1.GENERAL OVERVIEW
As Heuvels Uras Law Firm (“HU”), we place importance on the confidentiality and lawful processing and protection of personal data that we process in a “data controller” capacity in accordance with the Law on the Protection of Personal Data No.6698 (“Law”) and the Attorneyship Law No.1136. This Privacy Policy (“Policy”) sets out the principles adopted by HU for conducting of the personal data processing activities undertaken by HU and the fundamental principles adopted with respect to the compliance of HU’s data processing activities with the provisions regulated under the Law, whereby HU informs the personal data subjects and ensures necessary transparency. Your personal data are processed and protected pursuant to this Policy, in full awareness of our responsibility within this scope.
We have prepared this Policy to inform you with regard to your personal data that may be processed by HU and with regard to the purposes of processing, methods and legal grounds for collection, categories of recipients to whom the personal data may be transferred, and your rights under the Law. This Privacy Notice applies to personal data of individuals and shall not apply in cases where HU acts as the “data processor”.
Your personal data may be collected through the information and documents that you have produced or shared with us prior to, during, or after receiving services from HU or through other similar relations, transactions, publicly available resources and platforms (such as media records, the trade registry and the chamber of commerce), communications, research, meetings, interviews, and correspondences that HU has made with you and through other channels, including our website and social media, via oral, written, and electronic platforms, and are processed through automatic (electronic systems and programs that we use) and non-automatic (physical files and physical record keeping activities) means for the purposes explained in this Policy.
Your personal data will be retained within Turkey for the legal retention periods, if any, and/or for the period necessary for the purposes of processing. Your personal data will be erased, destroyed, or anonymized at the end of the retention period necessary for the purposes of processing in accordance with the legislation and relevant policies and procedures of HU.
Regarding the processing and protection of personal data, the applicable legal regulations in force will be given priority in application. HU accepts that in case of any inconsistency or discrepancy between the provisions of the applicable legislation and the Policy, the applicable legislation will prevail. The Policy sets out the rules stipulated in the applicable legislation, by formalizing such within the scope of HU practices.
2.THE PROTECTION AND PROCESSING OF PERSONAL DATA
2.1. THE MAINTENANCE OF THE SECURITY OF PERSONAL DATA
Pursuant to Article 12 of the Law, HU takes necessary measures according to the nature of the data to be protected in order to prevent the unlawful disclosure of, access to, transfer of personal data or any other kind of security deficiencies. Within this scope, HU takes administrative and technical measures which are intended to ensure the necessary security level in compliance with the guidelines that are published by the Personal Data Protection Board ("Board"), carries out or has inspections carried out therefor, and acts in compliance with the measures which are prescribed in the Law in case of the unlawful disclosure thereof.
2.2. THE PRINCIPLES ON THE PROCESSING OF PERSONAL DATA
HU processes personal data in accordance with the procedures and principles which are stipulated in the Law and this Policy. HU complies with the following principles while processing personal data:
i. Data Processing in accordance with the Law and Principle of Good Faith
HU complies with the laws, secondary regulations and general principles of the Law in the processing of personal data, and gives importance to processing personal data as limited to the purposes for processing, and to take the data subjects’ reasonable expectations into consideration.
ii. Ensuring the Personal Data to be Accurate and when Necessary, Up-to-Date
HU takes the necessary measures for the personal data to be accurate and up-to-date during the period in which they are processed, and within this scope, offers the personal data subjects the right to request the correction or deletion of inaccurate and outdated data.
iii. Data Processing for Specified, Explicit and Legitimate Purposes
HU clearly establishes the purposes for which the personal data are processed, and processes such, again in accordance with its business activities, for the purposes connected therewith.
iv. Being Relevant, Limited and Proportionate to the Purposes for Processing
HU limits its data processing activity with the personal data that are required for the realization of the purpose for collection, and collects personal data only in the nature and to the extent required for its business activities, and processes them as limited to the specified purposes.
v. Being Stored only for the Time as Prescribed in the Applicable Legislation or as Necessitated by the Purposes for which They are Processed
HU stores the personal data for the period that is required for the purpose for which they are processed and for the minimum period as stipulated in the applicable legislation. Within this scope, HU initially determines whether any period is prescribed in the applicable legislation for the storage of personal data or not, and if any specific period is designated, adheres to such period. If any statutory period is not prescribed, personal data are stored for the period that is required for the purpose for which they are processed. Personal data are destroyed at the end of the specified storage periods, as per the periodic destruction periods or according to the application of the data subject and with the specified methods of destruction (erasure and/or destruction and/or anonymization).
2.3. THE CONDITIONS FOR THE PROCESSING OF PERSONAL DATA
HU processes the personal data pertaining to the Personal Data Subjects in case of the existence of at least one of the personal data processing conditions listed in article 5 of the Law. Explanations on the said conditions are provided below:
i. Existence of Explicit Consent of the Personal Data Subject
One of the conditions for the processing of personal data is the explicit consent of the data subject. If the Personal Data Subject’s consent to the processing of his/her data is given freely, as adequately informed on the matter, clearly in a manner not to leave room for any doubts, and as limited solely with such operation, HU will carry out the data processing activity. The explicit consent of the Personal Data Subject should be given specifically, based on enlightening and with freewill.
In the event of the existence of the following conditions for the processing of personal data, personal data may be processed without necessitating the explicit consent of the data subject.
ii. Expressly Permitted by any Law
If the personal data of the data subject is expressly permitted by any law, i.e., in case of the existence of a clear provision on the processing of the personal data under the applicable law; this condition for data processing would be deemed to exist. In such case, HU will process personal data according to the applicable legal regulations.
iii. Being Unable to Obtain the Explicit Consent of the Data Subject due to Factual Impossibility
HU may process the personal data pertaining to the data subject who cannot give consent or whose consent cannot be accepted as valid due to factual impossibility, if it is necessary to process such personal data in order to protect the life or physical integrity of the data subject or another person.
iv. Being Directly Related to the Conclusion or Performance of the Contract
If it is necessary to process personal data, provided that the processing is directly related to the conclusion or performance of a contract between the data subject and HU, personal data processing activity will be carried out.
v. Data Processing Required for the HU’s Compliance with a Legal Obligation
Personal data pertaining to the data subject may be processed if it is necessary for HU to comply with its legal obligations.
vi. Personal Data is Revealed to the Public by the Personal Data Subject
In the event that personal data are revealed to the public by the data subject, the personal data concerned may be processed, as limited to the purpose for publicity.
vii. Data Processing Required for the Establishment or Protection of a Right
Personal data pertaining to a data subject may be processed if it is necessary for the establishment, exercise or protection of a right.
viii. Data Processing is Required for the Legitimate Interests of HU Provided not to Impair the Fundamental Rights and Freedoms of the Data Subject
Personal data pertaining to the data subject may be processed if the processing of data is obligatory for HU’s legitimate interests, provided not to impair the fundamental rights and freedoms of the Personal Data Subject, on the condition that the balance of interests between HU and the data subject are observed.
2.4.THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
Personal data of a sensitive nature are attached a particular importance under the Law due to posing a risk for aggrieve or discrimination of persons if unlawfully processed. These “special categories” of personal data are data related to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing and attire, association, foundation or trade union memberships, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Special categories of personal data are processed by HU in accordance with the principles which are prescribed in this Policy and in case of the existence of the conditions set forth below:
i. Special categories of personal data other than those related to health and sexual life may be processed without the explicit consent of the data subject, if expressly permitted by law, i.e., if there is a clear provision on the processing of personal data in the applicable law. Otherwise, the explicit consent of the data subject will be obtained.
ii. Special categories of personal data related to health and sexual life may be processed by persons under the obligation of secrecy or authorized institutions and organizations, without seeking explicit consent, for the purposes of the protection of public health, the operation of preventive medicine, medical diagnosis, treatment and care services, the planning and management of healthcare services and its financing. Otherwise, the explicit consent of the data subject will be obtained.
In the processing of special categories of personal data, HU takes the necessary steps regarding the adoption of the administrative and technical measures which are prescribed by the Board.
2.5.THE CATEGORIZATION, THE PURPOSES FOR PROCESSING, THE METHOD OF COLLECTION, LEGAL BASIS AND TRANSFER OF PERSONAL DATA PROCESSED BY HU
In accordance with our purposes for and the legal basis of the processing of personal data, HU processes and collects personal data in compliance with the general principles which are prescribed under the Law, in particular the principles set forth in Article 4 of the Law regarding the processing of personal data, on the basis of and limited with at least one of the conditions for the processing of personal data as
enumerated in Articles 5 and 6 of the Law, by informing the data subjects pursuant to Article 10 of the Law and secondary legislation.
HU may also transfer personal data and special categories of personal data pertaining to the personal data subjects to third parties in Turkey by taking the necessary security measures in accordance with the legal personal data processing purposes. In this respect, HU acts in accordance with the regulations laid down in articles 8 and 9 of the Law and the additional regulations determined by the Board.
2.6.THE PERIOD OF STORAGE, ERASURE, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA
HU keeps the personal data for the period that is required for the purpose for which they are processed and for the minimum period as stipulated in the applicable legislation. Within this scope, HU initially determines whether any period is prescribed in the applicable legislation for the storage of personal data or not, and if any specific period is designated, adheres to such period. If any statutory period has not been prescribed, personal data are stored for the period that is required for the purpose for which they are processed. Personal data are destroyed at the end of the specified storage periods, as per the periodic destruction periods or according to the application of the data subject and with the specified methods of destruction (erasure and/or destruction and/or anonymization).
If the purpose for processing personal data cease to exist; the storage periods which are stipulated in the applicable legislation or which are determined by HU have elapsed; personal data may only be stored in order to constitute evidence in any potential legal disputes or to assert any relevant personal data rights or to institute defense. In the establishment of the periods set forth herein, the periods of prescription for the assertion of any rights and despite the lapse of the prescription periods, the storage periods are determined on the basis of the examples of requests previously directed at HU on the same matters. In such case, the personal data which are stored is not accessible for any other purpose and the personal data concerned is accessed solely when required to be used in any relevant legal dispute. Following the expiry of the period mentioned herein, the personal data are erased, destructed or anonymized.
Without prejudice to the provisions of the other laws on the erasure, destruction or anonymization of personal data, HU erases, destructs or anonymizes the personal data ex officio or upon the data subject’s request, if the reasons necessitating the processing thereof cease to exist. With the erasure of personal data, such data cannot be re-used or retrieved in any manner. Accordingly, personal data are erased from the channels such as documentation, files, CDs, floppy disks, hard disks in which they are recorded, in an irreversible manner. The destruction of personal data purports the destruction of the materials suitable for storage such as documentation, files, CDs, floppy disks, hard disks in which data are recorded in a manner in which information cannot be retrieved or re-used. The anonymization of data refers to rendering it impossible for personal data to be associated with any natural person who is identified or identifiable, in any manner, even if linked with other data.
2.7.THE RIGHTS OF THE PERSONAL DATA SUBJECTS AND THE EXERCISE OF SUCH RIGHTS
HU hereby informs the Personal Data Subjects about their rights as per Article 10 of the Law; provides guidance as to how they can exercise such rights, and executes the necessary internal operations, administrative and technical regulations for all of the foregoing. Pursuant to Article 11 of the Law, the Personal Data Subjects possess the following rights:
i. Being informed of whether his/her personal data are processed or not,
ii. To request information thereon if his/her personal data have been processed
iii. Being informed of the purpose for the processing of his/her personal data, and whether such data are being used in compliance with such purpose,
iv. To know of any third parties in Turkey or abroad to whom his/her personal data are transferred,
v. To request the rectification of incomplete or inaccurate personal data, if any, and to request notification of this action to third parties to whom his/her personal data have been transferred,
vi. To request the erasure or destruction of his/her personal data despite the processing in accordance with the Law and other applicable legal provisions, once the reasons necessitating the processing cease to exist, and to request notification of this action to third parties to whom his/her personal data have been transferred,
vii. To object to any outcome to his/her detriment by means of the analysis of the processed data exclusively through automated means,
viii. To request compensation for his/her damage due to the unlawful processing of his/her personal data.
The personal data subjects may send their requests regarding their rights which are enumerated in this Policy, through the methods that are determined by the Board.
If the personal data subjects duly send their applications regarding their rights listed in this Policy to HU, HU will conclude such requests, free of charge and as soon as possible considering the nature of the request and within 30 (thirty) days at the latest. However, in case the operation requires an additional cost, the fee designated by the Board in the tariff may be charged.
HU takes the necessary administrative and technical measures in order to conclude the applications to be filed by the personal data subjects, in accordance with the Law and the secondary legislation.
In case of the rejection of the application, insufficient reply or non-reply within due time; the personal data subject may file a complaint with the Board within thirty days as of the date on which (s)he learns of the reply, and in any event, within sixty days as of the date of application.
3.COOKIES
We may use Cookies on our website at https://heuvels-uras.com in order to enable our visitors to benefit from our website in the most efficient manner and to develop user experience. The relevant cookies will be erased automatically upon the termination of the website session.
4.SECURITY
HU securely stores information pertaining to the personal data subjects, and thereby takes all necessary measures for the protection of such information against any loss, misuse or change. HU is obligated to keep the data shared by the personal data subjects for the delivery of the necessary services, confidential pursuant to its contractual obligations, and not to use such for any other purposes. Even if personal data are transferred to any third party by HU, the data concerned will be considered as confidential at all times.
5.ENFORCEMENT
HU may, at its sole discretion and unilaterally, amend this Policy at any time it deems appropriate, by publishing it on its website. The amended provisions of this Policy will enter into force and effect on the date of publication on the website, and the remaining provisions will remain in full force and continue to be effective and bear the consequences thereof. This Policy cannot be modified by the unilateral declaration of member.
