Personal data notice

This is a translation provided for information. In case of any discrepancy, the Turkish text (Kişisel Veri Aydınlatma Metni) prevails. Kişisel Veri Aydınlatma Metni

Data controller

Doğan Duman Hukuk Bürosu (Doğan Duman Law Office), Bahçelievler Mahallesi, Köroğlu Sokak No: 6B, Daire: 11, 34180 Bahçelievler / İstanbul

Personal data processed

Your name; the e-mail address or phone number for your preferred contact channel; the general subject you select; the short message you may write, and the time the request was recorded.

Purpose of processing

To get back to you through the channel you choose and to keep a record of your request.

Legal basis

Your personal data is processed in order to contact you at your request, on the legal grounds set out in Article 5(2) of the Law: that processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract; and that processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Explicit consent is not requested for this processing.

Method of collection

Data is collected electronically when you fill in the contact form on the website. If you send a message using the WhatsApp link, your phone number, WhatsApp profile name and message reach the office's WhatsApp line.

Transfers

When you start a conversation on WhatsApp, it is conducted on the infrastructure of WhatsApp (Meta), the provider of the service, and your data may be processed on servers abroad; whether to use this channel is your choice, and you can send the same request through the contact form. Contact form requests are also forwarded as a notification to the office's e-mail account so that they reach the office. This e-mail account is provided by Google LLC (Gmail); the servers of this service may be located abroad, and your data in the notification may therefore be processed abroad. Apart from this, contact form data is not transferred to third parties. The website and the database holding contact form records are hosted on a server provided by Hostinger International Ltd. in a data centre located in Germany (European Union); your contact form data is therefore stored on this server abroad. Records are kept encrypted on the server and deleted at the end of the retention period.

Security measures

• Your name, contact details and message from the contact form are stored in the database encrypted with AES-256-GCM; the encryption key is kept only on the server.
• Your IP address is not added to the record. The counter used to prevent misuse is kept only in the server's memory and for a short time.
• Form contents and search queries are not written to server logs.
• Requests whose retention period has expired are deleted automatically.
• The website uses no cookies, analytics, advertising tools or third-party scripts; pages are served with a strict Content Security Policy (CSP) and security headers.
• Requests are seen only by the office; records are viewed by authorised persons on the server, not through an administration panel accessible over the internet.
• The notification e-mail is sent over an encrypted connection (TLS) to the office's e-mail address only.

Retention period

Contact requests are kept in the website's database for at most 90 days and deleted at the end of this period. Notifications forwarded to the office's e-mail account are kept for as long as necessary to assess the request and are deleted by the office at the end of this period. If a request leads to a professional relationship, records of that relationship are kept separately in accordance with the applicable legislation.

Your rights

Under Article 11 of the Law, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in accordance with that purpose; to know the third parties to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its erasure or destruction under the conditions set out in the Law; to request that these actions be notified to third parties to whom it has been transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can send your applications to the data controller in writing or by other methods determined by the Personal Data Protection Board (e-mail: av.buseedogan@gmail.com). Applications are concluded within thirty days at the latest.