Personal Data Protection Notice

ÖZ&ÖZ LAW OFFICE
PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

As ÖZ&ÖZ Law Office (“ÖZ&ÖZ” or the “Office”), we attach great importance to the security and confidentiality of your personal data. This Privacy Notice has been prepared to inform you, in our capacity as data controller, about the personal data processing activities carried out by ÖZ&ÖZ within the scope of the Turkish Personal Data Protection Law No. 6698 (the “Law” / “KVKK”) and the relevant legislation.

As a law office, in addition to the KVKK, we exercise the utmost care in complying with attorney-client confidentiality and our professional duty of secrecy under the Attorneys’ Act No. 1136. Your personal data is processed in accordance with the fundamental principles set out in the KVKK, in a manner connected with, limited to and proportionate to the purposes for which it is processed, and is protected by taking the necessary technical and administrative measures.

This Privacy Notice serves to fulfil a disclosure obligation and is not conditional upon any approval or explicit consent. Where a processing activity is based on the explicit consent condition, such explicit consent will be obtained through a separate text and a separate declaration.

I. DATA CONTROLLER

The data controller under the KVKK is ÖZ&ÖZ Law Office. Its contact details are as follows:

• Address: Kavaklıdere Mah. Tunus Cad. No: 19/3-4 Çankaya/Ankara
• Address: Kuzguncuk Mah. Abdullahağa Cad. Cemil Molla Yalısı 22/3 Üsküdar/İstanbul
• E-mail: [email protected]

II. PERSONAL DATA PROCESSED

Depending on the relevant data subject group and the nature of the processing activity carried out, the following categories of personal data may be processed:

• Identity Data: Name, surname, Turkish ID number, passport number, date and place of birth, and other information enabling identification of the individual.
• Contact Data: Address, telephone number, e-mail address and other contact information.
• Professional Data: Profession, title, employer/organisation and information regarding professional experience.
• Financial Data: Bank account details, payment, collection and invoicing information; and transaction information regarding payments made through the payment screen on our website
• Legal Transaction Data: Information and documents obtained within the scope of litigation, enforcement and other legal proceedings, and information concerning the legal transactions and disputes relating to the data subject.
• Transaction Security Data: Where necessary within the scope of the use of the website and electronic systems, information such as IP address, access and transaction logs.
• Special Categories of Personal Data: Special categories of personal data that must be processed within the scope of the provision of legal services or the fulfilment of obligations arising from the relevant legislation.

The categories of personal data processed are limited to the data necessary within the scope of the relevant data subject and the activity carried out.

III. PURPOSES AND LEGAL GROUNDS OF PROCESSING

Your personal data is processed within the scope of the data subject groups set out below and to the extent necessary for the conduct of the relevant activities.

1. Clients and Client Representatives

The personal data of our clients and of the representatives, officers, employees of our corporate clients, and other persons acting on behalf of our clients, is processed for the purposes of providing legal consultancy and attorney services; conducting litigation, enforcement and other legal proceedings; preparing legal opinions and memoranda; establishing communication; conducting contractual processes; carrying out payment, collection, invoicing and accounting processes; establishing, exercising and protecting rights; fulfilling obligations arising from legislation; and responding to requests from authorised bodies.

In this context, your personal data is processed on the basis of;

• Article 5/2(c) of the KVKK — being directly related to the conclusion or performance of a contract,
• Article 5/2(ç) of the KVKK — being mandatory for the fulfilment of our legal obligations,
• Article 5/2(e) of the KVKK — being mandatory for the establishment, exercise or protection of a right,
• Article 5/2(f) of the KVKK — being mandatory for the legitimate interests of the Office, provided that it does not harm your fundamental rights and freedoms

legal grounds.

Your special categories of personal data are processed where one of the conditions set out in Article 6 of the KVKK, relevant to the nature of the processing activity, is present.

2. Prospective Clients

The personal data of natural persons who contact the Office to obtain legal services or who request information or a proposal regarding our services, as well as of the representatives and employees of prospective corporate clients, is processed for the purposes of receiving and evaluating requests, establishing communication, conducting meeting and proposal processes, and carrying out processes aimed at establishing a potential legal consultancy/attorney relationship.

In this context, your personal data is processed on the basis of;

• Article 5/2(c) of the KVKK — being directly related to the conclusion of a contract,
• Article 5/2(e) of the KVKK — being mandatory for the establishment, exercise or protection of a right,
• Article 5/2(f) of the KVKK — being mandatory for our legitimate interests

legal grounds.

3. Opposing Parties, Debtors and Other Persons Involved in Legal Proceedings

Within the scope of the legal services we provide to our clients and of litigation and enforcement proceedings, the personal data of opposing parties, debtors, their attorneys and other relevant persons involved in legal proceedings may be processed. In this context, the identity, contact and transaction information of persons who make debt payments through the payment screen on our website is processed for the purposes of carrying out payment and collection processes, conducting enforcement and dispute processes, and establishing, exercising and protecting legal rights.

In this context, your personal data is processed on the basis of;

• Article 5/2(e) of the KVKK — being mandatory for the establishment, exercise or protection of a right,
• Article 5/2(ç) of the KVKK — being mandatory for the fulfilment of our legal obligations,
• Article 5/2(f) of the KVKK — being mandatory for our legitimate interests

legal grounds.

4. Business Partners, Suppliers and Service Providers

The personal data of the natural-person employees, representatives and officers of the Office’s business partners, suppliers and service providers is processed for the purposes of establishing and conducting business relationships and contractual processes, procuring goods/services, establishing communication, carrying out payment/accounting processes, obtaining information technology and other support services, and fulfilling legal obligations.

In this context, your personal data is processed on the basis of;

• Article 5/2(c) of the KVKK — being directly related to the conclusion or performance of a contract,
• Article 5/2(ç) of the KVKK — being mandatory for the fulfilment of our legal obligations,
• Article 5/2(f) of the KVKK — being mandatory for our legitimate interests

legal grounds.

5. Job and Internship Applicants

The personal data of persons who apply to work or to undertake an internship at the Office through the career section of our website or other channels is processed for the purposes of receiving and evaluating applications, assessing the qualifications and suitability of candidates for the position, communicating with candidates, and carrying out recruitment/internship admission processes.

In this context, your personal data is processed on the basis of;

• Article 5/2(f) of the KVKK — being mandatory for the legitimate interests of the Office with respect to the conduct of recruitment processes,
• Article 5/2(e) of the KVKK — being mandatory for the establishment, exercise or protection of a right,
• Article 5/2(ç) of the KVKK — being mandatory for the fulfilment of our legal obligations

legal grounds.

6. Website Visitors and Users of the Contact Form

The personal data of persons who visit our website and who contact us through the contact form on the website is processed for the purposes of receiving and responding to communication and information/proposal requests, conducting communication activities, ensuring the security of the website and information systems, and, where necessary, protecting legal rights.

In this context, your personal data is processed on the basis of;

• Article 5/2(c) of the KVKK — being directly related to the conclusion of a contract,
• Article 5/2(f) of the KVKK — being mandatory for our legitimate interests with respect to managing communication requests and website security,
• Article 5/2(ç) of the KVKK — being mandatory for the fulfilment of our legal obligations

legal grounds.

The personal data processing activities carried out through cookies and similar technologies used on our website are additionally explained in the ÖZ&ÖZ Law Office Cookie Policy.

IV. METHODS OF COLLECTING PERSONAL DATA

Your personal data is collected through face-to-face meetings, telephone calls, e-mail, the website and the contact/career/payment channels on the website, physical and electronic documents, digital communication platforms, courts, enforcement offices, notaries and other judicial/administrative authorities within the scope of legal proceedings, and publicly available sources accessible in accordance with the legislation; verbally, in writing or electronically, by wholly or partly automated means or by non-automated means provided that they form part of a data recording system.

V. TRANSFER OF PERSONAL DATA

Your personal data may be transferred to the following recipient groups to the extent necessary for the fulfilment of the purposes set out above and in accordance with the conditions stipulated in Article 8 of the KVKK:

VI. TRANSFER OF PERSONAL DATA ABROAD

In carrying out its activities, the Office makes use of services such as e-mail, cloud-based storage and office applications. Since the servers of these service providers are located abroad, your personal data processed within the scope of these services may be transferred abroad.

The transfer of your personal data abroad is carried out in accordance with Article 9 of the KVKK and the relevant legislation; where an adequacy decision issued by the Personal Data Protection Board exists, on the basis of that decision; in the absence of an adequacy decision, provided that one of the conditions set out in Articles 5 and 6 of the Law is present and one of the appropriate safeguards stipulated (binding corporate rules, standard contract, letter of undertaking, etc.) is provided; and, in the absence of these as well, only on an incidental basis, in the exceptional cases listed in Article 9 of the Law or where your explicit consent is present.

VII. RETENTION AND DESTRUCTION OF PERSONAL DATA

Your personal data is retained for the retention periods stipulated in the relevant legislation and/or for the period necessary for the purposes of processing. Upon the elimination of the legal, administrative or factual reasons requiring retention and the expiry of the relevant period, your personal data is deleted, destroyed or anonymised in accordance with the Office’s personal data retention and destruction policy and the legislation.

VIII. RIGHTS OF DATA SUBJECTS

Under Article 11 of the KVKK, data subjects have the right to;

• learn whether their personal data is being processed and, if so, request information in this regard,
• learn the purpose of processing and whether the data is used in accordance with such purpose,
• know the third parties to whom the data is transferred, domestically or abroad,
• request rectification where the data has been processed incompletely or inaccurately,
• request erasure or destruction of the data within the conditions stipulated in the legislation,
• request that rectification, erasure or destruction operations be notified to the third parties to whom the data has been transferred,
• object to a result arising against them through the analysis of the data exclusively by automated means,
• request compensation for damages arising from unlawful processing of the data.

IX. APPLICATION PROCEDURE AND CONTACT

You may submit your requests under the KVKK to the Office in accordance with the procedures and principles stipulated in the KVKK and the relevant legislation. You may submit your applications;

• by delivering them in person or sending them via notary to the address Kavaklıdere Mah. Tunus Cad. No: 19/3-4 Çankaya/Ankara, or Kuzguncuk Mah. Abdullahağa Cad. Cemil Molla Yalısı 22/3 Üsküdar/İstanbul
• by sending an e-mail to [email protected] using a secure electronic signature or mobile signature, or via the e-mail address registered in our system

Your applications will be evaluated and concluded within the periods stipulated in the KVKK and the relevant legislation.

ÖZ&ÖZ Law Office