Data Protection Notice

Document Name: Dedecan Law Personal Data Protection and Processing Policy

Effective Date: 29.09.2026

Last Updated: 29.09.2026

1. INTRODUCTION

Dedecan Hukuk Avukatlık & Danışmanlık Bürosu ("Dedecan Law" or the "Firm") attaches great importance to the privacy and protection of personal data.

This Personal Data Protection and Processing Policy (the "Policy") has been prepared to explain the fundamental principles and rules governing Dedecan Law's personal data processing activities, in compliance with applicable legislation, in particular the Turkish Personal Data Protection Law No. 6698 ("KVKK").

The Policy covers the general principles applicable to the processing of personal data belonging to clients, prospective clients, website visitors, contact form users, opposing parties, employees, interns, suppliers, business partners, visitors, and other individuals who establish any relationship with the Firm.

In personal data processing activities carried out within Dedecan Law, the duty of confidentiality and professional secrecy principles specific to the legal profession are additionally observed.

2. DATA CONTROLLER

For the purposes of personal data processing under the KVKK, the data controller is:

Dedecan Hukuk Avukatlık & Danışmanlık Bürosu

Founding Partners: Att. Ömer Faruk Dedecan, Att. Yaren Buket Dedecan

Address: Paşabağı Mahallesi, Cumhuriyet Caddesi, 160. Sokak No: 6/12, Haliliye/Şanlıurfa, Türkiye

E-mail: dedecanhukuk@outlook.com

Website: dedecanhukuk.av.tr

Data subjects may submit their requests regarding the processing of their personal data under the KVKK to the Firm through the contact channels listed above.

Pursuant to the relevant decision of the Turkish Personal Data Protection Board, the Firm is exempt from the obligation to register with the Data Controllers' Registry (VERBİS), under the exemption granted to lawyers who process personal data solely within the scope of providing legal services.

3. BASIC PRINCIPLES APPLIED IN PROCESSING PERSONAL DATA

Dedecan Law processes personal data in accordance with the general principles set out in Article 4 of the KVKK.

Accordingly, personal data is processed:

In compliance with the law and the principle of good faith,
Accurately and, where necessary, kept up to date,
For specified, explicit and legitimate purposes,
In a manner connected, limited and proportionate to the purposes for which it is processed,
Retained for the period required by applicable legislation or for the period necessary for the purpose of processing.

4. CATEGORIES OF PERSONAL DATA THAT MAY BE PROCESSED

Depending on the nature of the relationship established with Dedecan Law, the following categories of personal data may be processed:

Identity Information: Name, surname, national ID number, date of birth, signature, and other identity information where necessary.

Contact Information: Telephone number, e-mail address, address and other contact information.

Legal Transaction Information: Litigation and enforcement files, legal disputes, contracts, warning letters, applications, decisions of judicial and administrative authorities, and other information obtained in the course of providing legal services.

Client Transaction Information: Requested legal services, meetings, file information, advisory processes and records created within the client relationship.

Financial Information: Information necessary for payment, fee, invoicing, banking and accounting transactions.

Professional and Employment Information: Occupation, position, company or institution information and other professional information required by the nature of the legal service.

Visual and Audio Records: Footage obtained from security camera systems used to ensure the security of the Firm's premises, and visual or audio recordings voluntarily provided to the Firm by the data subject.

Transaction Security Information: IP address, access time, browser and device information, traffic records, security logs, and other technical information obtained to ensure the security of the website.

Special Categories of Personal Data: Where required by the nature of the legal service and where the conditions set out in the KVKK are met, health data, criminal conviction and security measure data, and other special categories of personal data.

The Firm adopts the principle of not collecting or processing personal data that is not necessary for the legal service being provided.

5. PURPOSES OF PROCESSING PERSONAL DATA

Depending on the specific matter and the nature of the relationship with the data subject, personal data may be processed for the following purposes:

Providing legal and advisory services,
Establishing and maintaining client relationships,
Conducting litigation, enforcement, mediation, arbitration and other legal proceedings,
Drafting, reviewing and implementing contracts,
Providing legal opinions and advisory services,
Carrying out necessary transactions with competent public authorities and institutions,
Communicating with clients,
Fulfilling legal and commercial obligations,
Carrying out financial and accounting transactions,
Ensuring information and document security,
Ensuring the security and functionality of the website,
Evaluating requests submitted through the contact form,
Ensuring the physical security of the Firm,
Managing employee and intern processes,
Providing information to competent persons, institutions and organizations as required by legislation,
Following up on legal disputes and protecting the Firm's legal rights.

6. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Personal data is processed based on the processing conditions set out in Article 5 of the KVKK, and, with respect to special categories of personal data, in Article 6.

Accordingly, personal data may be processed where:

Expressly provided for by law,
Directly related to the establishment or performance of a contract,
Necessary for the data controller to fulfil its legal obligation,
Necessary for the establishment, exercise or protection of a right,
Necessary for the Firm's legitimate interests, provided that this does not harm the fundamental rights and freedoms of the data subject,
Made public by the data subject themselves, and under other legal grounds set out in applicable legislation.

Where explicit consent is required for a given processing activity, the explicit consent of the data subject is separately obtained.

7. SPECIAL CATEGORIES OF PERSONAL DATA

Due to the nature of legal services, the processing of special categories of personal data may be required in certain legal proceedings.

Such data is processed only to the extent required by the relevant legal service and where the processing conditions set out in applicable legislation are met.

Dedecan Law takes the necessary technical and administrative measures to ensure the security of special categories of personal data.

8. METHODS OF COLLECTING PERSONAL DATA

Personal data may be collected, in physical or electronic form, through channels such as:

Face-to-face meetings,
Telephone calls,
E-mail correspondence,
Contact forms on the website,
WhatsApp and similar communication channels,
Documents submitted in physical or electronic form,
Contracts,
Litigation and enforcement files,
UYAP and other competent public systems,
Competent public authorities and institutions,
Opposing parties and their representatives,
Business partners and service providers,
Website and technical log records,
The Firm's security cameras.

9. TRANSFER OF PERSONAL DATA

Provided that the transfer is limited to the purposes of processing and complies with the conditions set out in applicable legislation, personal data may, where necessary, be transferred to:

Courts,
Enforcement offices,
Public prosecutors,
Mediation offices and mediators,
Notaries,
Ministries,
Municipalities,
Law enforcement units,
Bar associations and the Union of Turkish Bar Associations,
Other competent public authorities and institutions,
Judicial authorities,
Expert witnesses and specialists,
Financial advisors and other professional consultants,
Third parties required by the nature of the legal process,
Competent service providers.

In every transfer, the principle of data minimization is observed, and only the personal data necessary for the purpose of the transfer is shared.

10. TRANSFER OF PERSONAL DATA ABROAD

Depending on the nature of the website, server, security, e-mail, content delivery network and similar technological services used by Dedecan Law, certain personal data may be processed or transferred through the systems of service providers located abroad.

Cloudflare services may be used in the security, performance and content delivery infrastructure of the website.

Where personal data is transferred abroad, such transfers are carried out in accordance with Article 9 of the KVKK (as amended by Law No. 7589) — covering transfers to a country with an adequate level of protection, the provision of appropriate safeguards, or the exceptional circumstances set out in the law — and in compliance with the current decisions and regulations of the Personal Data Protection Board in this respect.

11. DATA PROCESSED THROUGH THE WEBSITE

When Dedecan Law's website is visited, limited technical data may be automatically processed to ensure the security, performance and technical operation of the website.

Such data may include:

IP address,
Browser type,
Operating system and device information,
Date and time of visit,
Pages accessed,
Security and traffic logs.

Where the contact forms on the website are used, the name, surname, contact information and message content submitted by the user through the form are also processed solely for the purpose of evaluating the relevant request.

Use of the contact form does not, by itself, mean that an attorney-client relationship has been established.

12. COOKIES

Cookies and similar technologies may be used on the website to ensure the website functions properly, to maintain security, to remember user preferences, and, where necessary, to generate usage statistics.

Where non-essential cookies are used, the user's preference or consent is obtained to the extent required.

Users may delete or block cookies through their browser settings. However, blocking essential cookies may cause certain functions of the website to work improperly.

Detailed information on the types, purposes and retention periods of cookies may be found in the separately published Cookie Policy.

13. THIRD-PARTY SERVICES AND CONTENT

The website may include third-party services, maps, links or content such as Google Maps.

When such services are used, the relevant third parties may carry out their own independent data processing activities under their own privacy and cookie policies.

Dedecan Law is not responsible for the independent personal data processing activities carried out by third-party services within their own systems. Users are advised to separately review the privacy policies of the relevant service providers.

14. PHYSICAL PREMISES SECURITY AND CAMERA RECORDS

Security cameras may be used in necessary areas to ensure the physical security of the Firm, of its employees, clients and visitors, and to protect its assets.

Camera systems are not used in areas where this would constitute a disproportionate interference with privacy.

Access to camera recordings is restricted to authorized personnel only, and recordings are deleted, destroyed or anonymized once the period necessary for the purpose has elapsed.

15. DATA RELATING TO EMPLOYEES AND INTERNS

Personal data belonging to individuals employed or interning at the Firm may be processed in accordance with applicable legislation for purposes such as:

Establishing and conducting the employment or internship relationship,
Carrying out personnel processes,
Fulfilling occupational health and safety obligations,
Carrying out wage and benefit processes,
Managing authorization and information security processes,
Fulfilling obligations arising from legislation.

Access rights to personal data relating to employees and interns are restricted, and necessary confidentiality measures are applied.

16. RETENTION AND DESTRUCTION OF PERSONAL DATA

Personal data is retained for the periods set out in applicable legislation or for the period necessary for the purpose for which it is processed.

In determining the retention period, the following are taken into account:

Statutes of limitation and forfeiture periods set out in applicable legislation,
Periods of potential legal liability arising from legal services,
Obligations arising from tax and accounting legislation,
Periods necessary for the establishment, exercise or protection of a right,
Whether the underlying legal relationship continues.

Once the reasons requiring processing cease to exist, personal data is deleted, destroyed or anonymized in accordance with the procedures set out in applicable legislation.

17. SECURITY OF PERSONAL DATA

Dedecan Law takes care to implement the necessary technical and administrative measures to ensure an appropriate level of security in order to:

Prevent the unlawful processing of personal data,
Prevent unlawful access to personal data,
Ensure the safekeeping of personal data.

Depending on need and risk level, measures such as the following may be used:

Authorization and access controls,
Strong password policies,
Up-to-date software and security systems,
Backup mechanisms,
Physical document security,
Confidentiality obligations,
Employee awareness,
System and network security,
Maintenance of access logs.

18. LEGAL PROFESSION, PROFESSIONAL SECRECY AND CONFIDENTIALITY

In the data processing activities carried out by Dedecan Law, special regulations and professional rules relating to the legal profession are taken into account in addition to the KVKK.

The duty of professional secrecy and confidentiality required by the legal profession is observed with respect to information and documents provided to the Firm by clients for the purpose of legal advice or representation.

It is considered fundamental that the Firm's staff and the individuals from whom services are obtained also take the necessary measures to protect confidential information and personal data they access in the course of their duties.

19. RIGHTS OF THE DATA SUBJECT AND APPLICATION PROCEDURE

Under Article 11 of the KVKK, data subjects have the rights set out in applicable legislation with respect to their personal data.

Accordingly, to the extent the relevant conditions are met, data subjects have the right to:

Learn whether their personal data is being processed,
Request information regarding such processing, if any,
Learn the purpose of processing and whether the data is used in accordance with that purpose,
Know the third parties to whom their personal data is transferred, domestically or abroad,
Request the correction of incomplete or inaccurate personal data,
Request the deletion or destruction of personal data where the conditions set out in the law are met,
Request that the correction, deletion or destruction be notified to third parties to whom the personal data has been transferred,
Object to a result that is to their detriment arising solely from the analysis of their data through automated systems, within the conditions set out in the law,
Request compensation for damages arising from the unlawful processing of their personal data.

Applications may be submitted:

In writing to Dedecan Hukuk Avukatlık & Danışmanlık Bürosu, Paşabağı Mahallesi, Cumhuriyet Caddesi, 160. Sokak No: 6/12, Haliliye/Şanlıurfa, Türkiye, or through other methods permitted by applicable legislation.

For electronic communication: dedecanhukuk@outlook.com

For the application to be evaluated effectively, it must contain sufficient information to verify the identity of the data subject and to understand the request.

Applications are evaluated and concluded within the periods set out in applicable legislation.

ANNEX 1 – CATEGORIES OF DATA THAT MAY BE PROCESSED

The main categories of personal data that may be processed within the scope of Dedecan Law's activities are as follows:

Identity: Name, surname, national ID number, date of birth, signature and other necessary identity information.

Contact: Telephone, e-mail, address and other contact information.

Legal Transactions: Data relating to litigation, enforcement, mediation, arbitration, investigations, contracts and other legal proceedings.

Client Transactions: Requests for legal services, meetings, instructions, file and process information.

Finance: Invoice, payment, banking and accounting information.

Professional Information: Occupation, position, company and other information necessary for professional life.

Visual and Audio Records: Security camera footage and visual/audio records provided by the data subject.

Transaction Security: IP address, log records, device and browser information, and security logs.

Special Categories of Personal Data: Special categories of personal data that may be processed where required by the legal service and where the legal conditions are met.

ANNEX 2 – PERSONAL DATA COLLECTION CHANNELS

Personal data may primarily be obtained through the following channels:

Website,
Contact form,
E-mail,
Telephone,
WhatsApp,
Face-to-face meetings,
Physical and electronic documents,
Contracts,
Judicial and enforcement files,
UYAP and other competent public systems,
Public institutions,
Opposing parties and their representatives,
Clients,
Business partners,
Suppliers,
Security cameras,
Website security and access logs.

ANNEX 3 – PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED

Provided that the relevant processing conditions are met and the transfer is necessary, personal data may be transferred to:

Judicial authorities,
Enforcement offices,
Public authorities and institutions,
Law enforcement units,
Notaries,
Mediators,
Expert witnesses,
Bar associations and the Union of Turkish Bar Associations,
Financial and legal advisors,
Competent service providers,
Information technology and security service providers,
Other persons and organizations with whom information sharing is mandatory due to the nature of the legal process.

ANNEX 4 – ENTRY INTO FORCE AND UPDATING OF THE POLICY

This Policy entered into force on 29.09.2026.

Dedecan Law reserves the right to update this Policy in line with changes in legislation, decisions of the Personal Data Protection Board, the Firm's activities, the technologies used, or its personal data processing procedures.

The current version of the Policy is published on the website dedecanhukuk.av.tr.

Where the Policy is amended, the updated text takes effect from the date it is published on the website.