KVKK Privacy Notice

Data controller

Data controller: Zen Law Partners (the “Firm”), Maslak Mah. AOS 55. Sok. 42 Maslak Sitesi No: 4 Sarıyer / İstanbul. Email: [email protected], phone: +90 532 050 04 19.

Scope of this notice

This notice covers the personal data processed when you visit zenlawpartners.com and when you contact the Firm by phone, WhatsApp or email. The following have their own texts as well:

• Preliminary assessment request: the Privacy Notice and the Explicit Consent text for preliminary assessment requests shown next to the form.
• Newsletter sign-up: the Newsletter Privacy Notice and the consent text shown next to the sign-up form.
• Cookies and analytics measurement: the Cookie Policy.

If this notice and the Privacy Policy on the site differ, this notice prevails.

When you visit the site

For every request, the site’s server records your IP address, the time of the request, the address of the requested page, the response code and size, the address of the page you came from and the information your browser gives about itself. These records are processed to keep the site secure, detect misuse and fix errors, on the basis of the Firm’s legitimate interest (KVKK Art. 5(2)(f)). We do not use them for advertising or profiling.

The use of cookies and similar technologies is described in the Cookie Policy. Analytics measurement runs only if you allow it.

When you contact us by phone, WhatsApp or email

Your name, your contact details and the content of your message are processed to answer your request and to assess whether legal services can be offered to you. Legal grounds: the processing is directly related to a legal services agreement that may be concluded at your request (KVKK Art. 5(2)(c)), and our legitimate interest in answering your request (KVKK Art. 5(2)(f)).

If your message or the documents you send contain health information, this is a special category of personal data and is processed only with your explicit consent (KVKK Art. 6(3)(a)). That is why our first reply includes a link to this notice and asks for your written explicit consent for your health information; we do not assess your health information before we have your consent. You can withdraw your consent at any time by writing to [email protected]; this does not affect processing carried out before the withdrawal.

Your request may be entered manually into the Firm’s application panel for assessment. Such a record is subject to the same security and retention rules as requests sent through the form.

WhatsApp is a service provided by Meta Platforms; messages you send via WhatsApp are transmitted under that service’s own terms.

Who do we transfer data to?

• Providers of hosting, maintenance and security services for the site, email and the application panel: only to the extent needed for that service and under a duty of confidentiality.
• Google LLC: only if you allow analytics cookies, the measurement data described in the Cookie Policy.
• Public authorities and courts authorised by law, when they request it.

If one of these providers is located abroad, the transfer is made with the safeguards set out in KVKK Art. 9.

Your data is not sold, and your name, contact details, messages and applications are not used for advertising. If you allow analytics cookies, Google is told only that a visit that began with a link on Google ended in an application, as described in the Cookie Policy. Under the Turkish Attorneys’ Act, the Firm’s lawyers must keep confidential what they learn in the course of their professional work.

How long do we keep it?

• Server records: at most 30 days; then deleted automatically.
• Requests recorded in the application panel: 90 days from the last time we spoke or corresponded with you about the subject of the request. If the assessment is ongoing, the Firm may extend this period until a specific date, recording the reason.
• Other correspondence: for as long as needed to conclude your request and for the retention periods required by law; then deleted or destroyed.
• If you become our client, your information is moved to your client file and follows that file’s retention rules.

Your rights

Under KVKK Art. 11 you can apply to the Firm to:

• find out whether your personal data is processed;
• request information about it if it has been processed;
• find out the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom it has been transferred;
• ask for it to be corrected if it is incomplete or inaccurate;
• ask for it to be erased or destroyed under the conditions in KVKK Art. 7;
• ask for the third parties to whom it was transferred to be notified of a correction, erasure or destruction;
• object to a result against you that arises from the analysis of the data solely by automated systems;
• claim compensation if you suffer damage because of unlawful processing.

How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing to our office address (Maslak Mah. AOS 55. Sok. 42 Maslak Sitesi No: 4 Sarıyer / İstanbul), or to [email protected] from the email address you have previously given the Firm and that is in our records. Applications signed with a secure electronic signature or a mobile signature can also be sent to that address.

In your application, state your name and surname; your Turkish ID number if you are a Turkish citizen, otherwise your nationality and your passport number or, if any, your identity number; your address for notifications; your email address and phone number, if any; and the subject of your request. A written application must bear your signature.

We conclude your application as soon as possible according to its nature and within 30 days at the latest, free of charge. If the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your application is rejected, you find the answer insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your application.