Privacy policy.

This policy applies to the hukukbis.com website (the “Website”) and the cloud-based law firm management service provided at app.hukukbis.com (the “Service”). HukukBis is developed and operated by HukukBis.

For Website visitors, contact form senders and newsletter subscribers, HukukBis is the data controller. For data relating to the clients and cases of law firms using the Service, the roles are described in the next section.

Company name

HukukBis

Under Turkey’s Personal Data Protection Law No. 6698 (“KVKK”), the data controller is the person who determines the purposes and means of processing personal data, and the data processor is the person who processes personal data on behalf of the controller on the basis of the authority granted by it (Art. 3).

When a lawyer or law firm enters data about its clients, opposing parties, cases or documents into the Service, the lawyer or firm is the data controller of that data. HukukBis processes it only as a data processor, on the firm’s instructions and within the service agreement, solely to provide the Service. It does not use this data for its own purposes, share it with third parties or alter it without the firm’s instruction.

Firms are themselves responsible for informing their clients and for ensuring a valid basis for processing. HukukBis is the data controller for the account and subscription data of firm users (name, email, phone, role, billing information) and for Website data.

The following groups of data are processed through the Website and the Service.

• Contact form: full name, email, phone, firm or organisation name, subject, message content, your KVKK confirmation and the page language.
• Newsletter: email address, page language and subscription consent.
• Abuse prevention: an irreversibly derived value of your IP address on form submissions. The raw IP address is not stored for this purpose.
• Server logs: technical records kept for the security and operation of the server (request time, requested address, response code, error details and technical connection data transmitted over the network).
• Account and subscription (Service): user name, email, phone, role and permissions, subscription plan, billing and payment status information.
• Service usage records: session and security events, activity logs.

Your personal data is processed only for the following purposes and in line with the principles in KVKK Art. 4.

• Responding to your requests and conducting demo and sales conversations. Legal basis: the processing is directly related to the formation of a contract, and legitimate interest (KVKK Art. 5/2-c, 5/2-f).
• Sending the newsletter. Legal basis: your explicit consent (KVKK Art. 5/1) and your consent to commercial electronic messages under Article 6 of Law No. 6563.
• Preventing abuse of forms and automated attacks and ensuring system security. Legal basis: legitimate interest and the data security obligation (KVKK Art. 5/2-f and Art. 12).
• Providing the Service, managing the subscription, invoicing and giving support. Legal basis: performance of a contract (KVKK Art. 5/2-c).
• Meeting tax, commercial and other statutory obligations. Legal basis: legal obligation and express provision in law (KVKK Art. 5/2-a and 5/2-ç).
• Establishing, exercising or protecting legal claims. Legal basis: KVKK Art. 5/2-e.

When you submit the contact or newsletter form, your data is validated on the server and forwarded to a secure receiver configured by HukukBis. If delivery fails, the form is not shown as successful, so you know when your request did not arrive.

The Website uses no analytics, advertising or tracking tools, and writes no non-essential cookies to your browser. See the Cookie Policy for details.

To stop forms from being abused by automated submissions, the number of submissions is limited. For this, your IP address is converted one-way on the server; only this converted value and a counter are kept temporarily.

The counter record is deleted automatically at the end of a 10-minute window. Your IP address cannot be recovered from the converted value, and the value is not used for any other purpose or to identify you.

Server logs are kept to keep the Website and the Service secure and available, to fix errors and to investigate security incidents. These logs are not used for marketing or profiling; only authorised technical staff can access them, and they are not kept longer than the purpose requires.

Case, client and document data entered into the Service is isolated per firm; users can access it only within their roles and permissions. The firm decides the purpose, retention period and deletion of this data.

KVKK requests that firms receive from their clients are directed to the firm; HukukBis provides reasonable technical assistance so that firms can respond to them.

The Service is hosted on MTY Cloud, the company’s own cloud infrastructure, operated entirely by HukukBis; hosting is on infrastructure located in Turkey.

HukukBis AI is a separately purchased package; if you have not enabled it, no AI processing takes place. When enabled, the AI features (such as draft petitions, message replies and analysis) run on a local model on MTY Cloud, entirely inside Turkey. No data is transferred abroad or to a third-party AI provider for AI; the content of requests and the case context are not used to train models.

For certain features of the Service, sub-processors in the following categories are used. These transfers take place only when you use the relevant feature and only as far as the feature requires:

• Payment service provider: iyzico. Subscription and online collection payments are processed through iyzico; your card details are processed by iyzico and are not stored on HukukBis servers.
• Notification providers: service providers used to send email, SMS, WhatsApp and mobile push notifications.
• Calendar integrations: calendar services such as Google Calendar and Outlook, only those you connect; hearing and deadline records are sent to these calendars at your choice.

Personal data is kept for as long as the purpose of processing requires or as long as the relevant legislation provides; at the end of that period it is deleted, destroyed or anonymised under KVKK Art. 7.

• Contact requests: up to 2 years after the request is concluded.
• Newsletter subscriptions: for the duration of the subscription; when it ends, deleted except for the minimum record needed to ensure no further emails are sent.
• Abuse prevention counter: 10 minutes.
• Server logs: as long as needed for the purpose and as the relevant legislation provides.
• Account and subscription data: during the subscription and afterwards for the time that limitation periods require.
• Invoices and commercial books and records: the periods under Turkish Commercial Code No. 6102 Art. 82 and Tax Procedure Law No. 213 Art. 253 (up to ten years).
• Firm data: during the subscription; when it ends, exported, deleted or anonymised on the firm’s instruction. Details are in the service agreement.

Under KVKK Art. 12, technical and organisational measures are taken to prevent unlawful processing of and access to data: these include per-firm data isolation, role- and permission-based access, encrypted connections, secure session cookies and access logs.

HukukBis is developed and operated by HukukBis, which holds an ISO/IEC 27001 certified information security management system and TSE certified software development processes.

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information, request correction, deletion or destruction, learn the third parties to whom data is transferred, object to the result of automated analysis and claim compensation for damage.

You can send your request to the email address above or in writing to the company address. The application method, required information and time limits are explained in the KVKK Privacy Notice.

The Website and the Service are aimed at professionals and not at persons under 18, and data is not knowingly collected from them.

This policy may be updated to reflect changes in legislation or in the Service. The current version is always published on this page and the update date at the top changes.

If you have questions, you can reach us using the contact details above.