Last updated: 6 October 2026
Privacy notice.
Under Article 10 of Law No. 6698 (KVKK), this notice explains who processes your personal data, why and on what legal basis, who receives it, and your rights.
The Turkish version of this text is the binding one. This English version is provided for information only; in case of any discrepancy the Turkish version prevails.
Sections
01/08
Data controller
This notice has been prepared by HukukBis as data controller, under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. The identity and contact details of the data controller are below.
- Company name
- HukukBis
02/08
Data processed, purposes, legal bases and retention periods
Your personal data is processed for the purposes, on the legal bases and for the periods set out in the table below. The sub-paragraphs given as legal bases refer to Article 5/2 of Law No. 6698.
| Data category | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact: full name, email, phone, firm name (contact form) | Answering requests, demo and sales conversations | Directly related to the formation of a contract (c); legitimate interest (f) | Up to 2 years after the request is concluded |
| Customer transaction: subject, message content, page language, form confirmation | Assessing the request and keeping evidence | Legitimate interest (f); establishment, exercise or protection of a right (e) | Up to 2 years after the request is concluded |
| Newsletter: email address, page language | Sending the newsletter | Explicit consent (Art. 5/1); consent to commercial electronic messages under Art. 6 of Law No. 6563 | For the duration of the subscription; afterwards only the minimum record needed to stop sending |
| Transaction security: one-way value derived from the IP address | Preventing form abuse and automated attacks | Legitimate interest (f); data security obligation (Art. 12) | 10 minutes |
| Server logs: request time, address, response code, error and connection data | Ensuring information security, fixing errors, investigating incidents | Legitimate interest (f); legal obligation (ç) | As long as needed for the purpose and as the relevant legislation provides |
| Account and subscription: user name, email, phone, role, plan, billing information | Providing the Service, managing the subscription, support | Performance of a contract (c) | During the subscription and for limitation periods |
| Invoice and accounting records | Obligations under tax and commercial legislation | Express provision in law (a); legal obligation (ç) | Periods under Law No. 6102 Art. 82 and Law No. 213 Art. 253 (up to ten years) |
03/08
Scope and roles
This notice applies to visitors to the hukukbis.com website, people who send the contact form, newsletter subscribers and law firm users of the HukukBis service. For these persons the data controller is HukukBis.
For the client, opposing party and case data that lawyers and firms enter into HukukBis, the data controller is the lawyer or firm concerned and HukukBis is the data processor. The obligation to inform in relation to that data lies with the firm concerned.
04/08
Method of collection
Your personal data is collected by electronic means: through the contact and newsletter forms on the website, the information you enter when registering for and using the service, and the technical records the server generates automatically. No data is collected on the website through cookies or analytics tools; see the Cookie Policy for details.
05/08
Transfers of personal data
Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in line with the conditions in Articles 8 and 9 of KVKK:
- The domestic MTY Cloud infrastructure on which the Service is hosted and which is operated entirely by HukukBis.
- The payment service provider iyzico: to carry out subscription and payment transactions.
- Email, SMS, WhatsApp and mobile push notification providers: only when you use the relevant feature and as far as it requires.
- Calendar integrations (Google Calendar, Outlook): only to the calendar service you connect and in line with your choice.
- Competent public authorities and courts: to meet obligations under legislation, and limited to the request.
- Legal, tax and financial advisers and auditors: to meet legal and financial obligations.
HukukBis AI is a separately purchased package; only when it is enabled are the AI features processed on a local model on MTY Cloud, entirely inside Turkey; no data is transferred abroad for AI, and the data is not used to train models.
Some of the notification providers may operate systems outside Turkey. Such a transfer is made under KVKK Article 9 where an adequacy decision or the other safeguards provided for are in place.
06/08
Your rights under KVKK Article 11
By applying to the data controller, you can exercise the following rights regarding yourself.
- (a)
To learn
To learn whether your personal data is processed.
- (b)
To request information
To request information if your personal data has been processed.
- (c)
To learn the purpose
To learn the purpose of processing and whether the data is used in accordance with that purpose.
- (d)
To know third parties
To know the third parties in Turkey or abroad to whom personal data is transferred.
- (e)
Correction
To request correction of personal data if it is incomplete or inaccurate.
- (f)
Deletion and destruction
To request deletion or destruction of personal data under the conditions in Article 7 of the Law.
- (g)
Notification
To request that correction and deletion be notified to the third parties to whom personal data has been transferred.
- (h)
Objection
To object to a result against you arising from analysis of the processed data exclusively by automated systems.
- (i)
Compensation
To claim compensation if you suffer damage because your personal data was processed unlawfully.
07/08
How to apply
You can send your applications on your rights in the following ways, under the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette of 10 March 2018, No. 30356):
- Written application: submit your wet-signed petition by hand or by post to the address in the data controller section.
- Application by email: an application sent to the email address in the data controller section from the email address you have previously notified to us and that is registered in our system.
Your application should include your full name and, for a written application, your signature; your Turkish ID number (for foreigners, nationality and passport or ID number); your residential or business address for notification; your email, telephone and fax number for notification, if any; and the subject of your request. We may ask for additional information and documents to verify your identity.
Applications are concluded free of charge as soon as possible according to the nature of the request and at the latest within thirty days; if the process requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged (Art. 13). Our reply is notified to you in writing or electronically.
If the application is rejected, the reply is found insufficient, or no reply is given in time, you may complain to the Personal Data Protection Board within thirty days from the date you learn of the reply and in any case within sixty days from the date of application (Art. 14). The application route to the data controller must be exhausted before a complaint to the Board.
08/08
Data security
As data controller, under KVKK Article 12 we take the necessary technical and organisational measures to prevent unlawful processing of and access to your personal data and to ensure its safekeeping. Details are in the Privacy Policy.