The purpose of this Privacy Policy ("Policy") is to provide information about the personal data processing activities and personal data protection systems implemented by T&T & Partners Law Firm ("T&T Partners" or "Our Firm") in accordance with Law No. 6698 on Protection of Personal Data ("PDPL"), the European Union General Data Protection Regulation ("GDPR") and relevant legislation. This Policy aims to inform all individuals whose personal data is processed, particularly our website users, newsletter subscribers, individuals requesting legal consultation, and other website visitors.
1. Legal Basis for Personal Data Processing
T&T Partners processes personal data only based on the following legal grounds: (i) when explicitly provided for in legislation, (ii) when necessary for the establishment or performance of a contract, provided that it is directly related to the contract parties' personal data processing, (iii) when necessary for T&T Partners to fulfill its legal obligations, (iv) when made public by the data subject, (v) when necessary for the establishment, exercise or protection of a right, (vi) when necessary for T&T Partners' legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject, or (vii) when explicit consent of the data subject is available.
Personal data concerning individuals' ethnic origin, political opinion, philosophical belief, religion or sect, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data constitute special categories of personal data. Processing and sharing of special categories of personal data can only be carried out with the explicit consent of the relevant individuals.
2. Purpose and Methods of Personal Data Processing
T&T Partners collects personal data in the categories of identity, contact, digital footprint, technical log and cookie information through channels such as website, electronic mail, telephone, post and physical applications, and undertakes to process them in accordance with the fundamental principles of personal data protection and for the purposes specified below:
Personal data relating to website visitors is processed for the purposes of maintaining the basic functions of the website, improving user experience, enhancing site performance, optimizing our services and ensuring security measures.
Personal data relating to newsletter subscribers is processed for the purposes of sharing current information about T&T Partners, providing information about legal developments, announcing organized events and seminars, communicating legal publications and maintaining client relationships.
Personal data relating to individuals requesting legal consultation is processed for the purposes of conducting preliminary assessment processes, establishing communication, providing legal information, organizing appointments and initiating client relationships.
Personal data relating to individuals making contact is processed for the purposes of responding to questions, meeting information requests, managing feedback processes and ensuring client satisfaction.
3. Sharing of Personal Data within Turkey
When one of the legal grounds specified in Article 1 of the Policy exists, personal data may be shared without obtaining explicit consent. In the absence of these conditions, data sharing is not carried out without the explicit consent of the relevant person.
T&T Partners may transfer personal data, in the presence of the legal grounds set forth in Article 1 and for the purposes specified in Article 2, to technology service providers, hosting companies, email service providers, analytics tool providers, security service organizations, other professional service firms providing legal consultancy, and public institutions and organizations as required by legal obligations operating in Turkey.
4. Transfer of Personal Data Abroad
4.1. Transfer Abroad under PDPL
T&T Partners may process personal data abroad and transfer it abroad when explicit consent of personal data subjects is available. However, in the presence of one of the legal grounds specified in Article 1 of this Policy and when (i) adequate protection determined by the Personal Data Protection Board exists in the foreign country to which personal data will be transferred, or (ii) in the absence of adequate protection, when adequate protection is guaranteed in writing by data controllers in Turkey and the relevant country and permission from the Board is obtained, transfer abroad may be made without seeking consent of the relevant person.
T&T Partners may transfer the personal data it obtains, based on the legal grounds specified in Article 1 and for the purposes set forth above, to cloud service providers, email service providers, web analytics tool providers, security service organizations located abroad, and public institutions and organizations abroad as required by legal obligations.
4.2. Transfer under GDPR
T&T Partners may transfer the personal data it obtains to countries outside the European Economic Area ("EEA").
As a general rule, for personal data to be lawfully transferred to countries outside the EEA, the country to which the transfer will be made must be recognized by the European Commission as a safe country providing adequate level of protection. If the recipient party is not listed among countries providing adequate protection, T&T Partners may carry out data transfer based on (i) binding corporate rules or (ii) standard contractual clauses approved by the European Commission.
5. Storage, Security and Protection of Personal Data
T&T Partners takes all necessary technical and administrative measures to maintain the required security level to prevent unlawful processing of personal data, prevent unauthorized access and ensure proper storage. In this context, T&T Partners implements the following measures:
- SSL certificates and encryption technologies are used for website security
- Procedures for personal data processing processes are defined and regularly reviewed
- Training sessions are organized to raise staff awareness about personal data protection
- Confidentiality agreements are signed with all parties involved in personal data processing processes
- Physical documents are stored in secure environments
- Personal data is stored separately and retention periods are systematically monitored
- Regular system checks are conducted for information security and technological updates are followed
In case of any data security breach, T&T Partners will notify the relevant institutions and data subjects in accordance with PDPL and GDPR within 72 hours at the latest.
6. Rights of Data Subjects
Data subjects may exercise the following rights regarding their personal data by applying to T&T Partners under PDPL:
- Learning whether personal data is processed
- Requesting information if personal data has been processed
- Learning the purpose of processing personal data and whether it is used in accordance with its purpose
- Learning the third parties to whom personal data is transferred domestically or abroad
- Requesting correction if personal data is processed incompletely or incorrectly
- Requesting deletion or destruction of personal data within the framework of PDPL Article 7
- Requesting notification of correction, deletion and destruction operations to third parties to whom personal data has been transferred
- Objecting to the emergence of a result against the person due to analysis of processed personal data exclusively through automated systems
- Requesting compensation for damages in case of damage due to unlawful processing of personal data
Under GDPR Section 3, data subjects have the following rights:
- Obtaining information about personal data processing activities
- Accessing processed personal data and processing activities
- Requesting correction of personal data
- Requesting deletion of personal data (right to be forgotten)
- Requesting restriction of personal data processing activities
- Requesting transfer of personal data to another data controller
- Objecting
- Not being subject to decisions based solely on automated processing
To exercise the rights specified above, data subjects may submit their requests in writing to T&T Partners using one of the following communication methods, along with information that will enable identification:
a. By electronic mail to info@tt-hukuk.com; or
b. By post to Salacak Mahallesi, Salacak İskele Caddesi, No:34 – 1 Üsküdar/İstanbul; or
c. By contacting our telephone line 0850 303 42 83.
For faster evaluation of the application, it is recommended to write "Personal Data Information Request" on the application envelope.
Applications submitted to T&T Partners are responded to within thirty days from the date the request reaches us, depending on the nature of the request. If the information and documents submitted to T&T Partners are incomplete or incomprehensible, the applicant will be contacted to clarify the application.
7. Changes to the Privacy Policy
T&T Partners may make updates it deems necessary to this policy when data processing procedures or legislative provisions change. Such changes take effect with the publication of the updated policy text on our website.
Contact Information:
T&T & Partners Law Firm
- Email: info@tt-hukuk.com
- Phone: 0850 303 42 83
- Address: Salacak Mahallesi, Salacak İskele Caddesi, No:34 – 1 Üsküdar/İstanbul