Privacy Notice (KVKK)
In short
- What data: the identity, contact, legal matter and payment information you share when you contact us or engage us; on the website, technical access logs only.
- Why: to assess your request, provide legal services and comply with our legal obligations.
- Legal grounds: mainly KVKK Article 5(2)(c) (contract), 5(2)(ç) (legal obligation) and 5(2)(e) (establishment, exercise or protection of a right).
- Who receives it: only the courts and public authorities your matter requires; never shared for marketing or advertising.
- Website: no cookies, visitor tracking, advertising or analytics tools; information entered into the calculators never reaches us.
- Your rights: you can exercise your rights under KVKK Article 11 by applying to us as described in section 7.
This privacy notice has been prepared under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, regarding the processing of personal data of persons who contact our office, our clients, prospective clients and visitors to our website.
This notice is not a consent form; it is provided for information only. Your explicit consent is not requested for the processing described below.
1. Data controller
- Office
- BülbülKösecioğlu Avukatlık Bürosu
- Data controllers
- Kaan Kösecioğlu, attorney (Samsun Bar Association, reg. no. 3847)
İrem Bülbül Kösecioğlu, attorney (Muğla Bar Association, reg. no. 3019) - Registered email (KEP)
- kaan.kosecioglu@hs01.kep.tr
- Website
- bulbulkosecioglu.av.tr
Each attorney is a separate data controller for the files they handle; in files handled jointly, your data is processed by both attorneys for the same purposes.
2. How and what data is collected
Your personal data is collected by phone, email, WhatsApp, in-person meetings, documents and correspondence you provide, UYAP and other official systems, public registers such as the land and trade registries, and the hosting infrastructure of our website, partly by automated and partly by non-automated means.
By the nature of legal services, personal data of opposing parties, witnesses, heirs or other third persons relating to your matter may also be obtained from you or from official records and processed only to the extent necessary for that matter.
3. Data processed, purposes and legal grounds by process
Contact and appointment requests
- Data
- Name, surname, phone number, email address; brief information and documents you share about your request.
- Purpose
- Assessing your request, getting back to you, arranging a meeting or appointment.
- Legal ground
- Directly related to the conclusion of a contract (Art. 5(2)(c)); our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5(2)(f)).
Providing legal services
- Data
- Identity (name, surname, Turkish ID number, date of birth, power of attorney details), contact (phone, email, address), legal matter data (facts, documents, correspondence, case, enforcement and investigation file details), and third-party data to the extent the matter requires.
- Purpose
- Concluding and performing the engagement agreement; preparing and conducting cases, proceedings and applications; carrying out procedures before courts, notaries and public authorities; keeping you informed about your matter.
- Legal ground
- Conclusion or performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)); establishment, exercise or protection of a right (Art. 5(2)(e)).
Fees, expenses and financial records
- Data
- Identity and contact details, payment and bank account details, receipt and invoice details.
- Purpose
- Tracking fees and file expenses, issuing receipts, fulfilling record-keeping and filing obligations under tax law.
- Legal ground
- Performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)).
Operating the website
- Data
- Transaction security data: IP address, date and time of access, page visited, browser information. These logs are kept technically on the servers of our hosting provider.
- Purpose
- Keeping the website secure, preventing misuse and meeting legal obligations relating to hosting services.
- Legal ground
- Legal obligation (Art. 5(2)(ç)); legitimate interest (Art. 5(2)(f)).
Calculators: Amounts, dates and similar information you enter into the calculators on our website are processed only in your own browser; they are not sent to us or to any other server and are not stored.
Special categories of personal data: Data listed in KVKK Article 6(1), such as health data and data relating to criminal convictions and security measures, is processed only where and to the extent the nature of the matter requires, mainly on the grounds that it is necessary for the establishment, exercise or protection of a right (Art. 6(3)(d)) or expressly provided for by law (Art. 6(3)(b)), and with the adequate measures set by the Personal Data Protection Board. We do not request special categories of data through our website.
4. Transfers
For the purposes above and only as far as the matter requires, your personal data may be transferred to courts, enforcement offices, public prosecutors, notaries, court experts, mediators, land and trade registries and other public authorities authorised by law, in accordance with KVKK Article 8. Information may also be shared with authorities empowered by law upon their duly made requests.
Our website and office email service are hosted on servers located in Türkiye; the hosting provider, as a data processor, can access data only within the scope of the technical service. Your personal data is never transferred to third parties for marketing, advertising or sale.
WhatsApp: If you choose to contact us via WhatsApp, the messages and content you send are transmitted through the infrastructure of WhatsApp (Meta Platforms), whose servers are located abroad. This transfer takes place at your request and on an occasional basis under KVKK Article 9(6)(b). Using this channel is entirely your choice; we recommend sending special categories of data, such as health information or documents relating to criminal files, in person or by email rather than via WhatsApp.
As required by the legal profession, information shared with us is protected by the duty of confidentiality under the Attorneys Act No. 1136.
5. Retention period
- Contact requests that do not lead to an engagement: up to 1 year after the request is concluded.
- Client files: 10 years after the matter ends, the general limitation period under the Turkish Code of Obligations No. 6098, in view of possible disputes.
- Financial records: 5 years from the beginning of the calendar year following the year they relate to, under Article 253 of the Tax Procedure Law No. 213.
- Website access logs: the period required by the legislation applicable to the hosting provider.
At the end of these periods your personal data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. Where a dispute is ongoing or a legal retention obligation applies, the period is extended until that situation ends.
6. Your rights
Under KVKK Article 11, by applying to us you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties to whom it is transferred in Türkiye or abroad,
- request correction if it is incomplete or inaccurate,
- request erasure or destruction under the conditions of KVKK Article 7,
- request that correction, erasure or destruction be notified to third parties to whom the data was transferred,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage caused by unlawful processing.
The duty of confidentiality under the Attorneys Act and retention necessary for the establishment, exercise or protection of a right are reserved in the exercise of these rights.
7. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request by one of the following means:
- a signed written application delivered by hand or through a notary (you can obtain our office address by phone),
- registered electronic mail (KEP) to kaan.kosecioglu@hs01.kep.tr,
- an application signed with a secure electronic signature or mobile signature, sent to kaan@bulbulkosecioglu.av.tr or irem@bulbulkosecioglu.av.tr,
- an email to the same addresses from an email address you have previously given us and that is in our records.
Your application must include your name, surname, signature (for written applications), Turkish ID number (for foreign nationals, nationality and passport number), residential or business address for notification, email address and phone number if any, and the subject of your request.
Applications are concluded free of charge within thirty days at the latest, depending on their nature. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board under KVKK Article 14.
8. Cookies
Our website does not use cookies; it contains no visitor statistics, advertising or third-party tracking tools and does not load fonts or content from external sources.
This English version is provided for convenience. In case of any discrepancy, the Turkish version prevails.
Last updated: 16.10.2026