Your personal data is processed by Cetin Attorney Partnership, acting in its capacity as data controller, as set out below.

Your personal data is processed for purposes including ensuring uninterrupted access to our website, maintaining the security and stable operation of the site, improving user experience, reviewing site traffic and interactions through cookies and analytics tools, sending information notices where you subscribe to the newsletter and managing the subscription process, responding to requests and questions submitted through the contact form, carrying out advocacy and legal advisory work, managing the client and attorney relationship, following litigation and dispute processes, conducting pre contract negotiations and proposal processes, managing finance and accounting processes, providing information on legal developments, fulfilling legal obligations, carrying out personnel related activities within the framework of employment and internship relationships, managing bar association internship processes, conducting recruitment processes in relation to career and CV information transmitted through ISKUR, digital job platforms, and human resources companies, fulfilling operational activities and obligations arising from contractual relationships, and safeguarding information security.

Within the scope of the services we provide, we may process the categories of personal data set out below.

Your personal data may be collected in electronic form through automatic or partially automatic means by your visit to our website, your completion of contact forms, your communication with us by email or telephone, the execution of power of attorney and service agreements, client meetings, the receipt of human resources applications, the conduct of litigation and dispute processes, and the use of system records and cookie like technologies. Personal data may also be collected in physical form through written applications and legal documents.

The personal data obtained is stored securely in digital systems and processed on the legal bases provided for in Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698. In this context.

• Art. 5/2(c)Where processing is directly related to the establishment or performance of a contract, for the conduct of processes arising from mandates, consultancy agreements, service relationships, client communication, and employee or candidate procedures.
• Art. 5/2(c)Where processing is necessary for the fulfilment of legal obligations, for tax, accounting, archiving, retention, and mandatory reporting requirements imposed by law.
• Art. 5/2(e)Where processing is necessary for the establishment, exercise, or protection of a right, for the conduct of litigation, disputes, requests, and legal processes.
• Art. 5/2(f)Where processing is necessary for the legitimate interests of the data controller, for safeguarding information systems, preventing misuse, improving operational processes, keeping logs and technical records, and carrying out reporting and internal review activities.
• Art. 5/2(d)Where the relevant person has made personal data public, for the processing of information that you have made public in a manner consistent with the purpose of disclosure.
• Art. 5/1Where express consent has been provided, for data processing activities carried out in connection with promotional communications.
• Art. 6/3Where express consent has been provided in relation to special categories of personal data, for processing the information voluntarily supplied by you only to the extent required for the relevant processes. Processing based on express consent will cease immediately if consent is withdrawn, and the relevant data will be deleted, destroyed, or anonymised.

Your personal data may be transferred, within the scope of Articles 8 and 9 of the Law on the Protection of Personal Data No. 6698, to the parties listed below and for the purposes stated.

In accordance with Article 9 of the Law on the Protection of Personal Data No. 6698, your personal data may be transferred abroad where one of the legal grounds for processing is present and the international transfer procedures determined by the Personal Data Protection Board are complied with.

• For directing website traffic and operating security solutions and technical infrastructure through cloud service providers and content distribution network providers
• For the processing of visitor statistics and site performance data within the scope of analytics services provided by Google Analytics (Google LLC)
• For the operation of technical infrastructure through service providers located abroad that provide IT infrastructure, server hosting, security, system management, and maintenance services
• For mandatory reporting, audit, or official requests where required within the context of international legal processes

Where transfer is based on express consent, you may withdraw that consent at any time. In such case, the relevant transfer activity will cease without delay.

Under Article 11 of the Law on the Protection of Personal Data, you have the following rights.

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing and whether personal data is used in line with that purpose
• To learn the third parties to whom personal data is transferred, whether domestically or abroad
• To request rectification where personal data is incomplete or inaccurate
• To request deletion or destruction of personal data within the scope of Article 7 of the Law
• To request that rectification, deletion, or destruction requests be notified to third parties to whom personal data has been transferred
• To object to a result arising to your detriment through the exclusive analysis of personal data by automated systems
• To claim compensation where loss is suffered as a result of unlawful processing of personal data

You may submit your applications and requests concerning your personal data by completing the Data Subject Application Form and sending it to Cetin Attorney Partnership by one of the following methods.

In accordance with the Communique on the Procedures and Principles of Application to the Data Controller, the application must include the following information.

• Name and surname
• Signature for written applications
• Turkish identification number, or passport number or equivalent identification number for foreign nationals
• Residence or workplace address for notification
• Email address, telephone number, and fax number where available
• The subject matter of the request

When exercising the rights described above, the relevant person must clearly and intelligibly state the matter requested and provide information and documents supporting the request. The application must relate solely to the person of the applicant. If an application is made on behalf of another person, the applicant must be specifically authorised for that purpose and such authority must be evidenced by a power of attorney. Requests made by unauthorised third parties on behalf of another person will not be taken into consideration.

Cetin Attorney Partnership will respond to your application as soon as possible and, in any event, within 30 days depending on the nature of the request. If the application is rejected, the reasoned rejection will be notified through the communication channel specified in the application.