Last Updated: August 2026

As Attorney Ezgi Çalışkan, I regard the protection of personal data and of the privacy of private life not merely as a legal obligation but as a responsibility directly linked to the relationship of trust that is at the core of the legal profession.

This Privacy Notice on the Protection of Personal Data (Aydınlatma Metni) has been prepared under the relevant legislation, in particular the Law on the Protection of Personal Data No. 6698 (“KVKK”), to inform natural persons who visit the website, contact me through the communication channels, request a legal opinion or a meeting, enter into a power of attorney relationship (vekâlet ilişkisi) with me, or whose personal data is processed because of the legal proceedings being conducted.

The processing of personal data is based on the following principles: acting lawfully and in good faith, keeping data accurate and, where necessary, up to date, processing it for specified, explicit and legitimate purposes, ensuring that it is relevant, limited and proportionate to the purposes for which it is processed, and retaining it only for as long as necessary.

1. Data Controller

Under the Law on the Protection of Personal Data No. 6698, the data controller (veri sorumlusu) is:

Data Controller: Attorney Ezgi Çalışkan
Email: [email protected]
Telephone: +90 531 491 14 06
Website: ezgicaliskan.av.tr

You may submit your requests under KVKK concerning your personal data through the communication channels listed above.

2. Who Does This Privacy Notice Cover?

The scope of personal data processing may vary depending on the nature of the relationship established with Attorney Ezgi Çalışkan. This notice covers in particular the following groups of persons:

Website visitors,
Persons who make contact through the contact form, telephone, email or other communication channels,
Persons who request a legal consultation or advice,
Clients and prospective clients,
Employees, representatives and authorised officers of client companies,
Opposing parties in lawsuits, enforcement proceedings, mediation, arbitration or other legal proceedings,
Witnesses, court-appointed experts (bilirkişi), technical advisers and third parties connected with legal proceedings,
Suppliers, service providers and their authorised officers,
Other natural persons contacted in the course of professional activities.

Sending a message or sharing information through the website does not in itself mean that an attorney-client agreement or a power of attorney relationship has been established. The establishment of an attorney-client relationship depends on the parties separately agreeing to it.

3. Which Personal Data May Be Processed?

The personal data processed varies depending on the nature of the communication or the legal service. Not all of the data below is processed for every data subject.

Identity Information

Name, surname, Turkish ID number (T.C. kimlik numarası), date of birth, place of birth, passport or foreign ID number and other identity information required by the legal transaction.

Contact Information

Telephone number, email address, residential or service address and other contact information you provide.

Legal Transaction and File Information

Information relating to lawsuits, enforcement proceedings, investigations, prosecutions, mediation, arbitration, contracts or advisory work; documents from courts and public authorities; petitions, decisions, powers of attorney, contracts and other records relating to the legal dispute.

Financial Information

Where necessary within the legal service relationship, bank account details, payment records, invoice information, information on receivables and debts and similar financial data.

Professional and Commercial Information

Company name, title, position, information on commercial activities, contractual relationships and other professional or commercial information necessary for the legal transaction being handled.

Transaction Security and Technical Data

Depending on the nature of the technical infrastructure, IP address, access time, log records, browser and device information and technical records created to ensure information security may be processed when the website is used.

Special Categories of Personal Data

If the nature of the legal dispute so requires, health information, information on criminal convictions and security measures, or other personal data regarded as special categories under KVKK may be processed.

Special categories of personal data are processed only to the extent required by the legal service or the relevant legal transaction and only where one of the applicable conditions set out in Article 6 of KVKK is met.

4. For What Purposes Is Personal Data Processed?

Personal data is processed not for vague general purposes or purposes that may arise later, but for specific purposes connected with the activity being carried out.

Depending on the specific relationship, these purposes may be one or more of the following:

Responding to contact requests,
Assessing and organising meeting requests,
Carrying out a preliminary assessment of the legal dispute,
Carrying out conflict of interest checks,
Providing legal representation and legal advisory services,
Following up lawsuit and enforcement files,
Conducting mediation, arbitration and alternative dispute resolution proceedings,
Drafting, reviewing and negotiating contracts,
Establishing, exercising or protecting legal rights,
Carrying out proceedings before judicial and administrative authorities,
Fulfilling professional and legal obligations,
Managing files and documents,
Carrying out financial and accounting transactions,
Ensuring the security of information and communication systems,
Preventing unauthorised access, data loss and other information security risks,
Retaining the records required by the legal relationship.

5. Legal Grounds for Processing Personal Data

Personal data is processed after the appropriate legal ground has been determined for each processing activity. Depending on the nature of the processing activity, one or more of the conditions set out in Article 5 of KVKK and, for special categories of personal data, in Article 6 may apply.

These may include, in particular, the following legal grounds:

The processing is expressly provided for by law,
The processing is directly related to the conclusion or performance of a contract,
The processing is necessary for the data controller to fulfil its legal obligation,
The processing is necessary for the establishment, exercise or protection of a right,
The processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
Other conditions for processing personal data provided for in the Law are met

as applicable.

Where a processing activity requires explicit consent (açık rıza), explicit consent is obtained separately from the information provided in this notice and in a way that is based on the free will of the data subject.

6. How Is Personal Data Collected?

Depending on the nature of the relationship, personal data may be obtained in physical or electronic form directly from the data subject or from other lawful sources.

The channels through which data may be obtained include:

Contact forms on the website,
Email correspondence,
Telephone calls,
Face-to-face meetings,
Electronic documents and files,
Powers of attorney and contracts,
Courts and enforcement offices,
Mediation and arbitration files,
UYAP (the National Judiciary Informatics System) and other official systems that may be lawfully accessed,
Documents and information provided by the client,
Information lawfully obtained from third parties connected with the dispute

among others.

7. Attorney-Client Confidentiality and Privacy

Information obtained in the course of legal services is specially protected not only under personal data protection legislation but also under the legal profession’s duty of confidentiality.

The attorney’s obligation to keep confidential the matters learned in the course of their duties also applies separately under the Attorneyship Law No. 1136 (Avukatlık Kanunu) and the rules of the profession.

For this reason, information and documents shared in a legal consultation, file review or power of attorney relationship are handled in accordance with the principle of confidentiality, except where required for providing the legal service and where requested by authorities with legal powers to do so.

8. To Whom May Personal Data Be Transferred?

Personal data may be transferred to third parties where this is necessary for providing the legal service or fulfilling legal obligations, and only to the extent limited to the data required.

Depending on the nature of the specific case, the groups of recipients to whom data may be transferred may include:

Courts and public prosecutors’ offices,
Enforcement offices,
Mediation and arbitration bodies,
Notaries,
Bar associations and relevant professional bodies,
Public institutions and organisations authorised by law,
Court-appointed experts, technical advisers and persons involved in the legal proceedings,
The opposing party or the opposing party’s attorneys, where necessary for conducting the legal proceedings,
Financial advisers and accounting service providers,
Information technology, hosting, email, backup and security service providers.

Personal data is not transferred to third parties where the transfer is not connected with the legal service or has no legal basis.

9. Transfer of Personal Data Abroad

Where personal data needs to be transferred abroad, the conditions set out in Article 9 of KVKK are taken into account.

Where infrastructure providers located abroad are used for the website, email, cloud storage, data backup, security, analytics or other digital services, the legal conditions for the data transfer are assessed for the specific service used and the necessary safeguard mechanisms are applied.

No transfer abroad takes place for processes that do not involve the transfer of personal data abroad.

10. Website, Cookies and Technical Records

Certain technically necessary cookies or similar technologies may be used so that the website can operate securely and correctly.

If non-essential cookies are used for analytics, advertising, user profiling or similar purposes, these activities are explained in a separate Cookie Policy and, where required by the legislation, are based on the user’s preference or explicit consent.

Rejecting non-essential cookies should not be designed in a way that prevents use of the website’s basic functions.

11. Information Sent through Contact Forms

Depending on the nature of the legal issue, the content of a message sent through the website may contain sensitive or special categories of personal data.

For this reason, it is recommended that health documents, judicial documents, copies of identity documents, bank details or extensive personal data belonging to third parties that are not needed at the first contact stage are not sent through the contact form.

If detailed documents are needed to assess the legal service, a suitable method of communication or document sharing can be agreed separately.

12. The Principle of Data Minimisation

The principle is not to collect personal data that is not needed for providing legal services. The aim is to process only the categories of data necessary to carry out a legal transaction.

For example, it may not be necessary to ask for a Turkish ID number or the entire case file simply to set up a general consultation appointment. By contrast, more extensive identity and file information may be needed if a power of attorney relationship is established or an official legal transaction is carried out.

13. How Is Data Security Ensured?

To prevent unlawful processing of and access to personal data and to ensure that data is safeguarded, the principle is to apply technical and administrative measures appropriate to the nature and risk level of the data processed.

Measures that may be applied in this context include:

Restricting access rights,
Strong password and account security practices,
Multi-factor authentication on the necessary systems,
Using up-to-date software and security systems,
Technical controls to prevent unauthorised access,
Backup and other methods of protection against data loss,
Ensuring that files and documents are accessible only to the persons who need them,
Making the necessary confidentiality and data security arrangements with service providers,
Protecting physical documents against unauthorised access.

14. How Long Is Personal Data Retained?

Personal data is not retained indefinitely. Data is retained taking into account the periods set out in the relevant legislation, the obligations arising from the attorney-client and legal service relationship, limitation periods, the periods necessary for establishing, exercising or protecting a right, and the purpose of processing.

When the legal ground requiring the processing of the data no longer exists, personal data is deleted, destroyed or anonymised in accordance with the relevant legislation.

15. Data Breaches and Security Incidents

If it is detected that personal data has been obtained by unauthorised persons or that an incident affecting data security has occurred, the nature and scope of the incident are examined and the necessary technical, administrative and legal steps are taken under KVKK and the related regulations.

Where necessary, the notifications to be made to the data subjects and to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) are assessed.

16. Your Rights under KVKK

Under Article 11 of KVKK, persons whose personal data is processed have the right, to the extent that the conditions are met, to apply to the data controller to:

Learn whether their personal data is being processed,
Request information about the processing if their personal data has been processed,
Learn the purpose of processing their personal data and whether it is used in line with that purpose,
Know the third parties in Türkiye or abroad to whom their personal data has been transferred,
Request the correction of personal data that has been processed incompletely or incorrectly,
Request the deletion or destruction of personal data under the conditions set out in KVKK,
Request that the correction, deletion or destruction be notified to the third parties to whom the personal data has been transferred,
Object to a result against them arising from the analysis of the processed data exclusively through automated systems,
Claim compensation for damage suffered as a result of the unlawful processing of personal data.

17. How to Submit a KVKK Application

You may send your requests under KVKK to the data controller, clearly stating your identity and the subject of your request.

You can send your applications:

By email: [email protected]

Including your name and surname, the subject of the request and, where necessary, information that allows your identity to be verified, together with any information and documents relating to the request, will make it easier to assess your application.

Applications are assessed and concluded in accordance with the procedures and time limits set out in KVKK and the related secondary legislation.

18. Updates to This Privacy Notice

This Privacy Notice may be updated when necessary because of changes in personal data processing activities, the technologies used or the relevant legislation.

The current text takes effect from the date on which it is published on the website. If there is a significant change in the purpose, method or legal ground of processing personal data, the principle is to inform the data subjects in accordance with the legislation.

19. Approach to Privacy, Technology and Legal Security

In legal services provided in a digital environment, data security is a continuation of traditional file confidentiality. It should be borne in mind that every technology used, from email correspondence to electronic case documents and from cloud systems to online meetings, may bring different data security risks.

As Attorney Ezgi Çalışkan, I do not see the protection of personal data as limited to publishing a standard KVKK text; I treat attorney-client confidentiality, data minimisation, digital security and the confidentiality principles required by legal services as parts of the same data protection approach. Accordingly, my basic approach is to process personal data without going beyond the scope required by the legal transaction being handled and only to the extent that there is a legal basis for doing so.

This English text is provided for information. In case of any discrepancy, the Turkish version prevails.

Privacy notice on the protection of personal data