Privacy Notice (KVKK)

Your personal data may be processed by Günser + Partners Law & Consultancy in its capacity as data controller.

The contact details of the data controller are as follows: Title — Günser + Partners Law & Consultancy; Address — Aziziye Mahallesi, Refik Belendir Sokak No:109 D:3, 06690 Çankaya/Ankara; Telephone — 0533 701 24 51; Email — info@gunserlaw.com.

Depending on the nature of your relationship with Günser + Partners, the following personal data may be processed:

Identity data: name, surname, national ID number, date of birth and similar information.

Contact data: telephone number, email address, postal address and similar information.

Client and transaction data: requests, applications, complaints, meeting notes and appointment records.

Legal transaction data: documents relating to litigation, enforcement proceedings, powers of attorney, contracts, applications and the legal process.

Financial data: where necessary within the scope of the service relationship, payment, invoice and accounting records.

If you visit our website and give your explicit consent to analytics in the cookie banner, the following technical data is also processed. The list covers all of the fields actually stored in the database:

Connection and identifier data: raw IP address, connection date and time, the visitor correlation identifier written to your browser (the random value in the vid cookie), and the session identifier.

Data derived from the IP address: country, region, city, time zone, city-level latitude and longitude values, continent, and, regarding your internet service provider, the ASN number, the operator name and the operator's domain.

Device and browser data: the full browser identifier (User-Agent), browser name and version, operating system and version, device type (mobile, tablet, desktop) and device model, screen and viewport dimensions, pixel density, touch capability, device memory, number of processor cores, connection type, browser language and language list, dark theme and reduced motion preferences, and whether the request comes from automated software (a bot).

Site usage data: the addresses of the pages viewed, the referring address, campaign parameters (utm_source, utm_medium, utm_campaign), traffic type, whether you are a new visitor, time spent on the page, scroll depth, your clicks on contact links (WhatsApp, telephone, email) and form submission events.

This technical data is processed only while your explicit consent is present. If you do not give consent, or if you withdraw it, none of these records is created; for details, see the sections "Website Analytics and Visitor-Level Evaluation" and "Technical Processing Carried Out Without Explicit Consent" below.

Location information based on the IP address is not obtained from your device's location services; it is an estimated technical datum derived from your IP address. Including the latitude and longitude values, this data is produced by the hosting infrastructure at city-centre accuracy; it is not of GPS precision and does not contain an open address. The site does not request location permission.

Your special categories of personal data, on the other hand, are processed only where your explicit consent is present, where expressly provided for by law, or where the cases permitted under the relevant legislation exist, and only to the extent necessary.

Your personal data may be processed for the purposes of carrying out legal consultancy and attorney services, evaluating your applications, requests and contact forms, and conducting appointment, meeting and client communication processes.

Your data is also processed for the purposes of following up litigation, enforcement, mediation, contract and similar legal processes, fulfilling contractual and legal obligations, carrying out finance and accounting operations, and fulfilling obligations arising from legislation towards authorized public institutions and organizations.

Ensuring the security of the website, preventing misuse and improving the user experience are also among the purposes.

In website analytics based on your explicit consent, technical data is not turned into aggregate statistics only; it is also evaluated at the level of the individual visitor. The different page views and interactions of the same visitor are linked to one another through the correlation identifier, may be displayed as a single visitor history in the administration panel accessible to the firm, and are used to send the firm a notification if a contact link is clicked. How this evaluation works is explained separately below.

Your personal data may be processed on the basis of the following legal grounds, depending on the specific processing activity: its being expressly provided for by law; its being directly related to the conclusion or performance of a contract; and its being mandatory for the data controller to fulfil its legal obligation.

In addition, the following legal grounds are relied upon: that processing is mandatory for the establishment, exercise or protection of a right; that processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject; and, where necessary, the presence of your explicit consent.

Your personal data may be collected through automated or non-automated methods via the contact forms on our website, email, telephone, WhatsApp, physical documents, face-to-face meetings, powers of attorney, contracts, application documents and the technical infrastructure of the website.

This section explains how website analytics actually works. Analytics data is not turned into aggregate statistics only; it is also evaluated at the level of the individual visitor.

If you select "Accept" in the cookie banner, a randomly generated correlation identifier with a lifetime of 1 year (the vid cookie) is written to your browser. This cookie is set as httpOnly, Secure and SameSite=Lax; it is read only by the server and cannot be read by scripts on the page. For as long as this identifier remains in your browser, the visits you make at different times, the pages you view and your interactions are combined into a single visitor history and may be displayed in that form in the password-protected administration panel accessible only to the firm.

If, as a visitor who has given explicit consent, you click one of the WhatsApp, telephone or email links on the site, an automatic notification email is sent to the firm's address info@gunserlaw.com. That email contains the following information: the type of link clicked (WhatsApp, telephone or email), the address of the page you were on at the time of the click, the city and country derived from your IP address, the name of your internet service provider (operator/ASN), your device type, and a link that opens all activity associated with the relevant correlation identifier in the administration panel.

This notification does not contain your raw IP address, your latitude and longitude values or your full browser identifier; that data is held only in the database. For the same visitor and the same link type, a notification is generated at most once every six hours.

All of the processing activities described in this section are based on YOUR EXPLICIT CONSENT pursuant to Article 5/1 of the KVKK. If you do not give consent, no correlation identifier is written, no page view or interaction record is created, and no notification email is generated.

To withdraw your consent you do not need to deal with browser settings: it is sufficient to click the "Cookie preferences" button in the footer of every page. The button reopens the cookie banner; when you select "Decline", the decision takes effect immediately, your correlation identifier is deleted, the analytics records kept in your browser (the session identifier and the new-visitor marker) are removed, and no new records are created.

The withdrawal of explicit consent takes effect prospectively. Records created up to the date of withdrawal are deleted automatically at the end of the retention period set out below; if you wish, you may also request that they be deleted earlier.

If you select "Decline" in the cookie banner, no analytics data is collected. Nevertheless, there is a limited number of technical operations carried out independently of consent, for the operation of the website and the prevention of misuse; they are set out explicitly below.

Article view counter: when you open an article in the publications section, the view count of that article is increased by one. Only the address of the article and the total count are held in the database; no information relating to the visitor is recorded.

Misuse prevention (rate limiting): in order to prevent the view counter from being inflated by automated requests, the number of requests within a 10-minute window is counted. Your IP address is not stored in the clear in this record; the IP address is combined with a value that changes daily, hashed with SHA-256, and only this irreversible hash is kept.

A rate limit is also applied in order to prevent misuse of the contact form. That record is created only when you submit a form, contains your IP address, and is deleted within two days at the latest.

The legal ground for this processing is the legitimate interest of the data controller pursuant to Article 5/2-f of the KVKK, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your personal data may be transferred only for the purposes set out in this notice and in accordance with the legislation.

Within this scope, your personal data may be shared with courts, enforcement offices, public prosecutors, law enforcement units, notaries, mediation offices, relevant public institutions and organizations, financial advisors, audit and technical service providers, and with the persons and organizations necessary for carrying out the legal service.

The service providers used to operate the website, and the transfers within this scope, are as follows: the website is hosted on the infrastructure of Vercel Inc. and the technical data relating to your visit passes through that infrastructure; visit and interaction records are stored in a managed PostgreSQL database service; the contact form, the request form and automatic notification emails are delivered through the email delivery service Resend; and, for visits where explicit consent has been given, the IP address is sent to the ipinfo.io lookup service in order to determine which operator it belongs to.

As some of these providers are located abroad, such transfers are carried out within the framework of the KVKK provisions on transfer abroad and only where the conditions provided for therein exist.

Your personal data is retained for as long as the purpose of processing requires, taking into account the retention, limitation and proof periods provided for in the relevant legislation.

For records relating to website visits, the retention period is 12 months. Visit and interaction records are permanently deleted from the database 12 months after they are created, by an automated clean-up job that runs once a day. Rate-limiting records kept for misuse prevention are deleted within two days at the latest. Article view counters contain no personal data and are therefore not subject to these periods.

The information you submit through the contact form and the request form on the website is not stored in the database; it is delivered directly by email to the firm's corporate mailbox and is kept there taking into account the limitation and proof periods in the relevant legislation concerning the assessment of your application.

The cookies and local records kept in your browser are limited to their own lifetimes; the full list, by name, purpose and duration, is available in the Cookie Policy.

Upon expiry of the retention period or where the reasons requiring the processing of personal data cease to exist, your personal data is deleted, destroyed or anonymized in accordance with the relevant legislation.

As a data subject under the KVKK, you have the rights to learn whether your personal data is being processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in accordance with that purpose, and to know the third parties to whom your personal data is transferred domestically or abroad.

In addition, you have the rights to request the rectification of incompletely or inaccurately processed personal data, to request its deletion or destruction within the framework of the conditions provided for in the legislation, to request that these operations be notified to the third parties to whom the data has been transferred, to object to a result arising against you as a consequence of the analysis of personal data exclusively through automated systems, and to request compensation for the damage you suffer due to the unlawful processing of personal data.

You may submit your applications regarding your rights under the KVKK to Günser + Partners Law & Consultancy in writing or through the other methods provided for in the legislation.

You may make your applications through the following channels:

Address: Aziziye Mahallesi, Refik Belendir Sokak No:109 D:3, 06690 Çankaya/Ankara

Email: info@gunserlaw.com

Your applications are concluded, depending on the nature of the request, as soon as possible and within thirty days at the latest. Where the operation additionally requires a cost, a fee determined within the scope of the relevant legislation may be charged.

If you use the contact form on the website or contact us directly, the personal data you share may be processed for the purpose of evaluating your application and communicating with you.

Only two cookies are used on the website: the telemetry_consent cookie, which remembers the acceptance or refusal you express in the cookie banner, and the vid correlation cookie, which is written only where explicit consent is present. No advertising or marketing cookies and no third-party cookies are used. The full list of cookies and of the local records kept in your browser, by name, purpose, duration and type, is set out in the Cookie Policy.

In data processing activities based on explicit consent, you may withdraw your explicit consent at any time. To withdraw, you may use the "Cookie preferences" button in the footer of every page; the button reopens the cookie banner and allows you to change your decision. The withdrawal of explicit consent takes effect prospectively from the date of withdrawal.

This text is intended as general information regarding the processing of your personal data. The text may be updated in the event of changes in the data processing procedures.