PRIVACY POLICY
Privacy policy

  • Home
  • Privacy Policy

Dear website user,

As KST Law Firm ("KST"), acting as data controllers, we process personal data relating to the real persons listed below ("Data Subject") in accordance with the details set out in this privacy notice. In this context we may collect personal data from:

  • Visitors to our website (i.e., ksthukuk.com),
  • Employee or intern candidates applying for jobs and internships,
  • Our clients and their authorised representatives to whom we provide legal services,
  • Potential clients and their authorised representatives with whom we conduct business meetings,
  • Our suppliers and their authorised representatives from whom we purchase goods and/or services.

We process personal data collected from Data Subject within the scope of the legal services we provide, in accordance with the purposes, legal bases and details set out in the Personal Data Protection Law No.6698 (“Turkish DP Law”) and specified below.

We ensure that the processing of personal data is relevant, limited and proportionate to the purposes and legal grounds specified below, and that we keep the Data Subject’s personal data of accurate and up to date. The details of this processing are set out below.

1. What is personal data? Which personal data are processed?

Personal data refers to any information that identifies or can identify a real person. This primarily includes your identity information such as your name, surname, national identity number or details from your resume, or your personal bank account information, which can all be linked to you and are considered "Personal Data".

As KST, we process the types of Personal Data belonging to the Data Subject mentioned in this privacy notice. The types of personal data we may process and the purposes and legal basis for processing such data are set out below:


i. If you are a visitor to our website:

If you choose to contact us, we will collect your identity and contact details. However, if you simply visit our website without contacting us, we will only process cookies and log records.

Data category Personal data
  • Identity
  • Name and surname
  • Contact
  • Phone number and e-mail address
*If you do not contact us, the above personal data will not be collected.
Purposes of processing
  • Carrying out communication activities
  • Carrying out business activities
  • Recording visitor contact
Legal bases of processing
  • Manifestly made public by the data subject
Data category Personal data
  • Transaction security
  • Cookies and log record
*For detailed information on Cookies, please reach out to Cookie Policy from here.
Purposes of processing
  • Conducting information security processes
  • Conducting communication activities
  • Carrying out business activities
  • Conducting storage activities
  • Recording visitor access
Legal bases of processing
  • For log records the purpose is:
    • Expressly required by law;
    • Necessary to fulfill the data controller's legal obligations.


ii. If you are an employee candidate or Internship candidate:

Data category Personal data
  • Identity
  • Name, surname, Turkish identity number, birth date
  • Contact
  • Phone number, e-mail address
  • Audio and visual records
  • Photograph
*If it is included in your CV, it will be processed; otherwise your photograph will not be requested.
  • Professional experience
  • Resume/CV, diploma, attendance of courses, training information, certificates, transcript Information
Purposes of processing
  • Conducting recruitment activities and evaluating application processes for employee/Internship candidates
  • Ensuring activities are conducted in compliance with applicable legislation
  • Planning human resources processes
  • Ensuring the security of the data controller's operations
  • Conducting communication activities
Legal bases of processing
  • Manifestly made public by the data subject

In the case of applications for employment and/or internships, personal data relating to the identity and contact details of persons listed as referees in the resume/CV may be processed. In such cases, you are required to ensure that the information outlined in this Privacy Notice is provided to your referees and obtained approval for this sharing from respective persons.


iii. If you are our client or a representative of our client:

Data category Personal data
  • Identity
  • Name, surname, Turkish identity number, tax number, foreign identity number, signature
*If our client is a legal person, Tax No. is not obtained from the representative.
  • Contact
  • Phone number, address, e-mail address
*If our client is a legal person, personal address is not obtained from the client’s representative
**Only the name, surname, telephone number and email address of our potential clients or their representatives are collected.
Purposes of processing
  • Conducting communication activities
  • Conducting business activities
  • Ensuring activities are conducted in compliance with applicable legislation
  • Carrying out legal services and proceedings
  • Conducting the sales processes of goods/services
  • Managing risk management processes
  • Conducting storage and archiving activities
  • Managing contract processes
  • Providing information to authorized persons, institutions, and organizations
Legal bases of processing
  • Processing expressly required by law
  • Processing of personal data is necessary for the establishment, exercise or protection of a legal right
  • Processing of personal data of parties to a contract is necessary, if it is directly related to the establishment or performance of such contract
  • Processing is necessary to fulfill the data controller's legal obligations
Data category Personal data
  • Legal transaction
  • Power of attorney, court file, petition, authorised institution/court correspondence, judgment/decisions
  • Client data
  • Signature circular/signature declaration, share ledger/share certificate, board of directors/general assembly resolution, occupational information, position/seniority
*If our client is a legal person, share Ledger/share certificate is not obtained from the representative.
Purposes of processing
  • Conducting communication activities
  • Conducting business activities
  • Ensuring activities are conducted in compliance with applicable legislation
  • Carrying out legal services and proceedings
  • Conducting the sales processes of goods/services
  • Conducting storage and archiving activities
  • Managing contract processes
  • Providing information to authorized persons, institutions, and organizations
Legal bases of processing
  • Processing expressly required by law
  • Processing of personal data is necessary for the establishment, exercise or protection of a legal right
  • Processing of personal data of parties to a contract is necessary, if it is directly related to the establishment or performance of such contract
  • Processing is necessary to fulfill the data controller's legal obligations
Data category Personal data
  • Finance
  • Bank account number (IBAN)
*If our client is a legal person, this data is not obtained from the client’s representative
Purposes of processing
  • Ensuring activities are conducted in compliance with applicable legislation
  • Conducting financial transactions
  • Conducting business activities
  • Conducting the sales processes of goods/services
  • Managing contract processes
Legal bases of processing
  • Processing expressly required by law
  • Processing of personal data of parties to a contract is necessary, if it is directly related to the establishment or performance of such contract
  • Processing is necessary to fulfill the data controller's legal obligations


iv. If you are our supplier or representative of our supplier

Data category Personal data
  • Identity
  • Name, surname, Turkish identity number, tax number, signature
*If our client is a legal person, Tax No. is not obtained from the supplier’s representative.
  • Contact
  • Phone number, address, e-mail address
*If our client is a legal person, personal address is not obtained from the supplier’s representative.
Purposes of processing
  • Conducting communication activities
  • Conducting business activities
  • Ensuring activities are conducted in compliance with applicable legislation
  • Conducting the procurement processes of goods/services
  • Conducting storage and archiving activities
  • Managing contract processes
Legal bases of processing
  • Processing of personal data of parties to a contract is necessary, if it is directly related to the establishment or performance of such contract
Data category Personal data
  • Finance
  • Bank account number (IBAN)
*If our client is a legal person, this data is not obtained from the supplier’s representative
Purposes of processing
  • Ensuring activities are conducted in compliance with applicable legislation
  • Conducting financial transactions
  • Conducting business activities
  • Conducting the sales processes of goods/services
  • Managing contract processes
Legal bases of processing
  • Processing of personal data of parties to a contract is necessary, if it is directly related to the establishment or performance of such contract

2. Which method we use for collecting/processing your personal data?

We collect personal data of data subject using various methods, either fully or partially automated, or manually as part of any data recording system, in oral, written, or electronic formats during:

  • Obtaining documents provided by you physically or by telephone or email,
  • Obtaining your subscription request for newsletters on website,
  • The establishment of a contractual relationship with you,
  • The job application process,
  • Providing our legal services,
  • The creation of client records and the conduct of KYC processes,
  • The management of litigation and debt collection processes,
  • The recording of expenses under contracts and the execution of related payments,
  • The conduct of office audit activities and the preparation of related reports,
  • The conduct of office compliance activities and the preparation of related reports.

3. How is the security of personal data ensured?

KST is committed to protecting the confidentiality and security of personal data. In this regard, the necessary technical and administrative security measures are implemented to protect Personal Data against data breaches such as unauthorised access, damage or loss. In addition, the necessary technological infrastructure and regular technological security checks are carried out, access to systems used online is provided through multiple authentication systems, data access controls, security transfer controls, business continuity controls and other necessary security measures are applied.

4. Do we transfer your personal data to 3rd parties and/or abroad?

At KST, we are committed to securely storing your personal data for the legally required retention periods and/or in accordance with the purpose of the data processing. We may transfer your personal data to third parties in accordance with Article 8 of the Turkish DP Law, limited to and in accordance with the purposes and legal bases set out below. In this context:

  • For personal data obtained from the client related data subject: within the legal basis related to the establishment or execution of a contract, to:
    • Our business partners for the purpose of creating client records and carrying out KYC processes;
    • Authorised public institutions and organisations such as courts, trade registry office, notaries and tax offices within the country for litigation, enforcement follow-up, legal advice and contractual processes;
    • Courier for document delivery and freight processes;
    • Banking institutions for the preparation of expense reports and payments;
  • For personal data obtained from the Supplier related Data Subject: within the legal basis related to the establishment or execution of a contract, to:
    • Courier for document delivery and freight processes;
    • Banking institutions for the preparation of expense reports and payments;
  • For personal data obtained from data subject: for the legal basis that data processing is mandatory for the establishment, exercise or protection of a right, to:
    • Lawyers and, if necessary, to authorised public institutions and organisations for the follow-up and execution of legal matters in the event of a possible dispute.

In addition, if you contact us by electronic mail, your personal data may be transferred abroad with your explicit consent in accordance with Article 9 of the Turkish DP Law, as we use email and servers located abroad. In order to prevent your personal data from being transferred abroad, you can contact us at our physical address or by telephone.

5. What are your rights as a data subject and how to exercise data subject rights?


i. Your rights in relation to your personal data

We would like to inform you that as a data subject you have the following rights in relation to your personal data processed by KST:

  • To be informed whether your personal data is being processed;
  • To request further information about the processing, if your personal data is being processed;
  • To be informed of the purposes for which your personal data is processed and whether it is used in accordance with those purposes;
  • To be informed of the third parties in the country or abroad to whom personal data may be transferred;
  • To request the rectification of incomplete or inaccurate personal data;
  • To request that third parties to whom personal data is transferred be informed of the request for deletion and destruction of personal data;
  • To request the deletion or destruction of personal data if the reasons which required the processing of such data cease to exist or if the personal data are out of date;
  • To oppose the use of your personal data for purposes that are prejudicial to you and that are processed with the aid of automated systems;
  • To obtain compensation for the damage caused by the unlawful processing of your Personal Data.

You can make requests to us in relation to these rights by using the request procedures below.


ii. Request procedure

You may send your requests regarding your personal data within the scope of Article 11 of the Turkish DP Law in writing or by e-mail to the addresses below via your confirmed address in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ).

KST will evaluate the data subject requests it in accordance with the mentioned communiqué.

6. Data controller

KST LAW FIRM
Address Ferko Signature, Plaza Cubes Büyükdere Cd. No: 175 Esentepe Sisli/Istanbul
Phone number 0 (212) 393 07 42
E-mail address


A Turkish version of the document is also available.