Privacy Policy

Last updated: 21 October 2026

This notice explains what personal data we process when you visit www.yavuzozdemir.av.tr or contact us, why we process it and on what legal basis, who receives it, how long we keep it and what rights you have. It is our privacy notice (aydınlatma metni) under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where the EU General Data Protection Regulation (“GDPR”) applies to you, our information notice under Articles 13 and 14 GDPR. Reading this notice does not mean you consent to anything.

1. Who we are

The data controller is Av. Yavuz Özdemir, attorney at law, member of the İstanbul Bar Association, practising as Özdemir Law & Consultancy.

Address: Kıztaşı Cad. Açıklar Sok. 27/3, 34080 Fatih, İstanbul, Türkiye
Email: m.y@yavuzozdemir.av.tr
Phone: +90 530 541 5082

2. What we process, why and on what basis

2.1 When you contact us

You can contact us through the contact form, by email, by phone or through WhatsApp.

• Data: your first and last name, email address, phone number and country of residence (if you give them), the area of law you select, the content of your message and anything else you choose to tell us, and the date and time of contact.
• Purposes: to reply to your enquiry, to check for conflicts of interest, and, if you decide to instruct us, to prepare and carry out the engagement.
• Legal basis:
  • Steps taken at your request before entering into a contract: KVKK Art. 5(2)(c); GDPR Art. 6(1)(b).
  • Our professional obligations, including the conflict check required of attorneys: KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c).
  • Our legitimate interest in responding to people who contact us: KVKK Art. 5(2)(f); GDPR Art. 6(1)(f).

Please do not send special categories of personal data (for example health information or criminal records) through the form unless they are needed to describe your matter. If you do send them, we use them only to assess and handle your legal matter. In that case we rely on the establishment, exercise or protection of a right (KVKK Art. 6(3); GDPR Art. 9(2)(f)).

2.2 Visitor statistics

This website has its own visitor counter. It runs on every page view, whatever you choose in the cookie banner.

• Data:
  • Your IP address, and your approximate location worked out from it (city, region, country and approximate coordinates).
  • The page you viewed and the time.
  • The website that referred you, and the campaign information in the link you followed (for example utm_ parameters, or the fact that you arrived from an ad).
  • Your browser and device type (the browser's “user agent”).
• Purposes: to see how many people visit, from which countries and through which channels; to manage our advertising budget; and to spot misuse of the website.
• Legal basis: our legitimate interests in understanding and managing our website and advertising (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). You can object at any time (see section 8).

2.3 Google Ads measurement and advertising

• Data:
  • Online identifiers stored in cookies, and the ad-click identifier (gclid) when you arrive from a Google ad.
  • Your IP address, browser information and the pages you visit.
  • Whether you sent the contact form or clicked our phone, email or WhatsApp link. The content of your message is never sent to Google.
• Purposes: to measure which Google ads lead to enquiries. If you allow it, Google may also use this data to personalise ads.
• Legal basis: your consent, given through the cookie banner (KVKK Art. 5(1); GDPR Art. 6(1)(a)). Where the law of your country does not require consent, we rely on our legitimate interest in measuring our advertising. You can switch this off at any time (see section 3).

2.4 Running the website

• Saved settings: the website stores your cookie choice, and a copy of the page text to make pages load faster. This contains no personal data about you.
• Server logs: our hosting provider keeps technical logs of each request (IP address, time and page requested).
• Third-party files: when your browser loads fonts, scripts and some images from third-party servers (Google and Unsplash), those servers receive your IP address and browser information.
• Legal basis: our legitimate interest in delivering a working, secure website (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). Storage that is strictly necessary does not require consent.

We do not sell personal data. We do not make decisions about you based solely on automated processing.

3. Cookies and similar technologies

How the cookie banner works.

• If you are in the European Economic Area, the United Kingdom, Switzerland or Türkiye, Google advertising and measurement cookies stay off until you click “Accept all”.
• In other countries they are on by default, and clicking “Reject” turns them off.
• While they are off, Google's tags use Google Consent Mode. This means Google may still receive basic signals without cookies (for example, that a page was viewed or a form was sent, together with browser information and IP address), and ad-click identifiers are removed. Google uses these signals only in aggregated, modelled form.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page, or open cookie settings now. Withdrawing consent does not affect processing that took place before.

4. Who receives your data

We share personal data only as far as needed for the purposes above.

• Google (Google Ireland Limited and Google LLC):
  • Google Ads and Google Tag Manager (advertising measurement).
  • Firebase / Cloud Firestore, the database that stores visitor statistics and the website's content.
  • Google Fonts and Google-hosted scripts.
  For Google Ads, Google also uses some data as an independent controller. See how Google uses information from sites that use its services and Google's Privacy Policy.
• Web3Forms, the service that delivers contact form messages to our mailbox.
  • Web3Forms states that it operates from India and stores submissions on Amazon Web Services.
  • It uses Cloudflare and Hetzner for its infrastructure.
  • Its spam-filter providers (CleanTalk, Akismet) may receive the sender's IP and email address.
  See Web3Forms' privacy policy.
• ipwhois.io (ipwho.is), an IP-location service that our visitor counter queries to find the approximate location of an IP address. See its privacy policy.
• Unsplash, which hosts some of the images on our pages. See Unsplash's privacy policy.
• Our website hosting and email service providers, which store and transmit the website and our email on our behalf.
• WhatsApp (Meta) and LinkedIn, only if you choose to contact us or visit our profile through them. Their own privacy policies apply.
• Courts, public authorities and professional advisers bound by confidentiality, where the law requires it or where it is needed to establish, exercise or defend legal claims.

5. Transfers outside Türkiye

Some of the providers listed above, or their subprocessors, store or process data outside Türkiye, including in the European Union, the United States, India and other countries where they operate. We transfer personal data abroad only in line with Article 9 of the KVKK. This means either:

• an adequacy decision of the Personal Data Protection Board, where one exists; or
• the appropriate safeguards listed in Article 9, such as the standard contracts published by the Board; or
• for transfers that are only occasional, the exceptions listed in that Article.

If you are in the EU, you provide your data directly to us in Türkiye.

6. How long we keep your data

• Enquiries that do not lead to an engagement: up to 2 years from our last contact, then deleted or anonymised. We keep them longer only if they are needed for a legal claim.
• Client matters: for the duration of the matter, and afterwards for the periods required by law and the professional rules for attorneys, and in any case until the relevant limitation periods have expired.
• Copies held by our form provider (Web3Forms): for the retention period set in our account, and no longer than the 3 years allowed under its terms.
• Visitor statistics: 90 days, then deleted automatically.
• Google Ads cookies: up to 90 days on your device. Data held by Google is kept according to Google's own retention policies.
• Your cookie choice: in your browser until you change it or clear your browser data.

7. Confidentiality and security

Information you give us about a legal matter is protected by attorney professional secrecy under the Turkish Attorneys' Act No. 1136. The website is served only over an encrypted connection (HTTPS). Access to enquiries and visitor data is limited to the attorney and to people working under the attorney's supervision who are bound by confidentiality. No method of transmission over the internet is completely secure. For highly sensitive information, please ask us first which channel to use.

8. Your rights and how to use them

Under Article 11 of the KVKK you have the right to:

1. learn whether your personal data is processed;
2. request information about it if it is processed;
3. learn the purpose of the processing and whether the data is used for that purpose;
4. know the third parties, in Türkiye or abroad, to whom it is transferred;
5. request correction of incomplete or inaccurate data;
6. request erasure or destruction of your data under the conditions in Article 7 of the KVKK;
7. request that third parties who received your data are told about such a correction, erasure or destruction;
8. object to a result that is against you and arises only from automated analysis of your data;
9. claim compensation if you suffer damage because your data was processed unlawfully.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection. In particular, you can object to the visitor statistics described in 2.2. Where we rely on your consent, you can withdraw it at any time.

How to apply. Send your request:

• in writing to our address above; or
• by email to m.y@yavuzozdemir.av.tr from the email address you previously used with us, or signed with a secure electronic signature.

Please include:

• your name and surname;
• your Turkish ID number if you are a Turkish citizen, or your nationality and passport or ID number if you are not;
• your postal or email address for our reply;
• what you are asking for.

We may ask you to confirm your identity. We reply as soon as possible and within 30 days at the latest, free of charge. A fee may be charged only where the KVKK allows it, for example when the reply involves an additional cost.

Complaints. If you are not satisfied with our reply, or we do not reply within 30 days, you may complain to the Turkish Personal Data Protection Board (www.kvkk.gov.tr). Under the KVKK you must first apply to us. You then have 30 days from our reply, or 60 days from your application if we do not reply, to file the complaint. If you live in the EU, the EEA or the UK, you may also complain to the data protection authority in your country.

9. Other information

This website is not directed at children under 18. If this notice changes, we will publish the new version on this page with a new “Last updated” date.