in the Communiqué applies. If the request is refused, if the answer is inadequate, or if no answer arrives in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer and in any event within 60 days of the date of your application.
10. Changes
The date at the top of this page shows the version in force. Where this notice changes in a way that affects you, we publish the change rather than amending the text silently.
