Personal data.
Draft privacy notice.

1. Data controller and contact

Example controller field for the professional website: Pelin Karaçam, Attorney at Law — the role and scope remain to be confirmed. The responsibilities of service providers in the technical demo environment will be determined separately.

Bar association: Muğla Bar Association. Bar registration number: 2351. Union of Turkish Bar Associations registration details have not yet been supplied.

Contact email: info@pelinkaracam.av.tr. The procedure for data subject requests, postal application address and any registered electronic mail (KEP) details must be specified separately in the final privacy notice.

2. What information may be processed in this demo?

Connections to the website may generate technical access logs such as IP address, requested page or file path, access time, browser information and server response. Their scope depends on the server configuration.

The current demo has no contact form, membership application, online appointment booking, file upload, advertising pixel or visitor analytics tool. If telephone or email links are used, processing through those channels must be assessed separately.

3. Purpose, method and legal basis

Technical web access logs are generated automatically in the course of providing internet services, investigating security incidents and monitoring system operation. The purpose and applicable legal basis for each processing activity must be clearly identified in the final notice.

For technical security activities, the applicability of the conditions in Article 5(2)(f) of the Law will be confirmed alongside an assessment of necessity and data subjects’ fundamental rights and freedoms. This draft does not present a non-existent legal obligation or consent as an established legal basis.

4. Recipients and international transfers

The demo is hosted on Netcup. The parties involved in hosting, technical maintenance and authorised access, together with the processing location, must be verified through contracts and the data inventory.

Where an international transfer occurs, the transfer conditions under Article 9 of Law No. 6698 must also be met. No claim is made that an appropriate safeguard or another transfer basis has been established for this demo. Publishing a technical text or simply adding a checkbox cannot replace this review.

5. Retention and security

Retention and deletion periods must be determined by reference to the purpose and any applicable obligations. The current server log retention period and backup cycle have not yet been confirmed for the legal notice; no illustrative number of days or years is therefore given.

The website is served over HTTPS. Administration access and technical service accounts are used within their permissions. This statement does not assert that all security and administrative measures have been completed.

6. Data subject rights

Article 11 of the Law provides rights that may include learning whether data is processed and for what purpose, knowing the recipients, requesting correction or deletion where the conditions are met, and other statutory rights. Request procedures and channels will be finalised together with the actual controller information.

This draft must not be moved to production until the applicable procedure and channels for data subject requests have been finalised.