PERSONAL DATA PROTECTION NOTICE

1. Purpose

This Personal Data Protection Notice (“Privacy Notice”) has been prepared by DYC Law and Consultancy (the “Law Firm”) to explain the principles governing the processing of personal data obtained from natural persons with whom the Law Firm interacts in the course of its activities, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK” or the “Law”) and other applicable legislation.

2. General Principles Applicable to the Processing of Personal Data

Personal data is processed by the Law Firm in accordance with the Constitution of the Republic of Türkiye, the KVKK, other applicable legislation and the regulations and guidance issued by the Personal Data Protection Authority.

In this context, the Law Firm observes the following principles when processing personal data.

2.1. Processing Lawfully and Fairly

Personal data is processed lawfully and fairly in accordance with the Constitution of the Republic of Türkiye, the KVKK and other applicable legislation.

2.2. Ensuring Accuracy and, Where Necessary, Keeping Data Up to Date

The Law Firm takes the necessary measures to ensure that the personal data it processes is accurate and up to date.

Where any inaccuracy in personal data is identified, the relevant records are corrected as soon as reasonably possible. Where personal data changes, the necessary updates are made.

2.3. Processing for Specified, Explicit and Legitimate Purposes

Personal data is processed for specified, explicit and legitimate purposes in accordance with the KVKK and within the scope of the Law Firm’s activities, obligations and commitments.

2.4. Processing in a Relevant, Limited and Proportionate Manner

The Law Firm processes only the personal data that is relevant to the purpose of the processing and necessary for the conduct of its activities.

Personal data that is unrelated to the purpose of processing or falls outside the Law Firm’s field of activity is not processed.

2.5. Retaining Personal Data for the Period Prescribed by Applicable Legislation or Required for the Purpose of Processing

Personal data is retained for the periods prescribed by applicable legislation.

Where no specific retention period is prescribed by law, personal data is retained for as long as necessary for the purpose for which it was processed.

Following the expiry of the applicable retention periods, personal data is deleted, destroyed or anonymised in accordance with the Law Firm’s Personal Data Retention and Destruction Policy.

3. Methods of Collecting and Processing Personal Data

Personal data may be collected through the following channels when an individual contacts the Law Firm or enters into a legal services relationship with the Law Firm:

• Printed or online forms;
• Telephone;
• Fax;
• Email;
• Courier and postal services;
• Electronic communication systems;
• Documents delivered in physical form;
• Automated means; and
• Non-automated means, provided that the data forms part of a data filing system.

4. Categories of Personal Data Processed

The principal categories of personal data that may be processed by the Law Firm are explained below.

4.1. Identity Data

Identity data may be collected from individual clients, prospective individual clients, natural person representatives, employees or shareholders of corporate clients, individual suppliers and natural person representatives, employees or shareholders of corporate suppliers.

Such data may include, without limitation:

• First name and surname;
• Turkish identity number;
• Nationality;
• Mother’s and father’s names;
• Marital status;
• Identity card serial and sequence numbers;
• Place of birth;
• Date of birth;
• Gender;
• Signature and initials; and
• Other information contained in copies of driving licences, passports or identity documents.

4.2. Contact Data

Contact data may be collected from individual clients, prospective individual clients, natural person representatives, employees or shareholders of corporate clients, individual suppliers and natural person representatives, employees or shareholders of corporate suppliers.

Such data may include:

• Telephone number and extension number;
• Fax number;
• Postal address;
• Registered electronic mail address; and
• Personal or business email address.

4.3. Legal Transaction Data

Legal transaction data may be collected from individual clients, prospective individual clients, corporate clients and natural person representatives, employees or shareholders of corporate clients.

Such data may include:

• Information relating to the establishment and pursuit of legal claims and rights;
• Information relating to the discharge of debts and obligations;
• Information relating to legal and contractual obligations;
• Litigation, enforcement and case file information;
• Information contained in court judgments and decisions of administrative authorities; and
• Documents and records relating to legal disputes and advisory matters.

4.4. Financial Data

Financial data may be collected from individual clients, prospective individual clients, corporate clients and natural person representatives, employees or shareholders of corporate clients.

Such data may include:

• Bank account information;
• Account number;
• Bank and branch name;
• IBAN;
• Payment information;
• Contract value;
• Security or guarantee amount; and
• Receivable and payable balances.

4.5. Visual Data

Visual data may be collected from individual clients, prospective individual clients, corporate clients and natural person representatives, employees or shareholders of corporate clients.

Such data may include photographs and video recordings that do not fall within the scope of physical premises security data.

4.6. Special Categories of Personal Data

Special categories of personal data may be collected from individual clients, prospective individual clients, corporate clients and natural person representatives, employees or shareholders of corporate clients.

Such data may include:

• Medical reports and health information;
• Blood group information; and
• Information relating to criminal convictions and security measures.

5. Legal Grounds for Processing and Transferring Personal Data

Under Article 20 of the Constitution of the Republic of Türkiye and the provisions of the KVKK, personal data may only be processed in circumstances prescribed by law or with the explicit consent of the data subject.

Explicit consent must relate to a specific matter, be based on adequate information and be given freely.

However, personal data may also be processed without explicit consent where one of the conditions set out in Article 5(2) of the KVKK applies.

5.1. Processing Expressly Permitted by Law

Where the processing of personal data is expressly permitted by applicable legislation, personal data may be processed and transferred without obtaining the explicit consent of the data subject.

5.2. Necessity for the Protection of Life or Physical Integrity

Personal data may be processed and transferred without explicit consent where processing is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is physically incapable of giving consent or their consent is not legally valid.

5.3. Necessity for the Establishment or Performance of a Contract

Personal data may be processed and transferred without explicit consent where the processing is directly related to the establishment or performance of a contract and is necessary for processing the personal data of the parties to that contract.

5.4. Necessity for Compliance With Legal Obligations

Personal data that must be processed in order for the Law Firm, acting as data controller, to comply with its legal obligations may be processed without explicit consent.

5.5. Personal Data Made Public by the Data Subject

Personal data made public by the data subject may be processed and transferred without explicit consent to the extent that such processing is connected with the purpose for which the data was made public and is necessary for the Law Firm’s activities.

5.6. Necessity for the Establishment, Exercise or Protection of a Right

Personal data may be processed and transferred without explicit consent where processing is necessary for the establishment, exercise or protection of a right.

5.7. Necessity for the Legitimate Interests of the Law Firm

Personal data may be processed and transferred without explicit consent where processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected.

Legal Grounds by Category of Personal Data

Identity Data

Identity data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is necessary to protect life or physical integrity;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• The data has been made public by the data subject;
• Processing is necessary for the establishment, exercise or protection of a right;
• Processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected; or
• Where none of the above conditions applies, the explicit consent of the data subject.

Contact Data

Contact data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is necessary to protect life or physical integrity;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• The data has been made public by the data subject;
• Processing is necessary for the establishment, exercise or protection of a right;
• Processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected; or
• Where none of the above conditions applies, the explicit consent of the data subject.

Legal Transaction Data

Legal transaction data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• Processing is necessary for the establishment, exercise or protection of a right;
• Processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected; or
• Where none of the above conditions applies, the explicit consent of the data subject.

Financial Data

Financial data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• The data has been made public by the data subject;
• Processing is necessary for the establishment, exercise or protection of a right;
• Processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected; or
• Where none of the above conditions applies, the explicit consent of the data subject.

Visual Data

Visual data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• Processing is necessary for the legitimate interests of the Law Firm, provided that the fundamental rights and freedoms of the data subject are not adversely affected; or
• Where none of the above conditions applies, the explicit consent of the data subject.

Special Categories of Personal Data

Special categories of personal data are processed in accordance with the conditions and security measures prescribed by the KVKK and other applicable legislation.

Such data may be processed on the basis of one or more of the following legal grounds:

• Processing is expressly permitted by law;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for compliance with legal obligations;
• Processing is necessary for the establishment, exercise or protection of a right;
• Other legal grounds prescribed by applicable legislation; or
• The explicit consent of the data subject, where required.

6. Purposes of Processing Personal Data

Personal data may be processed for the following purposes under the KVKK and other applicable legislation:

• Fulfilling obligations arising from legal services agreements, Attorneyship Law No. 1136 and other applicable legislation;
• Providing prospective clients with legal service and fee proposals;
• Entering into legal services agreements with clients;
• Providing clients with litigation and legal advisory services;
• Conducting financial transactions arising from legal services;
• Fulfilling tax obligations;
• Carrying out accounting activities;
• Providing information about legislative updates and legal developments;
• Improving the services provided to clients;
• Informing clients about their files and legal processes;
• Fulfilling archiving and record-retention obligations;
• Sharing information with competent authorities and institutions;
• Carrying out legal and regulatory compliance procedures;
• Creating copies and backups to prevent data loss;
• Conducting technical and physical security processes;
• Fulfilling obligations arising from agreements with suppliers;
• Ensuring that the Law Firm’s activities are conducted in compliance with applicable legislation;
• Monitoring legal matters, contractual processes and legal requests;
• Using information relating to transaction history as evidence in possible disputes following the termination of a legal relationship;
• Responding to requests for information and documents from public authorities and institutions;
• Establishing and managing information technology infrastructure;
• Managing and monitoring access rights;
• Ensuring that data is accurate and up to date;
• Conducting supply chain management processes;
• Planning, monitoring and implementing information security processes;
• Providing information to authorised persons, institutions and organisations;
• Ensuring business continuity; and
• Planning and carrying out corporate governance activities.

7. Transfer of Personal Data

Personal data collected and processed by the Law Firm may be transferred to the following persons and organisations in accordance with the personal data processing and transfer conditions set out in the KVKK, for the purposes described above and in order to fulfil legal obligations:

• Natural persons;
• Private-law legal entities;
• Suppliers and service providers;
• Lawyers, consultants and other professional service providers;
• Competent public authorities and institutions; and
• Courts, enforcement offices and other judicial or administrative authorities.

The necessary technical and administrative measures are taken to ensure data security during the transfer of personal data.

8. Retention of Personal Data

Personal data is retained for the periods prescribed by applicable laws and other legislation.

Where no specific retention period is prescribed by legislation, personal data is retained for as long as necessary for the purpose for which it was processed.

The following matters may be taken into account when determining the applicable retention period:

• The duration of the legal relationship between the Law Firm and the data subject;
• Limitation periods and forfeiture periods prescribed by applicable legislation;
• The Law Firm’s legal obligations;
• The evidential value of personal data in potential disputes;
• Requests made by the data subject; and
• The Personal Data Retention and Destruction Policy.

Upon expiry of the applicable retention periods, personal data is deleted, destroyed or anonymised.

9. Deletion, Destruction and Anonymisation of Personal Data

Where the reasons requiring the processing of personal data cease to exist, personal data is deleted, destroyed or anonymised ex officio or upon the request of the data subject, in accordance with Article 7 of the KVKK and other applicable legislation.

These actions are carried out in accordance with the Law Firm’s Personal Data Retention and Destruction Policy and as part of periodic destruction procedures.

Personal data may be deleted or destroyed using the following methods:

• Secure destruction of physical documents;
• Secure deletion of electronic data from the software systems in which it is stored;
• Destruction of data in a manner that prevents it from being accessed or recovered; and
• Anonymisation of data so that it can no longer be associated with an identified or identifiable natural person.

The provisions of applicable legislation and the procedures and principles determined by the Personal Data Protection Board are taken into account when personal data is deleted, destroyed or anonymised.

10. Rights of the Data Subject and Application Procedure

10.1. Rights of the Data Subject

Under Article 11 of the KVKK, data subjects whose personal data is processed have the right to:

• Learn whether their personal data is being processed;
• Request information where their personal data has been processed;
• Learn the purpose for which their personal data is processed;
• Learn whether their personal data is being used in accordance with the stated purpose;
• Know the third parties to whom their personal data has been transferred in Türkiye or abroad;
• Request the correction of incomplete or inaccurate personal data;
• Request the deletion or destruction of their personal data under the conditions set out in Article 7 of the KVKK;
• Request that correction, deletion or destruction be notified to third parties to whom their personal data has been transferred;
• Object to an adverse outcome resulting from the analysis of their personal data exclusively through automated systems; and
• Claim compensation where they suffer damage as a result of the unlawful processing of their personal data.

10.2. Application Methods

Data subjects wishing to exercise their rights under the KVKK may submit their requests to the Law Firm by one of the following methods, in accordance with Article 13 of the KVKK and other applicable legislation.

Application in Person

The applicant may submit a wet-ink signed application together with a document verifying their identity to the following address:

Address: Mustafa Kemal Mahallesi, Tepe Prime A Blok, No: 18, Çankaya/Ankara, Türkiye

The envelope must state:

“Information Request Under the Law on the Protection of Personal Data”

Application Through a Notary Public

Applications submitted through a notary public may be sent to the following address:

Address: Mustafa Kemal Mahallesi, Tepe Prime A Blok, No: 18, Çankaya/Ankara, Türkiye

The notification envelope must state:

“Information Request Under the Law on the Protection of Personal Data”

Application by Email

Applications by email may only be submitted using an email address already registered in the Law Firm’s systems.

Email address: [email protected]

The subject line of the email must state:

“Personal Data Protection Information Request”

Evaluation of Applications

Additional information or documentation may be requested to verify the identity of the applicant and determine the scope of the request.

Applications are concluded as soon as reasonably possible and, in any event, within 30 days, depending on the nature of the request.

Applications are generally processed free of charge. However, where the processing of an application gives rise to additional costs, the fee determined in the tariff issued by the Personal Data Protection Board may be charged to the applicant.

Where an application is accepted, the necessary action will be taken as soon as reasonably possible.

Where an application is rejected, the reasons for rejection will be communicated to the applicant in writing or electronically.

Where an application is rejected, the response is considered insufficient or no response is provided within the prescribed period, the data subject may submit a complaint to the Personal Data Protection Board within 30 days from the date on which they become aware of the response and, in any event, within 60 days from the date of the application.

11. Identity and Contact Details of the Data Controller

This Privacy Notice has been prepared by DYC Law and Consultancy, established in Türkiye, in its capacity as data controller.

Trade name: DYC Law and Consultancy
Address: Mustafa Kemal Mahallesi, Tepe Prime A Blok, No: 18, Çankaya/Ankara, Türkiye
Telephone: +90 (312) 911 90 65
Email: [email protected]