Manage KVKK requests with records and plans.
Vekilaw provides client-linked requests, data packages and retention-aware erasure tools. Assess your firm’s and Vekilaw’s legal roles for each processing activity, actual decisions and current agreements; the application alone does not approve compliance or roles.
- Data location
- Setup information Confirm actual processing, backup and provider locations
- AI
- Separate approval Company consent, provider and processing terms are required
- Agreement
- Review required Confirm current scope and signature status separately
- Data tools
- Authorised scope Requests, data packages and erasure plans
Assess roles together with processing scope.
Controller and processor roles depend on actual decisions about processing purposes and means. This table lists office review topics; it is not a signed role allocation or completed duty record for Vekilaw. Compare the privacy notice and current agreements.
| Review topic | Your firm’s assessment | Product / service review |
|---|---|---|
| Purpose of processing and legal basis | Assess and record purpose and legal basis | Review software fields and data sent to providers |
| Informing the client | Determine notice, recipients and communication | A request record is not a privacy notice or delivery proof |
| Technical and organisational measures | Manage roles, permissions, membership and branches | Access/data boundaries are coded; verify actual operational safeguards separately |
| Data subject requests | Assess identity, scope, response and delivery | Authorised requests, packages and plans help prepare the response |
| Retention and destruction | Obtain approval for your retention/erasure matrix | Coded planning rules are not an approved matrix for every firm |
| Service providers | Review current providers and transfer conditions | Technical integrations are not an approved sub-processor inventory |
KVKK Authority: assessing roles (2020/71) (opens in a new tab)
Confirm the scope of your agreements.
Assess processing data, instructions, retention, return/erasure, security and provider conditions through current agreements. This page does not supply a prepared or signed data processing agreement.
- Scope
- Review categories, purpose, duration, roles and instructions for the actual service.
- Measures
- Assess permissions, branch boundaries, document scanning and audit features alongside operational safeguards; source capability is not completed security acceptance.
- At the end
- A client package, company export and company closure are separate operations. Ending an agreement does not run them all automatically; assess backup and retention exceptions separately.
Ask through the contact channel about current contract scope and signature status; a ready document, signing timetable or acceptance of custom terms is not promised.
Verify processing locations by setup and provider.
Application settings do not establish actual hosting, backup, external-provider or AI processing locations. Confirm current operational and contractual information with Vekilaw.
- HostingActual application, data and backup locations and recovery/retention conditions require operational information; this page does not guarantee domestic hosting.
- AIAI requires company consent, permissions, plan/quota and a configured provider. Local model settings alone do not establish transfer, training or retention terms; successful generation saves its input and output in history.
- Notification channelsPreferences, permissions, consent, quota and provider/device conditions vary by channel. Enabling a feature is not consent for every channel or proof of every delivery.
Review provider data, processing locations and applicable transfer conditions separately. Compare the privacy notice with current provider agreements; this product page does not declare transfer safeguards completed.
Current business and contact information
- Legal name
- Vekilaw
- Provider review
Compare the technical security scope with current provider/sub-processor agreements and actual processing conditions. A technical connection does not establish legal status or a completed inventory.
Track requests, packages and erasure plans separately.
A fictional review flow; it creates no real request, delivery or erasure. The product adds 30 days to the recorded receipt time for tracking; that indicator does not replace legal response/deadline review or delivery. Downloading a package does not complete the request.
The request is recorded
- Data export
- Build a JSON or JSON+CSV ZIP package from supported module records linked to the client; it is not a person search across all free text.
- Deletion request
- An authorised user starts handling the request and reviews the current plan and blockers; erasure needs separate explicit confirmation.
- Retention period
- Categories may be erased, anonymised, pseudonymised, retained/identity-held or blocked. Documents are not all automatically purged by age.
- Activity records
- Request transitions and package/action auditing are supported; they are not complete proof of every read, notification or delivery to the person.
For data migration and role management see the data migration and roles and permissions pages.
Clarify incident processes and communication beforehand.
These topics are preparation examples for incident-management discussions. They do not commit to automatic detection, a specific notice deadline, completed response services or preparing a Board notification.
- 01/03
Detection and containment
Identify who assesses the incident, record/access scope and responsibility for containment.
- 02/03
Notice to the firm
Confirm contacts, communication methods and applicable time limits against current agreements and legal assessment.
- 03/03
Information and record
Assess evidence, affected scope and possible notifications; application audit alone is not all incident evidence.
What is asked about KVKK?
- 01/06
Who is the controller and who the processor at Vekilaw?
Legal roles depend on actual processing-purpose/means decisions and authorisation for the activity. Do not assign one automatic role to every data group for the firm and Vekilaw; review the current privacy notice and agreements.
- 02/06
Do I need to sign a data processing agreement?
Assess the actual service, data and instructions with your legal adviser. Ask through the contact channel about current contract/signature status; this page is not a prepared/signed agreement or legal approval.
- 03/06
Is my data transferred abroad?
Actual hosting, backups, provider locations and AI/notification processing conditions need separate verification. Local model or connection settings do not establish transfer/training/retention terms; compare the privacy notice with current operations and agreements.
- 04/06
What do I do when a client asks for their data to be deleted?
Record the request; an authorised person should review the current erasure plan, blockers and retention exceptions. Erasure requires the necessary authority, revision and explicit confirmation. Automatic person matching/erasure must not be assumed for legacy address-only sends or free AI text; pseudonyms or held identity do not mean every record is destroyed.
- 05/06
Will I be informed if there is a data breach?
Confirm contacts, notice channels/time limits and incident support through current agreements. This page does not promise automatic detection or guaranteed notice services. Review the KVKK guide and official sources for your activity.
- 06/06
Can I delete my own user account?
Yes. You can request deletion of your own user account from the account deletion section of the profile settings in the web app, or from the account deletion screen in the mobile app; the request is re-verified with your password (and a code if two-step verification is on). The account is anonymised, open sessions are closed and device registrations are erased. A company owner must first transfer ownership or close the company. This does not replace the KVKK request tools for client-linked requests; those use separate request tools.