CLARIFICATION TEXT WITHIN THE SCOPE OF THE LAW ON THE PROTECTION OF PERSONAL DATA NO. 6698

Purpose and Scope of the Clarification Text

As Türkoğlu & Türkoğlu Law Firm, we take measures to protect your personal data within the scope of the Law on the Protection of Personal Data No. 6698 (hereinafter referred to as “KVKK” or “the Law”). We process your Personal Data within the scope of the KVKK and relevant legislation, in our capacity as “Data Controller,” for the reasons and through the methods explained below.

As Türkoğlu & Türkoğlu Law Firm, this Clarification Text on the Processing of Personal Data has been prepared pursuant to the article titled “Obligation of Data Controller to Inform” in Article 10 of the KVKK, for the purpose of informing you in the most transparent manner regarding: the identity of the data controller, the method and legal reason for collecting your personal data, for what purpose these data will be processed, to whom and for what purpose they may be transferred, the data processing duration, and what your rights are as listed in Article 11 of the KVKK. The explanations made for “Your Personal Data” in this clarification text also cover your “Special Categories of Personal Data.”

1. Data Controller

Title: Türkoğlu & Türkoğlu Hukuk Bürosu

Address: 1476 Sokak. No:1 Tibaş Alsancak Apt. K:7 D:14 Alsancak-Konak/İZMİR

(Hereinafter referred to as the “Law Firm” within the scope of this Clarification Text.)

Method and Legal Reason for Collection of Your Personal Data

Your personal data may be collected verbally, in writing, or electronically by the Law Firm’s affiliated units, website, social media channels, and through means used for the execution of activities within the Law Firm, by automatic or non-automatic methods. Your personal data may be processed by being created and updated as long as your relationship with the Law Firm continues, and may be kept in both digital and physical environments.

Your personal data may be processed and transferred in line with the purposes set out in the second article below and within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

Your Processed Personal Data and Purposes of Processing

Your Personal Data is processed securely in accordance with the Law on the Protection of Personal Data, due to legal obligations or in order to provide a more appropriate service in the Law Firm’s business and transactions.

In this context, the data listed in the table below are collected as personal data;

Communication Data: Data group used to contact the person (Phone, address, e-mail).

Identity Data: Data group containing information regarding the person’s identity (Name-surname, T.C. ID No, date of birth, gender, nationality data, registry information).

Visual/Audio Data: Data group containing visual and audio data belonging to the person (Photograph, voice recording, camera recording).

Image Recording Data: Photographic recording data belonging to the person at events (Camera recording, photo recording).

Professional Data: Data group containing information regarding the person’s profession (Information on the institution worked for, working hours).

Educational Data: Data group containing educational data belonging to the person (Diploma and education information).

Your collected personal data shall be processed for the purposes of;

• Execution of the Law Firm’s activities,
• Fulfillment of legal and regulatory requirements arising/that may arise from all relevant laws and secondary regulations and taking necessary measures in this context,
• Execution of inspection and/or regulation duties to be carried out by authorized public institutions and organizations and professional organizations with the status of a public institution,
• Fulfilment of information and document requests demanded by judicial bodies and/or administrative authorities,
• Utilization of data collected in works and/or transactions carried out in judicial bodies and/or administrative authorities,
• Performance of risk management and quality improvement activities,
• Taking necessary measures for systems and applications within the scope of data security,

within the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

To Whom and for What Purpose Your Processed Personal Data May Be Transferred

ensuring that all necessary technical and administrative measures are taken to provide the appropriate security level pursuant to the KVKK and relevant health legislation, your Personal Data may be transferred to;

-Persons/institutions and/or organizations permitted by the provisions of other relevant legislation;

-Auditors;

-Consultants;

in line with the purposes specified above and within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK.

Data Processing Duration and Retention Period

Your personal data shall be processed limited to the purposes specified in this Clarification Text, complying with the data processing and statute of limitations periods included in the Law Firm’s practices and all relevant laws and other legal legislation. In case of any amendment regarding data processing periods in the laws, the determined new periods shall be taken as the basis.

As a requirement of the principle of limitation by purpose, your personal data is processed limited to the period requiring it to be processed pursuant to the fulfillment of the purposes explained in this Clarification Text and in any case pursuant to the Law Firm practices and customs; following the expiration of the periods, they are deleted, destroyed, or anonymized. In this context, the retention period of process-based personal data is specified below;

PROCESS RETENTION PERIOD

Uploaded Resumes: All personal data, including the resumes and/or special categories of personal data in these resumes, are stored for 2 years from the date the resumes are sent to us.

Sent Messages: All personal data, including the messages sent and/or special categories of personal data in these messages, are stored for 3 years from the date they are sent to us.

Rights of the Data Subject and Exercising These Rights

Rights of the data subjects whose personal data are processed

Data subjects whose personal data are processed have the following rights:

1. To learn whether personal data are processed or not,
2. To request information if their personal data have been processed,
3. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data are transferred domestically or abroad,
5. To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data are transferred,
6. To request the deletion or destruction of personal data in the event that the reasons requiring its processing have ceased to exist despite having been processed in accordance with the KVKK and other relevant law provisions, and to request notification of the transaction made within this scope to third parties to whom personal data are transferred,
7. To object to the occurrence of a result against the person himself/herself by analysing the processed data exclusively through automated systems,
8. To claim compensation for the damage arising from the unlawful processing of personal data.

Exercising the Rights of the Data Subject

Data subjects whose personal data are processed may submit their requests regarding their rights specified in the clarification text to the Law Firm free of charge, with information and documents identifying their identity and through the methods specified below or other methods determined by the Personal Data Protection Board.

The Data Subject may apply to the Data Controller by;

• Preparing a petition in accordance with the procedure and submitting a wet-signed copy personally by hand or via notary/registered letter with return receipt to the address “1476 Sokak No:1 Tibaş Alsancak Apt. K:7 D:14 Alsancak-Konak/İzmir”, OR,
• Using the electronic mail address registered with the Law Firm or via software or application developed for the purpose of application to the address (info@turkoglu.av.tr).

In order for the above-mentioned application to be accepted as a valid application, pursuant to the Communiqué on the Principles and Procedures for the Request to Data Controller, it is mandatory for the data subject to state the following information in the application:

1. Name, surname, and if the application is written, signature,
2. For citizens of the Republic of Turkey, T.C. identification number; for foreigners, nationality, passport number or identification number if any,
3. Residential or workplace address for notification,
4. Electronic mail address, telephone, and fax number for notification, if any,
5. Subject of the request,

Otherwise, the application will not be evaluated as a valid application.

In order for third parties to make an application request on behalf of the data subjects whose personal data are processed, there must be a special power of attorney issued via a notary on behalf of the person who will make the application by the data subject.