Last updated: 8 October 2026
This notice is addressed to visitors of the website operated by istlegal Attorneys at Law (“istlegal”, “we”), to people who use our contact or incident forms, and to business contacts who reach out to us. It fulfils our information duties under the EU General Data Protection Regulation (GDPR, 2016/679) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
1. Data controller
- Name: istlegal Attorneys at Law
- Address: İstiklal Cd. No:56 D:5, 34435 Beyoğlu / Istanbul, Türkiye
- Email: mail@istlegal.com
- Phone: +90 850 309 9721 (weekdays 09:00 – 18:00)
Once an attorney–client relationship is established, personal data processed for the legal services are handled separately under professional secrecy rules and the engagement terms. This notice covers only the website and pre-engagement contacts.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone | Form, email, phone |
| Business details | Company/organisation, role, title | Form |
| Request content | Incident summary, consultation topic, urgency | Form |
| Technical data | IP address, browser and device data, access time | Automatic (server logs) |
Important: please do not include patient information, health data, trade secrets, passwords or access credentials in forms or in first contact. Such information is collected through secure channels after an engagement is in place. If it is shared anyway, it is processed solely to assess your request and with appropriate safeguards.
3. Purposes and legal bases
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Assessing your request and replying | Art. 6(1)(b), 6(1)(f) | Art. 5/2-c, 5/2-f |
| Prioritising cyber breach notifications and conflict checks | Art. 6(1)(f) | Art. 5/2-f |
| Website security and operation | Art. 6(1)(f), Art. 32 | Art. 5/2-f, Art. 12 |
| Compliance with legal obligations (e.g. professional rules, record keeping) | Art. 6(1)(c) | Art. 5/2-ç |
| Establishment, exercise or defence of legal claims | Art. 6(1)(f), 9(2)(f) | Art. 5/2-e |
| Activities based on consent: personalising the corporate experience (adapting content and calls to action to the practice area you are interested in), analytics cookies; also newsletters, only if you opt in | Art. 6(1)(a) | Art. 5/1 |
Special categories of data, such as health data (GDPR Art. 9, KVKK Art. 6), are processed only on the basis of explicit consent or a statutory exception and with additional safeguards.
4. Recipients and international transfers
Data may be shared, as needed and in line with the purposes above, with:
- Global technology suppliers, based in Türkiye or abroad, that provide email, web hosting, cloud infrastructure and form security (spam/bot protection) services and meet data security standards,
- Competent public authorities, courts and professional bodies where legally required,
- Auxiliary persons and partners (e.g. external experts, translators, expert witnesses) under confidentiality duties.
International transfers. The global technology suppliers from which we obtain email, web hosting and cloud infrastructure services may operate servers and facilities outside Türkiye (for example in the EU or the United States). Using this infrastructure may result in your personal data being hosted or transferred abroad, which is a technical necessity for providing the service. Transfers are made under KVKK Art. 9 (adequacy decision, appropriate safeguards such as standard contracts, or other statutory conditions) and, for data originating in the EU/EEA, under GDPR Chapter V (adequacy decisions, standard contractual clauses, etc.). For incidents involving cross-border technology or health data, transfers are assessed separately for each matter.
5. Retention
Personal data are kept for as long as required by the purpose and within the maximum periods set by law:
- Unsuccessful enquiries and form submissions: 24 months
- Files that become client matters: periods required by attorney regulations and applicable laws
- Technical/server logs (access logs): 2 years under Law No. 5651
After that, data are deleted, destroyed or anonymised.
6. Your rights
Under GDPR Art. 15-22 and KVKK Art. 11 you may:
- obtain confirmation of processing and access to your data,
- request rectification, erasure and restriction of processing,
- learn to whom data have been transferred,
- object to processing and, where applicable, request data portability,
- withdraw consent at any time (without affecting prior processing),
- object to decisions based solely on automated processing that adversely affect you.
Send requests to mail@istlegal.com with information that allows us to verify your identity. We respond within 30 days at the latest. If you are not satisfied, you may complain to the Turkish Personal Data Protection Board or, if you reside in the EU/EEA, to your competent supervisory authority.
7. GDPR scope
The GDPR may apply where we process data of individuals in the EU/EEA.
8. Security
We apply reasonable technical and organisational measures under GDPR Art. 32 and KVKK Art. 12: access control, encrypted communication (HTTPS), confidentiality undertakings and periodic review. In the event of a personal data breach, statutory notification duties are observed.
9. Cookies
Besides strictly necessary technical cookies needed to run the website, this site uses analytics cookies from Google Analytics (Google LLC) only with your explicit consent. Analytics cookies are used to measure site usage in aggregate and statistical form (pages visited, device and browser type, approximate location and session duration) and to improve the site.
| Cookie | Purpose | Duration | Consent |
|---|---|---|---|
_ga, _ga_* |
Distinguishing visitors and usage statistics (Google Analytics) | 2 years | Required (explicit consent) |
istlegal-consent (local storage) |
Remembering your cookie/personalisation choice | Until you change it | Necessary |
istlegal-profile (local storage, first-party) |
Stores on your device only which practice-area (cybersecurity / health) pages you spent time on, to adapt headlines, links and contact forms to your interests; never sent to a server | Up to 180 days | Required (personalisation consent) |
Analytics cookies and personalisation storage are not activated until you choose “Accept” in the cookie notice (or tick the relevant option under “Manage Preferences”). If you choose “Reject”, only strictly necessary storage is used and the site works in its default, non-personalised form. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of the page. Google Analytics may result in data being processed on Google’s servers outside Türkiye (e.g. in the United States); this transfer is based solely on your consent.
The Google Maps map on the contact page loads only when you click “Load map”; once loaded, your IP address and browser data are shared with Google LLC and Google’s own privacy policy applies.
10. Changes
This policy may be updated to reflect changes in law or in our activities. The current version is always published on this page.