KVKK Privacy Notice
Last updated: 21 October 2026
*This English text is provided for information purposes. In case of any discrepancy, the Turkish version prevails.*
1. Introduction
This Privacy Notice has been prepared by İşcan Law, Mediation and Consultancy Office (the "Office"), as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to inform natural persons ("data subjects") who visit the website iscan.av.tr (the "Website"), submit a contact form or appointment request through the Website, contact the Office by phone, email or in person, or receive legal services from the Office.
The Office processes personal data in accordance with the principles set out in Article 4 KVKK: lawfulness and fairness; accuracy and, where necessary, being kept up to date; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes; and retention only for the period laid down in the relevant legislation or required for the purpose of processing.
2. Data Controller
| Name | İşcan Law, Mediation and Consultancy Office (İşcan Hukuk, Arabuluculuk ve Danışmanlık Bürosu) |
|---|---|
| Address | Cumhuriyet Cad. Hatipoğlu İş Merkezi No:9 D:7, Yalova, Türkiye |
| info@iscan.av.tr | |
| Phone | +90 (226) 811 29 28 |
| Website | https://iscan.av.tr |
3. Categories of Personal Data, Collection Channels and Method
Your personal data are collected through the channels below, by fully or partly automated means, or by non-automated means provided that they form part of a data filing system.
3.1. Contact form
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number (optional), preferred contact method |
| Request management | Subject, message, preferred language |
| Transaction security | Date and time of submission; IP information irreversibly summarised (hashed) to prevent abuse |
3.2. Appointment request
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Phone number, email address |
| Request management | Meeting type and method (in person, phone, online), requested date and time, requested lawyer, subject and note (optional) |
| Transaction security | Date and time of request; hashed IP information |
3.3. Website visits
| Category | Data |
|---|---|
| Transaction security | IP address, browser and device information, access date and time, pages visited (hosting infrastructure logs) |
| Cookies and similar technologies | Strictly necessary and functional cookie/local storage data and aggregate visit statistics, as described in the Cookie Policy |
3.4. Phone, email and in-person communication
Identity, contact and request information and correspondence content that you share when contacting the Office directly.
3.5. Legal services and mediation
Where an attorney–client or mediation relationship is established: identity (including Turkish ID number), contact, power of attorney and contract information, case/file information, legal transaction information, financial information (fee and expense payments) and other data necessarily processed depending on the nature of the dispute. In this context, special categories of personal data such as health data or criminal convictions and security measures may also be processed where the nature of the dispute requires.
Important: The contact and appointment forms on the Website are designed for initial contact only. Please do not share special categories of personal data (such as health information, criminal convictions or religious beliefs), your ID number or detailed information about third parties through these forms. Where such information is needed, it will be obtained securely during the consultation.
3.6. Career (internship and job) applications
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number |
| Professional experience and education | Position applied for, education details, bar and traineeship details, CV, cover letter and other professional information shared by the applicant |
| Transaction security | Date and time of application; hashed IP information to prevent abuse |
Please do not include in your CV a photograph, special categories of personal data such as health information, religion or association membership, or your ID number; this information is not needed to assess your application.
4. Purposes and Legal Grounds of Processing
| Purpose | Data categories | Legal ground (KVKK) |
|---|---|---|
| Receiving, assessing and responding to your contact requests | Identity, contact, request management | Art. 5(2)(c) directly related to the conclusion or performance of a contract (pre-contractual communication); Art. 5(2)(f) legitimate interest |
| Receiving, scheduling, confirming, changing or cancelling appointment requests and informing you accordingly | Identity, contact, request management | Art. 5(2)(c) directly related to the conclusion of a contract |
| Providing legal and mediation services, establishing the power of attorney, conducting cases and proceedings | All data within the service relationship | Art. 5(2)(c) performance of a contract; Art. 5(2)(ç) legal obligation; Art. 5(2)(e) establishment, exercise or protection of a right |
| Processing special categories of data within legal services | Health, criminal convictions, etc. | Art. 6(3)(e) necessary for the establishment, exercise or protection of a right; otherwise the relevant conditions of Art. 6 |
| Complying with legal obligations (tax, attorney and mediation legislation, requests of competent authorities) | Identity, contact, financial, legal transaction | Art. 5(2)(ç) legal obligation; Art. 5(2)(a) expressly provided for by law |
| Ensuring Website security and preventing abuse and automated spam | Transaction security | Art. 5(2)(f) legitimate interest |
| Technically providing the Website and assessing aggregate visit statistics | Transaction security, cookie data | Art. 5(2)(f) legitimate interest |
| Receiving and assessing internship and job applications, contacting applicants and establishing an employment or traineeship relationship with the suitable candidate | Identity, contact, professional experience and education, transaction security | Art. 5(2)(c) directly related to the conclusion of a contract (pre-contractual stage); Art. 5(2)(f) legitimate interest |
| Protecting legal rights and using data as evidence in potential disputes | All relevant categories | Art. 5(2)(e) establishment, exercise or protection of a right |
Your personal data are not processed for advertising, marketing, profiling or sending commercial electronic messages. In accordance with the Attorneys' Act No. 1136 and the Regulation on the Prohibition of Advertising of the Union of Turkish Bar Associations, the Office does not engage in such activities.
5. Transfer of Personal Data
5.1. Transfers within Türkiye
Limited to and proportionate with the purposes above, and in accordance with Article 8 KVKK, your personal data may be transferred to:
- courts, enforcement offices, mediation offices and relevant public institutions, to fulfil legal obligations and protect rights;
- competent public authorities, upon their legal request;
- service providers from which the Office receives legal, financial and technical support (e.g. a certified public accountant), to the extent the service requires.
5.2. Transfers abroad
Website and form records are kept on the servers of the website hosting, content delivery and database infrastructure providers used by the Office. Emails informing you that your appointment request has been received, approved or rejected, as well as notification emails to the Office, are delivered through an email delivery service provider; in this context, your name, email address and appointment details (date, time, meeting method and, for video meetings, the meeting link) are processed by that provider. As these providers' servers are located abroad, contact form, appointment request and transaction security data are transferred abroad. This transfer is carried out in accordance with Article 9 KVKK. [To be completed: the legal basis for the transfer abroad (e.g. standard contract and notification to the Authority) should be confirmed by the Office and this paragraph updated.]
If you choose to load the map, technical data relating to the map service are processed directly by Google LLC (see the Cookie Policy).
6. Retention Periods
| Data | Retention period |
|---|---|
| Appointment requests (completed, rejected or cancelled) | Deleted after 180 days |
| Career (internship and job) applications and attachments | Deleted 6 months after the application date; if an employment or traineeship relationship is established, the retention periods under the relevant legislation apply |
| Contact form messages (not leading to a service relationship) | After the request is concluded, for as long as necessary against potential claims; deleted once the purpose ceases |
| Abuse prevention records (hashed IP) | The short period required for security purposes |
| Hosting infrastructure access logs | A limited period under the infrastructure provider's security policy |
| Data within a legal services or mediation relationship | From the end of the relationship, taking into account the general limitation period under the Turkish Code of Obligations No. 6098 (10 years), retention periods under tax legislation and obligations under professional legislation |
When the retention period expires or the conditions for processing cease to exist, personal data are deleted, destroyed or anonymised ex officio in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7. Data Security and Confidentiality
Pursuant to Article 12 KVKK, the Office takes the necessary technical and organisational measures to ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to ensure their safekeeping. In particular:
- All data transmitted between the Website and your browser is protected by SSL/TLS encryption (HTTPS).
- Form and appointment records can be accessed only by authorised Office staff with authentication; row-level access restrictions are applied in the database.
- IP addresses are kept only in irreversible hashed form for abuse prevention.
- Third-party content such as maps is loaded only at the visitor's choice; fonts are not loaded from third-party servers.
- In line with data minimisation, only the fields necessary to handle the request are mandatory in the forms.
Where an attorney–client or mediation relationship is established, all information obtained in that context is protected, in addition to KVKK, under the professional secrecy and confidentiality obligations arising from the Attorneys' Act No. 1136 and the Law No. 6325 on Mediation in Civil Disputes.
If personal data are obtained by others through unlawful means, the Office will notify the data subject and the Personal Data Protection Board as soon as possible.
8. Your Rights (Article 11 KVKK)
Under Article 11 KVKK, you have the right to apply to the data controller to:
a) learn whether your personal data are processed;
b) request information if your personal data have been processed;
c) learn the purpose of processing and whether the data are used in accordance with that purpose;
ç) know the third parties in Türkiye or abroad to whom your personal data are transferred;
d) request rectification if your personal data are incomplete or inaccurate;
e) request erasure or destruction of your personal data under the conditions set out in Article 7 KVKK;
f) request that the operations under (d) and (e) be notified to third parties to whom your personal data have been transferred;
g) object to a result against you arising from the analysis of the processed data exclusively through automated systems;
ğ) claim compensation if you suffer damage due to unlawful processing of your personal data.
The exceptions set out in Article 28 KVKK, in particular those relating to professional secrecy arising from the attorney–client relationship and to judicial activities, are reserved.
9. How to Apply
You may submit requests regarding the above rights, in Turkish and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following methods:
- In writing: with a wet-signed petition, delivered in person, by registered mail with return receipt or through a notary, to Cumhuriyet Cad. Hatipoğlu İş Merkezi No:9 D:7, Yalova, Türkiye;
- Electronically: signed with a secure electronic signature or mobile signature, to info@iscan.av.tr;
- by registered electronic mail (KEP);
- from an email address you have previously notified to the Office and that is registered in the Office's systems, to info@iscan.av.tr.
Your application must include your name, surname and, if in writing, your signature; your Turkish ID number for Turkish citizens, or your nationality and passport number or ID number (if any) for foreign nationals; your residential or business address for notification; your email address for notification (if any); your phone and fax number; and the subject of your request. Relevant information and documents should be attached. If the application is made by a third party, a specific authorisation is required.
Your application will be concluded as soon as possible depending on the nature of the request and free of charge within thirty days at the latest. If the operation requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. Additional information may be requested to verify your identity.
If your application is rejected, the response is found insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days from the date you learn of the response, and in any case within sixty days from the date of application.
10. Updates
This Privacy Notice may be updated in line with changes in legislation or in the Office's data processing activities. The current version takes effect on the date it is published on the Website.