Turkish Personal Data Protection Law (KVKK) Privacy Notice

This privacy notice has been prepared within the scope of Article 10 of the Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilment of the Obligation to Inform. It explains the purposes for which personal data collected by Kılıç Kurumsal Danışmanlık A.Ş. through its website and communication channels is processed, to whom it may be transferred, the legal grounds on which it is processed and your rights as a data subject.

A. Data Controller

Your personal data is processed by Kılıç Kurumsal Danışmanlık Anonim Şirketi (Kılıç Kurumsal) in its capacity as the data controller.

• Address: Mustafa Kemal Mah. Dumlupınar Bulvarı No: 274/7, Çankaya / Ankara
• Telephone: +90 312 441 40 41
• E-mail: [email protected]
• Website: https://www.kilickurumsal.com.tr
• MERSİS number: [MERSİS number to be entered]
• KEP address: [KEP address to be entered]

B. Personal Data Processed

Only the data required to assess your request is requested through our website; no unnecessary data is collected.

1. Identity and Contact Data

First name, surname, title, position or department information, institution or company name, telephone number, e-mail address, city or place of work.

2. Request and Transaction Data

The subject and stage of the request, the service or training topics you have selected, your explanatory text, expected output, number of documents, priority and deadline information, your preferred method of response, and your requests for a quotation and preliminary consultation.

3. Uploaded Documents

Limited information contained in documents submitted with your request, such as contract notices, specifications, contracts, progress payments, correspondence, minutes or decisions. If these documents contain personal data belonging to third parties, the person submitting the request is responsible for sharing such data.

4. Transaction Security Data

The IP address, browser information, referring address and campaign tracking parameters automatically recorded when a form is submitted, as well as the date of your KVKK consent and the version of the text to which you consented.

5. Cookie Data

Cookies that are strictly necessary for the operation of the website, as well as analytics and preference cookies subject to your consent. Details are provided on our Cookie Policy page.

C. Purposes of Processing Personal Data

• Receiving and classifying your request and directing it to the appropriate area of work
• Determining the scope of services and training and preparing a written quotation
• Contacting you and arranging a preliminary consultation and appointment
• Conducting pre-contractual discussions and managing the conclusion and performance of the contract
• Checking for conflicts of interest and safeguarding impartiality
• Keeping request records, monitoring business processes and improving service quality
• Ensuring information security and preventing misuse and spam submissions
• Fulfilling legal obligations and providing information to competent authorities

D. Legal Grounds for Processing

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:

• Conclusion or performance of a contract (Art. 5/2-c): Assessing your request, determining the scope and preparing a quotation.
• Fulfilment of a legal obligation (Art. 5/2-ç): Financial legislation and retention obligations.
• Legitimate interest (Art. 5/2-f): Information security, orderly record-keeping, prevention of misuse and measurement of service quality.
• Establishment, exercise or protection of a right (Art. 5/2-e): Retaining the consent record and request history.
• Explicit consent (Art. 5/1): Non-essential cookies and other processing activities requiring explicit consent. You may withdraw your explicit consent at any time.

E. Transfer of Personal Data

Your personal data is transferred only for the purposes specified above and to the extent necessary:

• To our team members responsible for the area of work to which the request relates
• To our suppliers from which we receive hosting, e-mail and information security services
• To authorised public institutions and organisations and judicial authorities upon request
• To providers of accountancy and independent audit services, to the extent required by legislation

If it is determined that your request requires legal representation, you will be informed that this need must be handled through a separate professional organisation; your data will not be transferred to that organisation without your consent.

If you consent to analytics cookies, some of your data may be processed abroad due to the infrastructure of the analytics service provider. Unless you provide consent, the analytics script will not be loaded at all.

F. Method of Collection

Your personal data is collected electronically and by partially automated means through the request and contact forms and document upload fields on our website, e-mail and telephone communications, and cookies.

G. Retention Period

Your personal data is retained for as long as necessary for the purpose for which it is processed, taking into account the limitation and retention periods stipulated in the relevant legislation. When the period expires, the data is erased, destroyed or anonymised. Consent records are retained separately for the purpose of proving the consent given.

H. Data Security

Submitted information is accessible only to authorised personnel; access rights are restricted on a need-to-know basis. Technical and administrative measures are taken to prevent unlawful processing of and access to the data. You are advised not to submit sensitive documents at the initial stage; if deemed necessary, a secure method for sharing documents will be communicated separately.

I. Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed and to request information if it has been processed
• To learn the purpose of the processing and whether the data is being used in accordance with that purpose
• To know the third parties to whom the data has been transferred in Türkiye or abroad
• To request the rectification of incomplete or inaccurate data
• To request its erasure or destruction within the framework of the conditions set out in the Law
• To request that the rectification, erasure and destruction operations be communicated to third parties to whom the data has been transferred
• To object to any outcome against you arising from the analysis of the data exclusively through automated systems
• To request compensation for damage if you suffer damage due to processing contrary to the Law

J. Application Procedure

You may submit requests concerning your rights using the Personal Data Application Form on the “KVKK and Cookies” page of our website or through the address, e-mail address and KEP address specified above. Your application must clearly include information verifying your identity and the details of your request.

Your request will be concluded free of charge as soon as possible depending on its nature and, in any event, within thirty days. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

K. Updates to This Notice

This privacy notice is reviewed in line with changes in legislation and updates to our business processes. When the notice is amended, the version information is updated and, where necessary, your consent is requested again.