Personal data notice.

Data controller

Your personal data is processed by the lawyer identified below, acting as data controller.

• Data controller: Av. Olcay Göçüm, Union of Turkish Bar Associations registration no. 1484
• Office name: Göçüm Hukuk
• Address: Panayır Mahallesi, İstanbul Yolu Caddesi No: 387, Biçen Plaza, Kat: 13, Daire: 98–99–100–101, 16220 Osmangazi/Bursa
• Phone: +90 (224) 221 97 00
• Email: info@gocumlaw.com

Data processed, purposes and legal bases

The information is set out below separately for each group of people. The articles cited as legal bases are those of the Law.

Website visitors

• Data: IP address, date and time of access, the page viewed, browser and device information.
• Method of collection: Recorded automatically on the hosting provider’s servers when the site is accessed. The site uses no cookies; the two technical records kept in the browser are described on the cookies page.
• Purpose: Publishing the site, keeping it secure, preventing misuse and investigating technical problems.
• Legal basis: Processing is necessary for the legitimate interests of the data controller (Art. 5(2)(f)).

People who contact the office and prospective clients

• Data: Name, phone number, email and postal address; the subject of the request and the information and documents shared in a meeting or correspondence.
• Method of collection: By phone, email, post or in person, when the information is provided directly by the person concerned.
• Purpose: Assessing the request, replying and arranging a meeting; checking whether anything prevents the matter from being taken on, in particular whether the opposing party has been served in the same matter (Attorneyship Law No. 1136, Art. 38).
• Legal basis: Processing is directly related to the formation of a contract (Art. 5(2)(c)) and is necessary for the data controller to comply with a legal obligation (Art. 5(2)(ç)).

Clients and people mentioned in files

This group covers clients and the opposing parties, witnesses and other third parties named in a file.

• Data: Identity details (name, Turkish ID number, date of birth), contact details and power of attorney details; records of cases, enforcement proceedings and applications, contracts, correspondence and notifications; fee, expense and payment information. Where the matter requires it, special categories of personal data such as health data and data on criminal convictions and security measures.
• Method of collection: Information and documents provided by the client orally or in writing; files and records of courts, enforcement offices and other public authorities (including UYAP, the national judicial network); documents submitted by the opposing party or their lawyer; official registers such as the land registry and the trade registry.
• Purpose: Establishing and conducting the client relationship; giving legal advice; preparing and conducting cases, enforcement proceedings and applications; communicating with the client; keeping track of fees and expenses and issuing receipts and invoices; complying with professional and statutory record-keeping obligations.
• Legal basis: For clients, the formation and performance of a contract (Art. 5(2)(c)); processing expressly provided for by law and the data controller’s legal obligations (Art. 5(2)(a) and (ç)), such as the identity details that procedural law requires in pleadings and record-keeping duties under tax legislation; processing necessary to establish, exercise or protect a right (Art. 5(2)(e)). Data of opposing parties and other third parties is processed to the extent necessary to establish, exercise or protect a right on the client’s behalf (Art. 5(2)(e)). Special categories of data are processed to the extent necessary to establish, exercise or protect a right (Art. 6(3)(d)) and subject to the adequate measures set by the Board (Art. 6(4)).

This information is protected by the duty of confidentiality under Article 36 of Attorneyship Law No. 1136.

Job and traineeship applicants

• Data: Name, contact details, education and professional experience set out in the CV, and any bar or traineeship details; a one-way hash of the sender’s IP address to prevent misuse of the form.
• Method of collection: The application form on the careers page, or applications sent by email or delivered by hand. Details and CVs sent through the form are forwarded by email to info@gocumlaw.com without being stored on the server; the IP hash is deleted after one hour.
• Purpose: Assessing the application, arranging an interview and communicating with the applicant; preventing misuse of the form.
• Legal basis: Processing is directly related to the formation of a contract (Art. 5(2)(c)); the data controller’s legitimate interest in preventing misuse (Art. 5(2)(f)).

Please do not include special categories of personal data, such as health, religion, association membership or criminal convictions, in your CV.

Transfers of personal data

Personal data is transferred only for the purposes below, to the extent those purposes require, and on the legal bases stated above for each group. Information covered by professional confidentiality is shared only as far as the client’s legal matter requires.

Recipients in Türkiye

• Courts, enforcement offices, public prosecutors, mediation offices, notaries, land registry and trade registry offices and other judicial and public authorities: to conduct cases, enforcement proceedings and applications.
• Opposing parties and their lawyers, court experts and mediators: to the extent required by the proceedings or the dispute resolution process.
• Accountant: to keep fee, receipt and invoice records in accordance with tax legislation.
• Competent public authorities: where information or documents are requested by law.

Transfers abroad

Recipient

Hostinger International Ltd. and its affiliates providing the service

Country

Data centre in Germany (company headquartered in Cyprus)

Service

Website hosting; email service for info@gocumlaw.com

Data transferred

Website access records; messages and attachments sent to this address (including job applications)

Recipient

Google LLC

Country

USA

Service

The email service the office uses for correspondence

Data transferred

Messages and attachments sent and received through this service

These transfers are subject to the conditions laid down in Article 9 of the Law. You may also deliver information and documents to the office by hand or by post instead of by email.

Retention periods

• Website access records: for the period set out in the hosting provider’s terms of service.
• Careers form IP hash: one hour.
• Contact and preliminary meeting information (if the matter is not taken on): 1 year from the conclusion of the request.
• Client files: 10 years from the end of the client relationship (the general limitation period, Turkish Code of Obligations No. 6098, Art. 146).
• Job and traineeship applications: 1 year from the conclusion of the application.

When the period expires or the reason for processing no longer exists, the data is erased, destroyed or anonymised. If a dispute, investigation or legal review is ongoing, the relevant records may be kept until it has concluded.

Data security

To prevent unlawful processing of and access to personal data, the following measures are applied under Article 12 of the Law:

• The connection to the website is encrypted (HTTPS).
• Details and CVs sent through the careers form are not stored on the server; they are forwarded directly to the office’s email address.
• No advertising, analytics, tracking or third-party scripts are used on the site.
• Lawyers and office staff may not disclose personal data they learn to others or use it for purposes other than processing, under Article 36 of the Attorneyship Law and Article 12(4) of the Law; this obligation continues after they leave their post.

Your rights

Under Article 11 of the Law, you may apply to the data controller to:

• Find out whether your personal data is processed.
• Request information about the processing, if it has taken place.
• Find out the purpose of the processing and whether the data is used in line with that purpose.
• Know the third parties in Türkiye or abroad to whom the data is transferred.
• Request correction if the data is incomplete or inaccurate.
• Request erasure or destruction under the conditions in Article 7 of the Law.
• Request that correction, erasure or destruction be notified to the third parties to whom the data has been transferred.
• Object to an outcome against you that results from analysis of the data exclusively by automated systems.
• Claim compensation if you suffer damage as a result of unlawful processing.

Requests concerning information covered by professional confidentiality are assessed with due regard to that duty and the rights of other people.

How to apply

You may submit your application, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, in one of the following ways:

• By a petition with a handwritten signature, delivered by hand or by post to the office address.
• From an email address you have previously given to the office and that is in our records, to info@gocumlaw.com.
• Signed with a secure electronic signature or mobile signature, to info@gocumlaw.com.

The application must include your name (and signature for written applications), Turkish ID number (for foreign nationals, nationality and passport number or any identity number), residential or business address for service, any email address and phone number for notifications, and the subject of the request. Relevant information and documents should be attached.

Your application will be concluded free of charge as soon as possible according to the nature of the request, and within 30 days at the latest (Art. 13). If the process involves an additional cost, a fee in accordance with the tariff set by the Personal Data Protection Board may be charged.

If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date (Art. 14).

Updates to this notice

This notice is updated when data processing activities, the services used or the legislation change. The current version is published on this page.

Official sources: Personal Data Protection Law No. 6698 (in Turkish), Personal Data Protection Authority — Obligation to inform (in Turkish).