Privacy Notice

This English version is provided for information; in case of any discrepancy the Turkish version prevails. Turkish version: KVKK Aydınlatma Metni.

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform persons who visit this website or contact the practice by e-mail, telephone or the contact form about the processing of their personal data.

Data controller

Personal data are processed by Av. Elif Comart (Elif Comart, Attorney at Law) as data controller.

Personal data processed

• Information sent by e-mail, telephone or the contact form on this website: identity and contact details such as name and surname, e-mail address and telephone number, and the content of the request and of the correspondence.
• Technical server logs: the IP address, the date and time of access, the address of the requested page and browser and device information, generated on the hosting provider’s servers when the website is accessed.

Information sent with the contact form on this website (name and surname, e-mail address, optionally a telephone number and a subject, and the content of the message) is stored on the website’s server and announced to the practice by e-mail. The website does not use cookies or similar tracking technologies for visitors; details are given in the Cookie Policy.

Purposes of processing

• Assessing requests for legal assistance and communicating with the person making the request
• Carrying out the conflict-of-interest checks required by the legal profession
• Providing the website and ensuring information security
• Complying with obligations arising under the legislation

Method of collection and legal grounds

Personal data are collected directly from the data subject by e-mail, telephone and the contact form on this website; technical server logs are collected automatically through the hosting infrastructure when the website is accessed. These data are processed on the legal grounds set out below under Article 5(2) KVKK:

• Article 5(2)(c): processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (assessment of the request and discussions towards concluding an engagement agreement for legal services);
• Article 5(2)(ç): processing is necessary for compliance with a legal obligation of the data controller;
• Article 5(2)(f): processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and liberties of the data subject (website and information security, conflict-of-interest checks).

Special categories of personal data (e.g. health data or data on criminal convictions) should not be shared by e-mail. If such data are nevertheless shared voluntarily by the data subject, they are processed under Article 6(3)(d) KVKK only to the extent necessary for the establishment, exercise or protection of a right.

Transfers, including transfers abroad

Personal data may be transferred to the recipients listed below, solely for the purposes set out above:

• Google: e-mail infrastructure service. Messages sent to the practice by e-mail are stored on this infrastructure.
• Fly.io, Inc.: hosting of the website. Fly.io is a company incorporated in the United States of America. The website is served from a server in Germany (Frankfurt), while requests are received by the Fly.io edge server closest to the visitor, in whichever country that is, and technical server logs are processed on this infrastructure. Requests sent with the contact form are also stored on this server.
• Resend, Inc.: notification of the practice by e-mail about requests sent with the contact form. Resend is a company incorporated in the United States of America; the information in the form is processed on its infrastructure while the notification e-mail is sent.
• Judicial authorities and public institutions: upon request and to the extent provided for by the legislation.

As the servers of Google, Fly.io and Resend are located outside Türkiye, transfers to these service providers constitute transfers abroad within the meaning of Article 9 KVKK.

Retention periods

• Correspondence on requests that do not lead to a client relationship: for as long as required to assess the request and to carry out the conflict-of-interest check.
• Technical server logs at the hosting provider: for the period set by the hosting provider.
• Where a client relationship is established: for the retention and limitation periods laid down in the applicable legislation.

At the end of these periods, personal data are erased, destroyed or anonymised in accordance with Article 7 KVKK.

Rights of the data subject

Under Article 11 KVKK, every person has the right to apply to the data controller in order to:

• learn whether personal data relating to them are processed;
• request information on the processing if their personal data have been processed;
• learn the purpose of the processing and whether the data are used in accordance with that purpose;
• know the third parties in Türkiye or abroad to whom their personal data are transferred;
• request the rectification of personal data that are incomplete or inaccurately processed;
• request the erasure or destruction of their personal data under the conditions laid down in Article 7 KVKK;
• request that the rectification, erasure or destruction be notified to the third parties to whom the personal data have been transferred;
• object to a result to their detriment arising from the analysis of the processed data exclusively by automated systems;
• claim compensation for damage suffered as a result of the unlawful processing of their personal data.

How to apply

Requests concerning these rights may be submitted, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the data controller’s address above or by e-mail to info@comartlaw.com using a secure electronic signature, a mobile signature or an e-mail address previously notified to the data controller and registered in its system.

The application states the applicant’s name and surname and, for written applications, the signature; for Turkish citizens, the Turkish identity number; for foreign nationals, the nationality and passport number or, if any, the identity number; the residential or business address for notifications; if any, the e-mail address, telephone or fax number for notifications; and the subject of the request.

Applications are concluded as soon as possible, depending on the nature of the request, and within thirty days at the latest (Article 13 KVKK). If the application is rejected, the response is found insufficient or no response is given in time, a complaint may be lodged with the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of the application (Article 14 KVKK).

Updates

This notice is updated if the data processing activities change.

Date of update: 13 October 2026