This policy explains what personal data Bayraktar Attorneys processes when you visit bayraktarattys.com, write to us, or book a consultation — and what you can require us to do about it. It is written against Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, the EU General Data Protection Regulation.
1. Who is responsible for your data
The data controller is Bayraktar Attorneys, a law office in İstanbul whose attorneys are registered with the Istanbul Bar Association, led by Founding Attorney Nevzat Oğulcan Bayraktar.
| Address | Esentepe, Talatpaşa Cd. No:5/1, 34394 Şişli/İstanbul, Türkiye |
|---|---|
| [email protected] | |
| Telephone | +90 539 935 2875 |
2. Two different relationships — and why the difference matters
This policy covers website visitors and enquirers. It does not govern the file of an existing client.
Once you engage the firm, everything you tell us falls under attorney–client professional secrecy under Article 36 of Attorneyship Law No. 1136. That obligation is stricter than this policy and is not limited by it: a client file is not disclosed to third parties on request, and a request to erase data from it is answered within the limits that the law and the courts impose on an attorney holding a case file.
Do not send case details through this website. The contact form is for arranging a first conversation, not for describing a legal problem. Please do not include identity numbers, passport or title-deed copies, health or criminal-record information, or anything else you would not want to send by ordinary e-mail. Nothing you send before an engagement is agreed creates an attorney–client relationship — see our legal disclaimer.
3. What we process, why, and on what legal ground
| Data | Purpose | Legal ground |
|---|---|---|
| Contact form — first name, last name, e-mail address, your message, IP address, time of submission | To answer your enquiry and take the steps you asked for before a possible engagement; to detect spam and abuse of the form | KVKK Art. 5/2(c) — necessary in connection with a contract, at your request; and Art. 5/2(f) legitimate interest. GDPR Art. 6(1)(b) and (f) |
| Direct correspondence — what you send by e-mail, telephone or WhatsApp | To reply and to keep a record of what was asked and answered | KVKK Art. 5/2(c) and 5/2(f); GDPR Art. 6(1)(b) and (f) |
| Appointment booking — name, e-mail address and the slot you choose, through Calendly | To schedule and confirm a consultation | KVKK Art. 5/2(c); GDPR Art. 6(1)(b) |
| Technical and security data — IP address, browser and device signals, pages requested, and the security signals our CDN produces | To deliver the site, keep it available, and defend it against attack and automated abuse | KVKK Art. 5/2(f) legitimate interest; GDPR Art. 6(1)(f) |
| Analytics and session recording — pseudonymous identifiers, pages viewed, clicks, scrolling and, through Yandex Metrica Webvisor, a replay of your interaction with the page | To understand which guides are read and where the site is confusing | Your explicit consent only — KVKK Art. 5/1; GDPR Art. 6(1)(a) |
| Marketing cookies | To measure campaigns | Your explicit consent only |
Analytics and marketing are switched off by default. Nothing in those two rows happens until you accept them in the cookie banner, and you can switch them off again at any time. How that works, and which cookies are involved, is set out in the cookie policy.
We do not sell personal data, we do not share it with data brokers, and we do not make decisions about you by automated means alone.
4. Who else sees the data
We use the following service providers. Each receives only what its function requires.
- Cloudflare, Inc. — content delivery, web application firewall, bot protection and e-mail address obfuscation. Necessary for the site to run; active for every visitor.
- Our hosting and e-mail providers — storage of the site and delivery of the message you send through the contact form.
- Google Ireland Limited — Google Analytics 4. Only after you consent.
- Yandex — Yandex Metrica, including Webvisor session replay. Only after you consent.
- Calendly LLC — appointment booking, on the pages where a booking widget is offered.
- Google — web fonts, and the map embedded on the contact page. Loading these discloses your IP address to Google.
- jsDelivr — delivery of the open-source interface library the site is built on.
Beyond these, personal data is disclosed only where a court, a prosecutor or another public authority is legally entitled to demand it, and only to the extent the demand is lawful. An attorney's duty of professional secrecy is asserted wherever it applies.
5. Transfers outside Türkiye
Several of the providers above operate infrastructure outside Türkiye. Transfers abroad are governed by Article 9 of Law No. 6698 as amended by Law No. 7499 in March 2024, which permits a transfer where there is an adequacy decision, or an appropriate safeguard such as standard contractual clauses notified to the Personal Data Protection Authority, or — failing both — on your explicit consent for that specific transfer.
For the consent-gated tools this has a simple practical consequence: if you decline analytics and marketing cookies, no data reaches Google or Yandex at all. For the providers that are necessary to serve the site, we rely on the contractual safeguards those providers make available.
6. How long we keep it
- Enquiries that do not lead to an engagement — two years from our last exchange, so that we can recognise a conflict of interest and show what was said if a dispute arises. Then deleted.
- Client files — for the period required by Article 39 of Attorneyship Law No. 1136 and by the limitation periods that apply to the matter, after which documents are returned or destroyed.
- Technical and security records — a short period, no longer than the security purpose requires.
- Analytics data — the retention configured in the relevant provider's own settings. Withdrawing consent stops further collection.
7. How it is protected
The site is served over TLS, sits behind a web application firewall, and the contact form is rate-limited against automated abuse. Access to enquiries and client files is limited to the firm's attorneys and staff, all of whom are personally bound by professional secrecy. No transmission over the internet is perfectly secure, which is the reason for the warning in section 2.
8. Your rights
Article 11 of Law No. 6698 gives you the right to:
- learn whether your personal data is processed, and request information if it is;
- learn the purpose of processing and whether the data is used in line with it;
- know the third parties, in Türkiye or abroad, to whom it is transferred;
- have incomplete or inaccurate data corrected, and have the correction notified to those third parties;
- request erasure or destruction where the grounds for processing have fallen away, and have that notified to those third parties;
- object to a result reached solely by automated analysis that works against you;
- claim compensation for loss caused by unlawful processing.
If you are in the EEA or the United Kingdom, the GDPR additionally gives you rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting processing already carried out.
9. How to exercise them
Write to [email protected] from the address you have previously used with us, or send a signed letter to the postal address in section 1. Applications by registered electronic mail (KEP), secure electronic signature or mobile signature are also accepted, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller.
Please state your name, your contact details, and the request itself clearly. We answer within 30 days at the latest, free of charge in principle; where a request genuinely requires additional cost, the fee tariff in that Communiqué applies.
If our answer does not satisfy you, or if no answer arrives, you may complain to the Personal Data Protection Board within 30 days of receiving the answer and in any event within 60 days of your application. If the GDPR applies to you, you may also complain to your local supervisory authority.
The disclosure notice we publish specifically under Article 10 of Law No. 6698 is on a separate page: KVKK disclosure notice.
10. Children
This website is aimed at adults instructing a law firm. We do not knowingly collect data from children. If you believe a child has sent us personal data, write to us and we will delete it.
11. Changes
The date at the top of this page is the date of the current version. Where a change materially affects how we handle your data, we say so on the site rather than changing the text silently.
12. Contact
Questions about this policy go to [email protected], or use the contact page. See also our terms of use and legal disclaimer.
