POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

1. Purpose and Scope

OGS Legal Law Office ("OGS Legal"), attaches paramount importance to the protection of personal data and the duty of professional secrecy. This Policy has been prepared to explain the fundamental principles adopted by OGS Legal in personal data processing activities and to provide general transparency to data subjects within the framework of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), relevant secondary legislation, and decisions of the Personal Data Protection Board.

This Policy applies to clients, prospective clients, website visitors and contact form users, counter-parties, third parties related to legal disputes, employees, employee candidates, supplier/partner representatives, and any other natural persons whose personal data is processed within the scope of OGS Legal's professional operations.

2. Data Controller and Contact Information

Data Controller	Att. Şenol Öztürk
Address	İnönü Cad. No:43/8 Gümüşsuyu, Beyoğlu / Istanbul, Türkiye
E-Mail	ogs@ogslegal.com
Phone	+90 212 240 72 42
Registered E-Mail (KEP)	…
Website	https://ogslegal.com/

3. Fundamental Definitions

Personal Data	Any information relating to an identified or identifiable natural person.
Special Categories of Personal Data	Sensitive categories specified under Article 6 of the KVKK, requiring higher safeguards; including race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership to associations, foundations or trade unions, data concerning health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
Data Subject	The natural person whose personal data is processed.
Data Controller	The natural or legal person determining the purposes and means of processing personal data and responsible for establishing and managing the data filing system.
Data Processor	The natural or legal person processing personal data on behalf of the data controller upon its authorization.
Processing	Any operation performed upon personal data, such as collection, recording, storage, retention, alteration, disclosure, transfer, acquisition, making available, erasure, or destruction.

4. Principles Governing Data Processing

Lawfulness, fairness, and good faith.
Accuracy and, where necessary, keeping data up to date.
Processing for specified, explicit, and legitimate purposes.
Relevance, limitation, and proportionality to the purposes for which data is processed.
Retention for the period stipulated by applicable law or necessary for the purpose of processing.

5. Categories of Processed Personal Data

Depending on the nature of OGS Legal's operations and the specific relationship established with the data subject, the following data categories may be processed:

Identity details (name-surname, signature, identification verification details where required).
Contact information (phone number, e-mail address, physical address).
Legal transaction and dispute file data (consultancy requests, documentation, records, and correspondence pertaining to litigation, enforcement, arbitration, and mediation proceedings).
Client transactions and contractual data.
Financial and accounting information (fees, billing, payments, bank account details).
Professional experience and resume records (pertaining to recruitment processes).
Transaction security and digital log data (IP address, web log records, device and browser data related to site security).
Audio-visual data (depending on the procedural context).
Special categories of personal data; strictly processed only to the extent necessary for legal representation, establishment/exercise/protection of a legal right, or compliance with statutory duties.

6. Purposes of Personal Data Processing

Provision and management of legal consultancy, litigation, and attorney services.
Receiving, evaluating, and responding to legal consultancy and contact requests.
Conflict checks, client onboarding, and verification of professional independence.
Conducting judicial, enforcement, arbitration, mediation, and administrative proceedings, as well as establishing, exercising, or defending legal claims.
Fulfilling legal and regulatory obligations arising from attorney profession legislation.
Managing contractual, invoicing, accounting, and payment operations.
Ensuring information security, operational continuity, and website technical integrity.
Managing and concluding data subject applications, inquiries, and complaints.
Preservation of evidentiary records and protection of legal rights in the event of dispute.

7. Legal Grounds for Data Processing

Personal data is processed on the basis of one or more legitimate processing conditions set forth under Articles 5 and 6 of the KVKK. OGS Legal primarily relies on the following grounds:

Explicitly stipulated by laws (KVKK Art. 5/2-a).
Directly related to the conclusion or performance of a contract, provided that processing is necessary for the contracting parties (KVKK Art. 5/2-c).
Mandatory for the data controller to fulfill its legal obligations (KVKK Art. 5/2-ç).
Mandatory for the establishment, exercise, or protection of a legal right (KVKK Art. 5/2-e).
Necessary for the legitimate interests of OGS Legal, provided it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f).

Special categories of personal data are processed pursuant to Article 6/3 of the KVKK and subject to adequate measures determined by the Board. Explicit consent is sought solely where no statutory legal ground applies.

8. Transfer of Personal Data

8.1. Domestic Transfers

Personal data may be transferred to competent judicial bodies, courts, enforcement offices, public prosecutor offices, arbitration/mediation authorities, regulatory and public authorities, and external service providers such as experts, auditors, financial advisors, banks, postal services, and IT providers strictly in compliance with Article 8 of the KVKK.

8.2. International Transfers

Where international data transfer arises, it is executed pursuant to Article 9 of the KVKK and the Regulation on Transfer of Personal Data Abroad. Transfers are performed subject to adequacy decisions, standard contractual clauses approved by the Board, or explicit statutory exemptions.

9. Data Retention and Erasure

Personal data is retained for statutory limitation periods or for the reasonable duration required to fulfill the underlying processing purpose. Upon expiration of statutory periods or cessation of the processing grounds, personal data is securely erased, destroyed, or anonymized.

10. Data Security and Confidentiality

OGS Legal implements appropriate technical and administrative safeguards to prevent unlawful access, illicit disclosure, or data loss. All employees and attorneys operate under strict professional confidentiality duties imposed by the Attorneys' Act.

11. Rights of the Data Subject and Applications

To learn whether personal data is being processed.
To request information if personal data has been processed.
To learn the purpose of the processing and whether data is used in accordance with its purpose.
To know third parties to whom personal data is transferred domestically or abroad.
To request rectification of incomplete or inaccurate data.
To request erasure or destruction of data under statutory conditions.
To request notification of rectification, erasure, or destruction to third parties to whom data has been transferred.
To object to adverse results produced solely through automated analysis of data.
To claim compensation for damages suffered due to unlawful processing.

Requests under Article 11 of the KVKK may be submitted in writing to İnönü Cad. No:43/8 Gümüşsuyu, Beyoğlu / Istanbul, Türkiye or via e-mail from your registered e-mail address to ogs@ogslegal.com. Inquiries are finalized free of charge within 30 days.

Data Subject Application Form You may download the application form to exercise your statutory rights under KVKK.

Download Form (PDF)

12. Policy Updates

This Policy may be revised in line with regulatory changes, Board decisions, or technical infrastructure updates. The latest version is published on our website.

Last updated: September 2026