Privacy policy.

This policy applies to the vekilaw.com website (the “Website”) and the cloud-based law firm management service provided at app.vekilaw.com (the “Service”). Vekilaw is developed and operated by Vekilaw.

For Website visitors and contact form senders, Vekilaw is the data controller. For data relating to the clients and cases of law firms using the Service, the roles are described separately in the next section.

Company name

Vekilaw

Under Turkey’s Personal Data Protection Law No. 6698 (“KVKK”), the data controller is the person who determines the purposes and means of processing personal data, and the data processor is the person who processes personal data on behalf of the controller on the basis of the authority granted by it (Art. 3).

When a lawyer or law firm enters data about its clients, opposing parties, cases or documents into the Service, the lawyer or firm is the data controller of that data. Vekilaw processes it only as a data processor, on the firm’s instructions and within the service agreement, solely to provide the Service. It does not use this data for its own purposes, share it with third parties or alter it without the firm’s instruction.

Firms are themselves responsible for informing their clients and for ensuring a valid basis for processing. Vekilaw is the data controller for the account and subscription data of firm users (name, email, phone, role, billing information) and for Website data.

The following groups of data are processed through the Website and the Service.

• Contact form: full name, email, phone, firm or organisation name, subject, the content of your message, your KVKK consent and page language.
• Abuse prevention: an irreversibly derived value of your IP address when forms are submitted. The raw IP address is not stored for this purpose.
• Connection and infrastructure data: when you reach the Website and the application, your IP address, request time and address, browser and device information; this traffic is routed through the Cloudflare infrastructure.
• Server logs: technical records kept for the security and operation of the server (request time, requested address, response code, error information and technical connection details sent over the network).
• Error reports: error type, request path and version information about technical errors in the application; personal data is removed from the report.
• Account and subscription (Service): user name, email, phone, role and permissions, subscription plan, invoice and payment status information; if two-step verification (MFA) is on, the related verification records.
• Service usage records: session and security events, activity logs.

Your personal data is processed only for the following purposes and in line with the principles in KVKK Art. 4.

• Responding to your requests and conducting demo and sales conversations. Legal basis: the processing is directly related to the formation of a contract, and legitimate interest (KVKK Art. 5/2-c, 5/2-f).
• Delivering Website and application traffic, protecting it against attacks and keeping it available. Legal basis: legitimate interest and the data security obligation (KVKK Art. 5/2-f and Art. 12).
• Preventing abuse of forms and automated attacks and ensuring system security. Legal basis: legitimate interest and the data security obligation (KVKK Art. 5/2-f and Art. 12).
• Providing the Service, managing the subscription, invoicing and giving support. Legal basis: performance of a contract (KVKK Art. 5/2-c).
• Meeting tax, commercial and other statutory obligations. Legal basis: legal obligation and express provision in law (KVKK Art. 5/2-a and 5/2-ç).
• Establishing, exercising or protecting legal claims. Legal basis: KVKK Art. 5/2-e.

When you submit the contact form, your data is validated on the server and forwarded to a secure receiver configured by Vekilaw. If delivery fails, the form is not shown as successful, so you are told when your request has not arrived.

The Website uses no analytics, advertising or tracking tools, and writes no non-essential cookies to your browser. See the Cookie Policy for details.

To stop forms from being abused by automated submissions, the number of submissions is limited. For this, your IP address is converted one-way on the server; only this converted value and a counter are kept temporarily.

The counter record is deleted automatically at the end of a 10-minute window. Your IP address cannot be recovered from the converted value, and the value is not used for any other purpose or to identify you.

Server logs are kept to keep the Website and the Service secure and available, to fix errors and to investigate security incidents. These logs are not used for marketing or profiling; only authorised technical staff can access them, and they are not kept longer than the purpose requires.

Traffic to the Website and the application is routed through the network and security infrastructure provider Cloudflare. Cloudflare processes the visitor’s IP address and request information to deliver the connection, block attacks and speed up content; in doing so, data may be held on systems located abroad.

Case, client and document data entered into the Service is isolated per firm; users can access it only within their roles and permissions. The firm decides the purpose, retention period and deletion of this data.

KVKK requests that firms receive from their clients are directed to the firm; Vekilaw provides reasonable technical assistance so that firms can respond to them.

The Service is hosted on MTY Cloud, our own cloud infrastructure operated entirely by Vekilaw; client and case data is stored on infrastructure in Turkey. Website and application traffic, however, is routed through Cloudflare (see below).

AI access/quota depends on the active plan or add-on scope; generation calls require current company consent, permission and provider configuration. Model settings alone does not establish the processing country, subprocessors, retention or training-use terms. Verify actual provider and contractual terms separately; these product settings do not guarantee no international transfers or exclusion from training. The person-matching and erasure policy for historical free-text analyses has not yet been determined.

For certain features of the Service, sub-processors in the following categories are used. These transfers take place only when you use the relevant feature and only as far as the feature requires:

• Network and security infrastructure (CDN): Cloudflare. Delivers Website and application traffic, protects it against attacks and speeds it up; for this it processes the visitor’s IP address and request information. Its systems are located abroad.
• Payment service provider: iyzico. Subscription and online collection payments are processed through the iyzico infrastructure; your card details are processed by iyzico and not stored on Vekilaw servers.
• Email delivery provider: Resend. Used to deliver account verification, password reset and notification emails; it processes the email address and message content. Its systems are located abroad.
• Error monitoring provider: Sentry. Receives technical error reports; configured so that personal data does not enter the report and removed from it. Its systems are located abroad.
• Notification providers: the service providers used to send SMS, WhatsApp and mobile push notifications.
• Calendar integrations: calendar services such as Google Calendar and Outlook that you connect yourself, and the ICS subscription link you create; hearing and deadline records are sent to these calendars at your choice.
• E-document integrators: the provider the firm chooses for e-Invoice, e-Archive or e-SMM (for example Paraşüt, Logo, Uyumsoft). Transfers are made on the firm’s instruction and as far as the invoice transaction requires; the firm is the data controller for this data.

Personal data is kept for as long as the purpose of processing requires or as long as the relevant legislation provides; at the end of that period it is deleted, destroyed or anonymised under KVKK Art. 7.

• Contact requests: up to 2 years after the request is concluded.
• Abuse prevention counter: 10 minutes.
• Server logs: as long as needed for the purpose and as the relevant legislation provides.
• Account and subscription data: during the subscription and afterwards for the time that limitation periods require.
• Invoices and commercial books and records: the periods under Turkish Commercial Code No. 6102 Art. 82 and Tax Procedure Law No. 213 Art. 253 (up to ten years).
• Firm data: during the subscription; when it ends, exported, deleted or anonymised on the firm’s instruction. Details are in the service agreement.
• Backup copies: up to 12 months. Data that has been deleted or anonymised drops out of the backups at the end of this period.
• Accounts left without any firm when a firm account is closed: anonymised 30 days after we notify you by email; if you join another firm or sign in during this period, your account is kept.

Under KVKK Art. 12, technical and organisational measures are taken to prevent unlawful processing of and access to data: these include per-firm data isolation, role- and permission-based access, encrypted connections, secure session cookies and access logs.

Vekilaw is developed and operated by Vekilaw. ISO/TSE certificate details have not been published.

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information, request correction, deletion or destruction, learn the third parties to whom data is transferred, object to the result of automated analysis and claim compensation for damage.

You can send your request to the email address above or in writing to the company address. The application method, required information and time limits are explained in the KVKK Privacy Notice.

Service users can export their personal data from within the application. The company owner can ask from the application for the company account to be closed under KVKK: after identity verification the account becomes read-only, an export of the data is prepared and deletion is scheduled; the request can be withdrawn before deletion starts. Retention obligations under legislation (such as for invoices) are reserved.

The Website and the Service are aimed at professionals and not at persons under 18, and data is not knowingly collected from them.

This policy may be updated to reflect changes in legislation or in the Service. The current version is always published on this page and the update date at the top changes.

If you have questions, you can reach us using the contact details above.