Personal Data Protection and Processing Policy

Last updated: August 2026

I. Purpose and Data Controller

The purpose of this Personal Data Protection and Processing Policy (the “Policy”) is to provide information about the personal data processing activities carried out by KST Law & Consultancy and the measures adopted for the protection of personal data.

The Policy covers all data subjects whose personal data are processed, including in particular our clients, business partners, employees, job applicants, suppliers, visitors to our website, and the employees and representatives of the institutions with which we cooperate.

Data controller

KST Law & Consultancy

Address

Gayrettepe Mahallesi, Barbaros Bulvarı No: 163/B, Floor: 3, Apt: 5, Beşiktaş / İstanbul

Email

info@kstlawfirm.com

Telephone

0212 220 27 27

The Policy has been prepared within the framework of the Personal Data Protection Law No. 6698 and the secondary legislation issued thereunder. As provided at Art. 1 of Law No. 6698, the provisions of international conventions to which the Republic of Turkey is a party are reserved.

II. Processing Principles and Legal Grounds

A. General Principles

Personal data are processed in accordance with the principles at Art. 4/2 of Law No. 6698: Lawfulness and fairness; accuracy and, where necessary, currency; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes of processing; and retention only for the period prescribed by the applicable legislation or required for the purpose of processing.

B. Legal Grounds

Personal data are processed without the explicit consent of the data subject only where one of the conditions at Art. 5/2 of Law No. 6698 is present. Those conditions are: Where processing is expressly provided for by law (Art. 5/2-a); where it is necessary to protect the life or physical integrity of a person who is unable to give consent due to factual impossibility or whose consent is not legally valid, or of another person (Art. 5/2-b); where processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (Art. 5/2-c); where it is necessary for the data controller to fulfil a legal obligation (Art. 5/2-ç); where the data have been made public by the data subject (Art. 5/2-d); where processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e); and where processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed (Art. 5/2-f).

Where none of these conditions is present, personal data are processed only with the explicit consent of the data subject.

C. Special Categories of Personal Data

Under Art. 6/1 of Law No. 6698, data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with biometric and genetic data, constitute special categories of personal data.

KST Law & Consultancy does not seek to process special categories of personal data in the ordinary course of its activities. No biometric data and no health data are collected.

That said, given the nature of legal practice, documents and information falling within the scope of a dispute or a case file may contain special categories of personal data. In such cases processing is based on one of the conditions at Art. 6/3 of Law No. 6698. Under the provision introduced by Art. 33 of Law No. 7499, in force since 1 June 2024, those conditions are: The explicit consent of the data subject (Art. 6/3-a); express provision by law (Art. 6/3-b); factual impossibility (Art. 6/3-c); data made public by the data subject, consistently with that intention (Art. 6/3-ç); necessity for the establishment, exercise or protection of a right (Art. 6/3-d); necessity for health purposes by persons or authorities under a duty of confidentiality (Art. 6/3-e); necessity for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance (Art. 6/3-f); and processing directed at the members of certain organisations (Art. 6/3-g).

Where special categories of personal data are processed within a case file, the legal ground relied on is as a rule the necessity for the establishment, exercise or protection of a right at Art. 6/3-d. In such processing the adequate measures determined by the Board are additionally taken, as required by Art. 6/4 of Law No. 6698.

III. Data Categories, Purposes and Method of Collection

Personal data are collected by email, through our website and the contact form on it, by telephone, by post, by courier, by hand delivery and in face-to-face meetings.

A. Clients and Business Partners

Categories processed: Identity, contact, legal transaction, client transaction, financial, professional experience and correspondence data.

Purposes: Performance of all legal representation and advisory work, establishment and conduct of the retainer relationship, conduct of pre-contractual discussions and proposals, communication activities, management of finance and accounting processes, provision of information on legal developments, and fulfilment of obligations arising from legislation.

Legal grounds: Art. 5/2-c, Art. 5/2-ç, Art. 5/2-e and Art. 5/2-f of Law No. 6698.

B. Employees and Job Applicants

Categories processed: Identity, contact, personnel file, professional experience and financial data.

Purposes: Conclusion and performance of the employment contract; fulfilment of rights and obligations arising from labour, occupational health and safety, social security and tax legislation; planning and conduct of human resources processes; personnel file administration; performance assessment; and workplace security.

Legal grounds: Art. 5/2-a, Art. 5/2-c, Art. 5/2-ç and Art. 5/2-f of Law No. 6698.

C. Suppliers, Cooperating Institutions and Third Parties

Categories processed: Identity, contact, financial and correspondence data.

Purposes: Conduct of commercial and operational activities, fulfilment of obligations arising from contractual relationships, communication activities, and conduct of tax and return filing processes.

Legal grounds: Art. 5/2-c, Art. 5/2-ç and Art. 5/2-f of Law No. 6698.

D. Website Visitors

Two separate processing activities take place through our website.

First, cookies are used to operate the site and to measure its use. The personal data processed through cookies, the categories of cookie used and their legal grounds are set out separately in the Cookie Policy. Cookies other than strictly necessary cookies are used only where explicit consent has been obtained.

Second, the contact form on the website collects the sender’s name, email address, subject and message content. These data are processed solely in order to assess and respond to the enquiry. The legal ground is the legitimate interest of the data controller under Art. 5/2-f of Law No. 6698, together with Art. 5/2-c where the enquiry concerns pre-contractual discussions.

IV. Transfer of Personal Data

A. Transfers Within Turkey

Under Art. 8 of Law No. 6698, personal data may be transferred without the explicit consent of the data subject where one of the conditions at Art. 5/2, or at Art. 6/3 provided that adequate measures are taken, is present. Where those conditions are absent, transfer takes place only with explicit consent.

On that basis personal data are transferred to service providers and suppliers established in Turkey, business partners, clients, judicial and administrative authorities, the relevant bar association and professional bodies, tax offices, and other institutions permitted by legislation.

B. Transfers Abroad

Transfers abroad are made within the framework of Art. 9 of Law No. 6698, as replaced by Art. 34 of Law No. 7499 and in force since 1 June 2024. The regime under the repealed provision does not apply.

Transfers are carried out according to the following tiered procedure.

1. Adequacy decision: Under Art. 9/1 of Law No. 6698, personal data may be transferred abroad where one of the conditions at Art. 5 and Art. 6 is present and an adequacy decision issued by the Board exists in respect of the destination country, of sectors within that country, or of the international organisation concerned.
2. Appropriate safeguards: In the absence of an adequacy decision, transfer may be made where one of the conditions at Art. 5 and Art. 6 is present, the data subject has the ability to exercise rights and pursue effective remedies in the destination country, and one of the appropriate safeguards at Art. 9/4 is provided. Those safeguards are an agreement between specified public bodies together with Board permission (Art. 9/4-a), binding corporate rules approved by the Board (Art. 9/4-b), a standard contract published by the Board (Art. 9/4-c), and a written undertaking together with Board permission (Art. 9/4-ç).
3. Incidental cases: Where no adequacy decision exists and none of the appropriate safeguards can be provided, transfer may be made only on an incidental basis and only where one of the situations at Art. 9/6 applies. Those situations include the explicit consent of the data subject given after being informed of the possible risks (Art. 9/6-a). Transfers that are continuous rather than incidental cannot be carried out on this basis.

Where transfer is based on a standard contract, the contract is notified to the Authority within five business days of signature (Art. 9/5 of Law No. 6698). Failure to comply with this obligation is subject to an administrative fine under Art. 18/1-d.

The recipient groups to which data are transferred abroad on this basis are: Clients and business partners established abroad; cloud computing, email and website hosting providers with which a contractual relationship exists; measurement service providers used on the website; and, where required by legislation, competent public authorities.

Transfers abroad in connection with cookies used on the website are addressed separately in the Cookie Policy.

The relevant secondary legislation is the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad dated 10 July 2024. The Authority also published its Guide on the Transfer of Personal Data Abroad in January 2025.

V. Legal Professional Privilege and Statutory Exceptions

KST Law & Consultancy is a law firm. Its personal data processing activities are therefore assessed together with the duty of confidentiality at Art. 36 of the Attorneyship Law No. 1136, under which an attorney may not disclose matters entrusted to them or learned in the course of their professional duties.

This has two consequences for the exercise of data subject rights.

First, as regards information and documents within a case file, the extent to which a request from a data subject other than the client of that file can be met is limited by the duty of confidentiality. Information concerning a client’s file cannot be provided to the opposing party in a dispute.

Second, the exceptions at Art. 28 of Law No. 6698 are reserved. Under the second paragraph of that article, provided that it is consistent with and proportionate to the purpose and fundamental principles of the Law, Art. 10 on the obligation to inform, Art. 11 on the rights of the data subject other than the right to claim compensation, and Art. 16 on registration with the Data Controllers’ Registry do not apply in the situations listed in that article.

VI. Retention Periods and Erasure

Personal data are retained for the period prescribed by the applicable legislation or required for the purpose of processing. Where the purpose has ceased or the statutory period has expired, the data are erased, destroyed or anonymised under Art. 7 of Law No. 6698, either on the data controller’s own initiative or at the request of the data subject.

Retention periods are determined by reference to the limitation and retention periods in the applicable legislation, in particular Law No. 1136, the Turkish Code of Obligations No. 6098, the Turkish Commercial Code No. 6102, the Tax Procedure Law No. 213 and the Labour Law No. 4857.

VII. Data Security and Breach Notification

Under Art. 12 of Law No. 6698, all necessary technical and administrative measures are taken to provide an appropriate level of security in order to prevent unlawful processing of personal data, to prevent unlawful access to them, and to ensure their preservation. The measures applied include, without limitation:

• Definition and periodic review of personal data processing procedures
• Regular briefing of staff on data protection legislation
• Execution of confidentiality undertakings with all parties involved in processing and transfer
• Storage of hard-copy documents in access-restricted locations
• Monitoring of retention periods and operation of erasure procedures for data whose period has expired
• Keeping information systems current with access rights restricted

Under Art. 12/2 of Law No. 6698, where personal data are processed on behalf of KST Law & Consultancy by another natural or legal person, joint responsibility exists with that person for the taking of the necessary measures.

Where processed personal data are obtained by others through unlawful means, this is notified to the data subject and to the Board as soon as possible under Art. 12/5 of Law No. 6698. Notification to the Board is made within seventy-two hours of becoming aware of the breach, in accordance with the Board’s decision on the matter.

VIII. Rights of the Data Subject and Applications

Under Art. 11 of Law No. 6698, data subjects have the following rights on application to the data controller:

1. To learn whether their personal data are being processed.
2. To request information if their personal data have been processed.
3. To learn the purpose of processing and whether the data are used in accordance with that purpose.
4. To know the third parties within Turkey or abroad to whom their personal data have been transferred.
5. To request rectification where their personal data have been processed incompletely or inaccurately.
6. To request erasure or destruction of their personal data within the conditions set out at Art. 7 of Law No. 6698.
7. To request that action taken under items five and six be notified to the third parties to whom the data have been transferred.
8. To object to an adverse outcome arising from the analysis of processed data solely by automated systems.
9. To claim compensation for loss suffered as a result of unlawful processing of their personal data.

Requests may be submitted, within the framework of the Communiqué on the Procedures and Principles of Application to the Data Controller, by either of the following means:

1. By email to info@kstlawfirm.com.
2. In writing to Gayrettepe Mahallesi, Barbaros Bulvarı No: 163/B, Floor: 3, Apt: 5, Beşiktaş / İstanbul.

In order for an application to be assessed, it must contain information establishing the identity of the data subject and state the subject of the request. A Data Subject Application Form prepared for this purpose may be downloaded from our website. Use of the form is not mandatory; any application containing the information required by the Communiqué will be assessed.

Applications are concluded free of charge as soon as possible and in any event within thirty days, according to the nature of the request, under Art. 13/2 of Law No. 6698. Where the process entails an additional cost, the fee in the tariff determined by the Board may be charged.

Where an application is rejected, the response is considered insufficient, or no response is given within the period, the data subject may lodge a complaint with the Board under Art. 14 of Law No. 6698 within thirty days of learning of the response and in any event within sixty days of the date of application. A complaint cannot be lodged with the Board before the application route to the data controller has been exhausted.

IX. Amendments to the Policy

Where processing activities or the legislation change, the necessary amendments are made to this Policy. Amendments take effect on publication of the updated text at www.kstlawfirm.com.

Back to home