Privacy & Data Policy

Privacy, Personal Data Protection and Cookie Policy

At Orhan Önal Law and Consultancy Office, we value the privacy and personal data protection of people who visit our website or contact us through our communication channels. This notice explains the purposes and legal bases for processing personal data, the principles governing transfer and retention, your cookie preferences and your rights to submit requests.

This policy covers website visits and initial communications. Separate information is provided for case files, litigation and client matters handled within our legal and consultancy services, according to the nature of the service.

This is a privacy notice; it is not a declaration of explicit consent. Visiting the website or reading this notice does not mean that you consent to the processing of your personal data for every purpose. Where explicit consent is required, information and consent procedures are conducted separately. This distinction is observed in accordance with the Personal Data Protection Board’s Principle Decision dated 18 February 2026, No. 2026/347 .

1. Data Controller and Contact Details

The data controller for the personal data processing activities covered by this notice is Orhan Önal.

• Office: Orhan Önal Law and Consultancy Office
• Website: www.orhanonal.av.tr
• Email: avukat@orhanonal.av.tr
• Office address and other contact details: Our contact page

2. Our Approach to Processing Personal Data

Personal data is information that enables an individual to be identified directly or together with other information. IP addresses and visit logs are therefore personal data insofar as they make the individual identifiable.

Data is processed lawfully and fairly, for specified purposes and only to the extent needed. Accuracy and currency are taken into account. When the purpose or legal obligation requiring retention ends, the relevant records enter the disposal process.

Reliance on a legitimate interest does not place processing outside the scope of the Turkish Personal Data Protection Law (KVKK). Use of this legal basis requires the processing to be necessary and the individual’s fundamental rights and freedoms not to be harmed. Personal Data Protection Authority – Conditions for Processing Personal Data.

3. Data Collected, Purposes and Legal Bases

When you access the site, technical information such as your IP address, pages visited and access time is obtained automatically by electronic means. If you contact us, your name, contact details and the content of your request are obtained directly from you through the email or other communication channel you use.

The purpose and legal basis are assessed separately for each processing activity:

• IP address, page and access time: Site operation and security — KVKK Article 5/2-f.
• Identity, contact details and service request: Steps necessary to enter into a service contract — KVKK Article 5/2-c.
• Technical reports and contact details: Resolving the reported problem — KVKK Article 5/2-f.
• KVKK request and identity verification information: Assessing and responding to the request — KVKK Article 5/2-ç.
• Records relating to disputes: Protection of legal rights — KVKK Article 5/2-e.

These legal bases do not apply jointly and without limitation to all data. Each activity is limited to its own purpose and the data it requires. Clear identification of the processing purpose and legal basis is observed under the Communiqué on the Obligation to Inform .

4. Special Categories of Personal Data and Professional Confidentiality

During initial contact, please do not send copies of identity documents, health records, criminal conviction information or private documents belonging to third parties unless they are necessary to explain your request.

For special categories of personal data required for legal assistance, an appropriate processing condition under the current Article 6 of the KVKK is determined separately. Processing necessary to establish, exercise or protect a right is assessed particularly under Article 6/3-d, and the adequate measures prescribed by the Board are taken. Sending a document does not by itself create unrestricted permission to process it. Personal Data Protection Authority – Special Categories of Personal Data.

Information learned for the purpose of legal assistance is also subject to a lawyer’s duty of confidentiality . Confidentiality is assessed with regard to Article 36 of the Attorneyship Law No. 1136 .

5. Retention and Disposal Principles

Personal data is not retained indefinitely. Retention periods are determined by the type of record, processing purpose, applicable legal obligations and the period necessary to protect a right. Website access logs and files or documents obtained for legal services are not subject to the same retention regime.

When all conditions requiring processing cease to exist, data is erased, destroyed or anonymised so that it cannot be associated with anyone, within the applicable periods. If an ongoing retention obligation exists when a request is assessed, its reason is explained. Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

6. Principles Governing Personal Data Transfers

Data access required for hosting, email, maintenance and information security services is limited to what is needed to provide the service. When technical providers are granted access, confidentiality, data security and compliance with instructions are taken into account. Using a service provider does not remove the data controller’s responsibility. Personal Data Protection Authority – Data Security Obligations.

Sharing with competent judicial or administrative authorities is limited to the necessary information after examining the basis and scope of a legally valid request. Professional confidentiality and lawyers’ professional safeguards are assessed separately.

Transfers of data abroad require a separate legal basis. To use a service requiring such a transfer, the conditions of KVKK Article 9 must be met. The current framework relies on an adequacy decision or appropriate safeguards meeting the necessary conditions; standard contracts are one form of appropriate safeguard. Personal Data Protection Authority – Transfers Abroad.

Exceptions that may apply in the absence of an adequacy decision and appropriate safeguards are limited to occasional transfers. Regular transfers to an ongoing foreign service provider do not become lawful solely through a general cookie consent. The service, recipient group, purpose and transfer method must be explained before the relevant processing activity. Personal Data Protection Authority – Guide to Transfers of Personal Data Abroad.

7. Data Security

Technical and organisational measures appropriate to the nature of the data are taken to prevent unauthorised access and unlawful processing. Restricting access permissions by role, secure communication, updates, backups and monitoring service providers are considered in this context. Security measures are addressed in accordance with the Personal Data Security Guide .

8. Your Rights and How to Submit a Request

With regard to your personal data, you may exercise your rights under Article 11 of the KVKK . These include obtaining information about processing, requesting correction or erasure where the conditions are met, and seeking compensation for damage resulting from unlawful processing. The full list of rights can be found in the Personal Data Protection Authority’s explanation .

You may send a signed request to the office address listed on our contact page . You may also submit a request from an email address you have previously provided to us and which is registered in our system, by emailing avukat@orhanonal.av.tr . Other procedures under the Communiqué on Procedures and Principles for Applications to the Data Controller remain available.

In your request, clearly state your identity, contact details for the response and what you are requesting. Only information necessary for identity verification is requested. Requests are answered as soon as possible and within 30 days at the latest . If the procedure incurs an additional cost, only the fee permitted by the relevant legislation may be charged. Personal Data Protection Authority – Right to Apply.

If your request is rejected, the response is inadequate or no response is provided in time, you may lodge a complaint with the Board within 30 days of learning of the response and, in all cases, within 60 days of submitting your request. Personal Data Protection Authority – Right to Complain.

9. Cookie Policy

What is a cookie? Cookies are small records held in your browser or device in connection with a website you visit. They serve different functions, such as maintaining sessions, security, remembering preferences or measuring usage. Where cookies contain personal data, the KVKK applies.

Not all cookies are deleted when you leave the site. Session cookies generally expire at the end of a browser session. Persistent cookies may remain on the device until their specified period expires or the user deletes them. Being a session cookie does not automatically make a cookie strictly necessary.

Cookies are assessed according to their purposes:

• Strictly necessary cookies: These are necessary to provide the site or a function you expressly request. Remembering security and privacy preferences may fall into this category. They may be used without explicit consent if an appropriate processing condition exists.
• Functional cookies: These remember preferences such as language and appearance. Whether consent is required depends on whether the function was expressly requested and whether the cookie is necessary.
• Analytics cookies: These measure visits and performance. Explicit consent is required for tracking beyond the limited first-party analytics conditions described in the Guide.
• Advertising and tracking cookies: These are used for interest profiling and behavioural advertising and require explicit consent.

This classification does not mean that all the listed cookies are used on this site. Cookie assessments are based on the Personal Data Protection Authority’s July 2025 Guide on Cookie Practices .

Cookies requiring explicit consent must not be activated before a preference is expressed. Continuing to browse, closing an information window or leaving a pre-selected box unchanged does not constitute valid consent. Providing information about cookies and obtaining the necessary consent are separate obligations. Personal Data Protection Board Decision dated 23 December 2022, No. 2022/1358.

You may subsequently withdraw your explicit consent. Withdrawal does not retrospectively invalidate previous processing; it requires processing based on consent to stop after the declaration reaches the data controller. Personal Data Protection Authority – Explicit Consent.

Access to basic site content must not depend on consent to unnecessary cookies. Acceptance, rejection and purpose-specific choices for cookies requiring consent should be clear and easily accessible.

You can manage cookies in your browser. For options to view, delete and block cookies, consult the guidance for Google Chrome, Mozilla Firefox and Apple Safari . Deleting cookies may affect your session and saved preferences. Browser settings do not replace the data controller’s obligation to provide prior information and obtain consent where required.

10. Google and Other Third-Party Resources

The links in the previous policy to the DoubleClick DART explanation, the Google advertising and content network privacy policy and NAI Self-Regulatory Principles for Publishers (PDF) have been retained to provide access to earlier resources. These old addresses may have changed or become unavailable.

For Google’s current explanations, the Google Cookie Policy and Google’s Advertising and Privacy Explanations may be consulted.

Linking to these resources is not a statement that Google AdSense or the advertising technologies mentioned are used on this site. Where a third-party tool is used, its data processing and transfers are assessed separately. A provider’s general privacy policy does not replace our office’s obligation to inform.

When you follow an external link to another website, that site’s data processing practices and cookie preferences apply. The currency and availability of linked content may be changed by the third party. This statement does not limit our office’s statutory responsibility for its own processing.

11. Legal Information and Professional Principles

Articles, case reviews and explanations on our website are prepared to provide general information on legal matters. They do not replace legal advice based on an examination of your specific case. The characteristics of a dispute, evidence, deadlines and current legislation may require a different assessment.

Visiting the site or sending an unsolicited message does not automatically mean that a matter has been undertaken, representation has been accepted or our office has begun monitoring deadlines. For limitation periods and appeal deadlines, you should not rely on sending a message without confirmation that the matter has been accepted.

Our publications respect the independence of the legal profession, professional confidentiality and the prohibition on advertising. Content does not guarantee an outcome or promise success in a case. This approach is based on the Union of Turkish Bar Associations Regulation on the Prohibition of Advertising .

12. Updates

This notice was reviewed on 9 September 2026 . If legislation or data processing practices change, the relevant explanations are updated and a new date is shown on this page.

Changes to this policy do not retroactively authorise earlier processing or automatically constitute explicit consent to new processing. Necessary information is provided before processing data for a new purpose, and separate consent is obtained where required. For questions about privacy, your personal data or this notice, you can contact us at avukat@orhanonal.av.tr .