Date of update: 30.10.2026. This notice replaces the notice dated 15.10.2026. The Turkish text is the governing version; this English text is provided for information only.
1. Data controller
The data controller is Kağan Ulaş, Attorney at Law. Address: Validei Atik Mahallesi, Şair Talat Sokak No: 39, Üsküdar, İstanbul. Telephone: +90 212 293 00 06. E-mail: info@kaimhukuk.com. Registered electronic mail (KEP): kagan.ulas.1@hs01.kep.tr.
2. Personal data we process
In respect of our clients and opposing parties: identity and contact details; powers of attorney and documents evidencing authority; the documents forming the subject matter of the file and their content; correspondence with courts, enforcement offices and public authorities; records of service of process; payment and fee records.
In respect of persons who contact the office before an attorney-client relationship is established: contact details and what they tell us about the subject of their enquiry.
In respect of visitors to our website: the IP address, the time of the request and the request details recorded in the server access logs.
Owing to the subject matter of your files, special categories of personal data, such as data concerning health or data relating to criminal convictions, may also be processed. Such data are processed only to the extent the work requires.
3. Channels through which we collect data and what is read in those channels
We collect data through the following channels: the office e-mail addresses, the office WhatsApp Business line +90 212 293 00 06, documents delivered by hand, post and courier, the National Electronic Notification System (UETS), file records accessed through the National Judiciary Informatics System (UYAP), and the server logs of our website.
In these channels, not only who wrote and when but also the content of the message is read. The reading is carried out by the office's case management software; its purpose is to classify incoming documents and messages, to open tasks and to identify statutory time limits. The reading is continuous and automated.
Messages received at and sent from info@kaimhukuk.com are read four times a day. All conversations on the WhatsApp Business line, including one-to-one conversations, are read at fifteen-minute intervals, and the daily record of each conversation and the documents received on the line are saved to the office archive.
A person sees the content in the following cases: where the software opens a task from a document or message you have sent, the attorney responsible for the task and the assistant handling it, if any; where the software considers that it has found a time limit and submits it for an attorney's approval, the approving attorney; where a misclassification or malfunction is being examined, the person examining it; and where a legal dispute, an audit or an obligation arising from legislation so requires. Apart from these cases, no free search is made in the content.
Our duty of professional confidentiality under Article 36 of the Attorneys Act applies to all information passing through these channels and is not limited in time.
4. Purposes of processing
Establishing and performing the attorney-client relationship; preparing and pursuing lawsuits, enforcement proceedings and applications; identifying and monitoring statutory time limits; classifying incoming documents and linking them to files; providing legal advice; calculating and collecting fees; fulfilling our legal obligations; ensuring information security within the office and keeping a record of processing activities.
5. Legal grounds
Article 5(2)(c) of the Law: processing is necessary, provided that it is directly related to the establishment or performance of the power of attorney contract.
Article 5(2)(ç) of the Law: processing is mandatory for the fulfilment of obligations arising from the Attorneys Act, the Code of Civil Procedure, the Enforcement and Bankruptcy Law, the Notification Law and tax legislation.
Article 5(2)(e) of the Law: processing is mandatory for the establishment, exercise or protection of a right.
Article 5(2)(f) of the Law: processing is mandatory for the legitimate interests of the data controller, namely ensuring that incoming documents are not lost and time limits are not missed, provided that it does not harm the fundamental rights and freedoms of the data subject.
In respect of special categories of personal data, Article 6(3)(d) of the Law: processing is mandatory for the establishment, exercise or protection of a right.
This processing is not based on your explicit consent. As there is therefore no consent to withdraw, we ask you to write to us if you notice any practice that goes beyond the limits set out below.
6. Transfer abroad
The office's e-mail, document storage and calendar services are provided through a provider whose servers are located outside Türkiye (Google). Because these services are used, the data processed in connection with your file are technically held on that provider's systems. For this transfer, we are carrying out the process of concluding with the provider the standard contract announced by the Personal Data Protection Board; this notice will be updated once the contract has been signed and notified to the Personal Data Protection Authority.
For the classification of documents, the extraction of tasks and time limits from messages received on the office line and the preparation of legal work, the office makes use of an artificial intelligence service whose servers are located in the United States of America (Anthropic). Where your file and the work on it so require, your information may be sent to this service to the extent necessary. Where necessary for the work to be done, and only to that extent, the texts sent may contain information such as identity numbers, telephone numbers and addresses without masking; where the subject matter of the file so requires, a document containing information on health or criminal records may also be sent within this scope. The service provider does not use the content sent to train its own models and deletes it within thirty days. The Board's standard contract has not yet been signed with this provider; until one of the safeguards set out in Article 9 of the Law is in place, the transfer continues, with the absence of such a safeguard recorded in the office's written records. Information passing through this route is likewise covered by the duty of professional confidentiality under Article 36 of the Attorneys Act.
Your file documents are not sent to any service abroad other than those described above.
Under Article 11 of the Law, your right to know the third parties to whom your data are transferred abroad and to request information about the transfer is reserved.
7. Categories of recipients
Courts, enforcement offices, public prosecutors' offices and other judicial authorities: conduct of court and enforcement proceedings.
Public institutions and organisations: application and notification obligations.
The opposing party and its counsel, court experts, mediators and conciliators: requirements of the proceedings and of dispute resolution processes.
The bar association of which we are a member: professional notifications.
Certified public accountant and banks: fee and payment transactions.
The provider of cloud storage and office applications whose servers are located outside Türkiye (Google) and the artificial intelligence service provider described in Section 6 (Anthropic): limited to the purpose and data described there.
8. Retention periods
File documents are retained for three years from the termination of the power of attorney (Attorneys Act, Article 39). If you have been notified in writing to collect the documents, this period is three months from the notification. In files in which we have a receivable for attorney's fees, the documents are retained for the limitation period of that receivable.
Where the power of attorney is not limited in time, retention continues for as long as the relationship continues.
Messages, documents and e-mails linked to a client file are subject to the retention period of the file to which they are linked. Message records, e-mail records and the software's processing log that are not linked to any file are retained for one year.
Server access logs are retained for the period prescribed by legislation in accordance with the obligations arising from Law No. 5651.
Data whose retention period has expired are subject to periodic destruction at intervals not exceeding six months; the data are erased, destroyed or anonymised.
9. Your rights
Under Article 11 of the Law, every person whose personal data are processed has the right to learn whether their personal data are processed; to request information about the processing if so; to learn the purpose of the processing and whether the data are used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom the data are transferred; to request rectification if the data are incomplete or inaccurate; to request erasure or destruction of the data under the conditions set out in Article 7 of the Law; to request that rectification and erasure be notified to the third parties to whom the data have been transferred; to object to a result to their detriment arising from analysis carried out exclusively by automated systems; and to claim compensation for damage suffered as a result of unlawful processing.
You may send your application to kagan.ulas.1@hs01.kep.tr if you have a registered electronic mail address; with a secure electronic signature or mobile signature; or by a letter bearing your wet signature to the office address above. If you do not have a registered electronic mail address, you may also write to info@kaimhukuk.com; in that case we will contact you in order to verify your identity.
Your application must state your name and surname; your signature, if the application is made in writing; your Turkish identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number if you are a foreign national; your address for service; your telephone number and e-mail address, if any; and the subject of your request.
Your request will be answered within thirty days at the latest from the date on which your application reaches us. In requests for erasure and destruction, our retention obligations under the Attorneys Act and related legislation are reserved to the extent that they exist, and your request is assessed within that framework.
If your application is rejected, if you consider the answer insufficient or if no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the answer and, in any event, within sixty days of the date of your application.
10. Cookies
Our website does not use cookies. Details are set out in the third section of the privacy policy on the website.