Last updated: 13 October 2026
Privacy notice.
Under Article 10 of Law No. 6698 (KVKK), this notice explains who processes your personal data, why and on what legal basis, who receives it, and your rights.
The Turkish version of this text is the binding one. This English version is provided for information only; in case of any discrepancy the Turkish version prevails.
Sections
01/08
Data controller
This notice has been prepared by Vekilaw as data controller, under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. The identity and contact details of the data controller are below.
- Company name
- Vekilaw
02/08
Data processed, purposes, legal bases and retention periods
Your personal data is processed for the purposes, on the legal bases and for the periods set out in the table below. The sub-paragraphs given as legal bases refer to Article 5/2 of Law No. 6698.
| Data category | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact: full name, email, phone, firm name (contact form) | Answering requests, demo and sales conversations | Directly related to the formation of a contract (c); legitimate interest (f) | Up to 2 years after the request is concluded |
| Customer transaction: subject, message content, page language, form confirmation | Assessing the request and keeping evidence | Legitimate interest (f); establishment, exercise or protection of a right (e) | Up to 2 years after the request is concluded |
| Transaction security: one-way value derived from the IP address | Preventing form abuse and automated attacks | Legitimate interest (f); data security obligation (Art. 12) | 10 minutes |
| Connection and infrastructure: IP address, request time and address, browser and device information, security signals (Website and application traffic is routed through the Cloudflare infrastructure) | Providing access, preventing attacks and automated abuse, performance and availability | Legitimate interest (f); data security obligation (Art. 12) | As long as the infrastructure provider needs its security and operating logs |
| Server logs: request time, address, response code, error and connection data | Ensuring information security, fixing errors, investigating incidents | Legitimate interest (f); legal obligation (ç) | As long as needed for the purpose and as the relevant legislation provides |
| Error monitoring: technical error report, error type, request path, version information (personal data is removed from the report) | Detecting and fixing errors, service quality | Legitimate interest (f) | As long as needed to fix the error |
| Account and subscription: user name, email, phone, role, plan, billing information | Providing the Service, managing the subscription, support | Performance of a contract (c) | During the subscription and for limitation periods |
| Email messages: email address, message content and delivery status (account verification, password reset, notifications) | Sending service messages | Performance of a contract (c) | As long as needed for sending and delivery records |
| Invoice and accounting records | Obligations under tax and commercial legislation | Express provision in law (a); legal obligation (ç) | Periods under Law No. 6102 Art. 82 and Law No. 213 Art. 253 (up to ten years) |
| Backup copies: backup copies of the categories above | Keeping the service running after data loss and in emergencies | Legitimate interest (f); data security obligation (Art. 12) | Up to 12 months; data that has been deleted or anonymised drops out of the backups at the end of this period |
03/08
Scope and roles
This notice applies to visitors to the vekilaw.com website, people who send the contact form and law firm users of the Vekilaw service. For these persons the data controller is Vekilaw.
For the client, opposing party and case data that lawyers and firms enter into Vekilaw, the data controller is the lawyer or firm concerned and Vekilaw is the data processor. The obligation to inform in relation to that data lies with the firm concerned.
04/08
Method of collection
Your personal data is collected by electronic means: through the contact form on the website, the information you enter when registering for and using the service, and the technical records the server creates automatically. No cookies or analytics tools collect data on the website; see the Cookie Policy for details.
05/08
Transfers of personal data
Your personal data may be transferred, limited to the purposes above and in line with the conditions in KVKK Articles 8 and 9, to the following recipient groups:
- The domestic MTY Cloud infrastructure where the Service is hosted, operated entirely by Vekilaw.
- Network and security infrastructure provider Cloudflare: processes visitors’ IP addresses and request information to deliver, protect and speed up Website and application traffic (transfer abroad; see below).
- Payment service provider iyzico: to carry out subscription and payment transactions.
- Email delivery provider Resend: to deliver account verification, password reset and notification emails (transfer abroad).
- Error monitoring provider Sentry: to receive technical error reports; configured so that personal data does not enter the report and removed from it (transfer abroad).
- SMS, WhatsApp and mobile push notification providers: only when you use the relevant feature and to the extent the feature requires.
- Calendar integrations (Google Calendar, Outlook) and ICS subscriptions: only to the calendar link you connect or create, according to your choice.
- E-document (e-Invoice, e-Archive, e-SMM) integrators: to the provider the firm chooses, on the firm’s instruction and only as far as the invoice transaction requires.
- Authorised public bodies and courts: to meet legal obligations and limited to the request.
- Legal, tax and financial advisers and auditors: to meet legal and financial obligations.
Transfers abroad: the systems of providers such as Cloudflare, Resend and Sentry are located abroad. These transfers rely on an adequacy decision where one exists under KVKK Article 9 and, where it does not, are made with the appropriate safeguards the Authority provides for (such as standard contractual clauses) and the required notifications. Using the Website and the application means your connection is routed through this infrastructure.
AI access/quota depends on active plan or add-on scope; generation calls also require current company consent, permission and provider configuration. Model settings or the MTY Cloud name alone does not establish the processing country, subprocessors, retention or training-use terms. Verify actual provider and contractual terms before use; these settings do not guarantee domestic-only processing, no transfers or exclusion from training.
06/08
Your rights under KVKK Article 11
By applying to the data controller, you can exercise the following rights regarding yourself.
- (a)
To learn
To learn whether your personal data is processed.
- (b)
To request information
To request information if your personal data has been processed.
- (c)
To learn the purpose
To learn the purpose of processing and whether the data is used in accordance with that purpose.
- (d)
To know third parties
To know the third parties in Turkey or abroad to whom personal data is transferred.
- (e)
Correction
To request correction of personal data if it is incomplete or inaccurate.
- (f)
Deletion and destruction
To request deletion or destruction of personal data under the conditions in Article 7 of the Law.
- (g)
Notification
To request that correction and deletion be notified to the third parties to whom personal data has been transferred.
- (h)
Objection
To object to a result against you arising from analysis of the processed data exclusively by automated systems.
- (i)
Compensation
To claim compensation if you suffer damage because your personal data was processed unlawfully.
07/08
How to apply
You can send your applications on your rights in the following ways, under the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette of 10 March 2018, No. 30356):
- Written application: submit your wet-signed petition by hand or by post to the address in the data controller section.
- Application by email: an application sent to the email address in the data controller section from the email address you have previously notified to us and that is registered in our system.
Your application should include your full name and, for a written application, your signature; your Turkish ID number (for foreigners, nationality and passport or ID number); your residential or business address for notification; your email, telephone and fax number for notification, if any; and the subject of your request. We may ask for additional information and documents to verify your identity.
Applications are concluded free of charge as soon as possible according to the nature of the request and at the latest within thirty days; if the process requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged (Art. 13). Our reply is notified to you in writing or electronically.
If the application is rejected, the reply is found insufficient, or no reply is given in time, you may complain to the Personal Data Protection Board within thirty days from the date you learn of the reply and in any case within sixty days from the date of application (Art. 14). The application route to the data controller must be exhausted before a complaint to the Board.
08/08
Data security
As data controller, under KVKK Article 12 we take the necessary technical and organisational measures to prevent unlawful processing of and access to your personal data and to ensure its safekeeping. Details are in the Privacy Policy.