This Privacy Notice has been prepared by Bilgin & Albayrak Legal & Consultancy, acting as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (PDPL) and the Communique on the Principles and Procedures for Fulfilling the Obligation to Inform. Our firm treats the protection of personal data as a fundamental obligation and conducts all personal data processing activities in full compliance with applicable legislation, including the GDPR principles as international best practice benchmarks.
The data controller within the meaning of the PDPL No. 6698 is:
Name: Bilgin & Albayrak Legal & Consultancy
Address: Ünalan Mah. Libadiye Cad. Emaar Square Heights 82/E No:612 Üsküdar, İstanbul
E-mail: info@bilginalbayrak.av.tr
Website: www.bilginalbayrak.av.tr
The firm operates in compliance with Bar Law No. 1136 and the PDPL, and fully observes the duty of confidentiality arising from the attorney-client relationship.
Depending on the nature of the relationship established with our firm, the following categories of personal data may be processed. All processing is conducted in accordance with the general principles set out in Article 4 of the PDPL — lawfulness and fairness, accuracy and being up to date, processing for specified, explicit and legitimate purposes, relevance and proportionality, and erasure when no longer necessary.
| Category | Examples of Personal Data | Legal Basis (PDPL Art. 5 / Art. 6) |
| Identity Data | Full name, national ID number, passport number, tax identification number | Art. 5(2)(c) – conclusion/performance of a contract; Art. 5(2)(a) – expressly provided by law |
| Contact Data | Phone number, e-mail address, postal address | Art. 5(2)(c) – contract performance; Art. 5(2)(f) – legitimate interest |
| Professional Data | Title, position, employer name and industry | Art. 5(2)(c) – contract performance; Art. 5(2)(f) – legitimate interest |
| Legal Transaction Data | Case file, petitions, legal correspondence, power of attorney, contract documents | Art. 5(2)(a) – expressly provided by law; Art. 5(2)(e) – establishment or protection of a right |
| Financial Data | Invoice details, payment history, bank account/IBAN number | Art. 5(2)(a) – Tax Procedure Law, AML legislation; Art. 5(2)(c) – contract performance |
| Special Category Personal Data | Data relating to criminal convictions and security measures (only within case scope) | Art. 6(3) – provided by law or explicit consent; Turkish Code of Criminal Procedure & Bar Law No. 1136 |
| Digital / Technical Data | IP address, cookie data, website visit information, browser type | Art. 5(2)(f) – legitimate interest; Art. 5(1) – explicit consent (analytics cookies) |
Your personal data is processed solely for the following purposes and only to the extent necessary to achieve them:
Your personal data is collected through verbal communications, written correspondence (e-mail, post), website contact forms, documents submitted by clients, and publicly available registers and records, both by automated and non-automated means, for the purposes set out above. Such data is processed on the following legal bases as specified in Articles 5 and 6 of the PDPL:
Your personal data may be transferred to the recipient groups listed below in accordance with Articles 8 and 9 of the PDPL. Transfers abroad are carried out only where the safeguards required under Article 9 of the PDPL are in place (a country determined to provide adequate protection by the Personal Data Protection Board, or explicit consent).
| Recipient Group | Purpose of Transfer | Legal Basis |
| Competent courts, enforcement offices, public prosecutors and arbitral tribunals | Conduct of litigation and legal proceedings; service of requests and decisions | PDPL Art. 5(2)(a) – expressly provided by law |
| Public authorities and regulatory bodies (Ministry of Justice, SGK, Tax Authority, Land Registry, etc.) | Fulfilment of statutory obligations | PDPL Art. 5(2)(a) |
| Certified public accountants and accounting service providers | Billing, tax compliance and accounting processes | PDPL Art. 5(2)(c) and Art. 5(2)(f) |
| Technical service providers (cloud infrastructure, software systems) | Operation and security of IT infrastructure | PDPL Art. 5(2)(f) – legitimate interest |
| Opposing counsel or representatives (to the extent required by the proceedings) | Mandatory disclosure arising from legal proceedings conducted on behalf of the client | PDPL Art. 5(2)(e) – establishment or protection of a right |
Your personal data is erased, destroyed or anonymised in accordance with Article 7 of the PDPL and the Regulation on Erasure, Destruction or Anonymisation of Personal Data once the purpose of processing has ceased, statutory retention periods have expired and the firm’s legitimate interest has ended.
Under Article 11 of the PDPL No. 6698, individuals whose personal data is processed have the following rights:
You may exercise these rights by submitting a request to our firm through the methods established by the Personal Data Protection Authority (KVKK). Your application will be concluded within thirty (30) days at the latest.
To exercise your rights under Article 11 of the PDPL, please contact us through one of the following channels. Your request must include documents enabling us to verify your identity and a clear statement of your request:
We will process your request after verifying your identity. Your right to lodge a complaint with the Personal Data Protection Authority (kvkk.gov.tr) is reserved.
