Privacy Agreement and Personal Data Protection Policy

1. Purpose and scope

This Privacy Agreement and Personal Data Protection Policy (the “Policy”) sets out the procedures and principles for processing, keeping confidential and securing the personal data of all natural person users (“Users”) of the Tevkil, Adliyedeyim and Courthouse Guide services offered through the mobile application and website operated under the name “meslektaş” (the “Platform”) by Raci Eren Denizoğlu (the “Data Controller”), in accordance with the Constitution of the Republic of Türkiye, Personal Data Protection Law No. 6698 (“KVKK”), Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications (“Law No. 5651”), Law No. 6563 on the Regulation of Electronic Commerce (“Law No. 6563”) and secondary legislation.

This Policy is an integral part of the Terms of Use and Membership Agreement and is binding on all Users who register with or visit the Platform.

2. Definitions

The terms used in this Policy have the following meanings:

• Data Controller: Raci Eren Denizoğlu, who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
• User: lawyer, trainee lawyer and clerk users registered with the Platform, and persons visiting the Platform’s website.
• Lawyer User: a User who registers with the Platform declaring that they practise as a lawyer registered on the relevant bar register under Attorneyship Law No. 1136 (the “Attorneyship Law”).
• Tevkil Module: the area where Users post listings for professional assignments such as hearings, file reviews, attachment proceedings and court registry work, apply to listings and message each other in the app.
• Adliyedeyim Module: the area where Users who are within 1 km of a supported courthouse may optionally announce to other users that they are available for work at that courthouse. The User’s location is neither shown to other users nor stored.
• Courthouse Guide: the guide module that provides access to courthouse buildings, registries, administrative units and general logistical information.
• Personal Data: any information relating to an identified or identifiable natural person.

3. Categories of personal data processed

The personal data that Users declare directly or that results from use of the Platform are as follows:

• Identity Data: name, surname, Turkish ID number (for the authority document; if the User enters it).
• Contact Data: mobile phone number, e-mail address, address and office address.
• Professional Data: role (lawyer, trainee lawyer or clerk), bar association, registration number, year of starting the profession, office name and, if the User enters them, university and foreign language information.
• Visual Data: profile photo, if the User uploads one.
• Location Data: when the User turns on the “Adliyedeyim” status, the current location taken once from the device’s location services to verify whether the User is within 1 km of a supported courthouse. This location is used only for verification and is not stored. What is stored and shown to other users is the courthouse at which the User turned on the status and the duration of the status (at most 2 hours). No location history is kept.
• Transaction Security and Traffic Data: IP address, access date and time, device and operating system information, and the device token used to send notifications. Passwords are stored irreversibly encrypted.
• Usage and Interaction Data: listings posted, applications and their outcomes, in-app messages, blocks, reports (reason and the description written by the User), courthouses added to the Courthouse Guide, types of work of interest, notification preferences and notification records.
• Data Not Processed: no payments are taken through the Platform; payment and card data are not processed. UDF documents and information entered into the calculation tools are processed only on the User’s device; they are not sent to the Data Controller and are not stored. The app contains no analytics, crash reporting or advertising tools; no advertising or tracking identifier is collected.

4. Purposes and legal grounds of processing

Personal data are processed for the following purposes based on the legal grounds set out in Article 5 of the KVKK:

• Establishment and Performance of a Contract (KVKK Art. 5/2-c): creating the membership account, performing the Terms of Use and Membership Agreement, establishing professional cooperation between Users in the Tevkil module, and providing the Courthouse Guide and communication infrastructure without interruption.
• Compliance with a Legal Obligation (KVKK Art. 5/2-ç): keeping and retaining hosting provider traffic logs under Law No. 5651, compliance with Law No. 6563 and commercial communication legislation, and responding to requests for information and documents from judicial and administrative authorities and competent public institutions.
• Establishment, Exercise or Protection of a Right (KVKK Art. 5/2-e): presenting evidence in possible disputes and conducting legal proceedings, enforcement and litigation.
• Legitimate Interest of the Data Controller (KVKK Art. 5/2-f): assessing complaints concerning usurpation of title and fake legal practice under Articles 35 and 63 of the Attorneyship Law, preventing abuse and ensuring system security.
• The User’s Explicit Consent or Data Made Public by the User (KVKK Art. 5/1 and Art. 5/2-d): the User personally announcing their presence at a courthouse to other users through the “Adliyedeyim” module.

5. Location data and how the “Adliyedeyim” module works

• Location data is taken once, only when the User swipes the “Adliyedeyim” slider and only if “While Using the App” location permission has been granted on the device; location is not taken in the background. The User may turn off location permission in the device settings at any time.
• The “Adliyedeyim” module is an optional feature that lets the User announce to other users that they are available for work at a courthouse, together with the remaining duration of the status (at most 2 hours).
• A User who uses this module accepts and undertakes that the courthouse at which they turned on the status will be shown to other users of the Platform; the User’s actual position in or around the courthouse is not shown. This information shared by the User is data made public by the data subject personally within the meaning of KVKK Art. 5/2-d and is processed only for interaction purposes consistent with the nature of the module.

6. Professional secrecy and third-party data in tevkil

• There is no file sharing on the Platform. Lawyer Users are personally obliged to comply fully with the duty of professional secrecy under Article 36 of the Attorneyship Law and with KVKK principles when sharing information in listing descriptions and in-app messages, making assignments or issuing authority documents.
• Where Lawyer Users write information belonging to their clients, the opposing party or the case file, including special categories of personal data, in listing descriptions or messages, the Lawyer User alone is the data controller of that data.
• With respect to personal data shared in listing descriptions and messages, the Platform acts only as an intermediary technical infrastructure provider and has no control over, or legal responsibility for, whether such data was lawfully obtained or may be transferred.

7. Transfer of personal data

Personal data may be transferred to the following recipient groups in accordance with Articles 8 and 9 of the KVKK, with the necessary technical and administrative security measures in place:

• Competent Public Institutions: judicial authorities, chief public prosecutor’s offices, law enforcement and the Information and Communication Technologies Authority (“BTK”), as required by law and court orders.
• Bar Associations and the Union of Turkish Bar Associations: the relevant professional bodies, upon request, in complaint procedures concerning the detection of unauthorised legal practice or professional fraud.
• Service Providers: server and database service (Supabase; data is hosted in the Frankfurt data centre in Germany), SMS phone verification at registration and password reset (Verifykit Yazılım A.Ş., otp.com) and notification delivery (Apple Push Notification service). If notifications are allowed, the device token and notification content may reach Apple’s servers in the United States; this transfer is necessary for the notification service and takes place only when notifications are allowed. Transfers to service providers abroad are made in accordance with Article 9 of the KVKK.
• Other Users: the name, surname, role, bar association, registration number, year of starting the profession, office, university, foreign language and types of work of interest shown on the User’s profile, and the “Adliyedeyim” status. Phone, e-mail, Turkish ID number and address are disclosed only to the other party of an application approved by the poster of the listing; they are closed again if either party blocks the other.

8. Data security and protective measures

Under Article 12 of the KVKK, the Data Controller takes the following measures to ensure an appropriate level of security in order to prevent unlawful processing of and access to personal data and to safeguard it:

• Network and application security are ensured, and secure socket layer (SSL/TLS) encryption protocols are used for data transfers.
• Accounts are accessed with a phone number and password; the phone number is verified by SMS at registration, and passwords are stored irreversibly encrypted.
• Access rights to systems containing personal data are restricted; row-level access rules are applied in the database so that each User can access only the records they are authorised to see.
• Profile photos are kept in non-public storage and shown only through time-limited, signed links. Agreements with service providers containing confidentiality and data security obligations are relied on.

9. Retention and destruction of data

Personal data are retained for as long as the processing purposes set out in this Policy and the mandatory retention periods under the relevant legislation continue. Accordingly:

• Membership and account data are retained for the duration of the membership. When the User deletes their account, their profile, contact details, profile photo, listings, applications, messages and notifications are deleted immediately,
• Records that must be retained under Law No. 5651 and other legislation (e.g. traffic data) are retained only for the period required by the legislation,
• The “Adliyedeyim” status turns off automatically after at most 2 hours.

When the retention period expires or the legal grounds requiring processing cease to exist, personal data are deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, in the first periodic destruction period or upon the User’s request.

10. Rights of the data subject (KVKK Art. 11)

By applying to the Data Controller, Users have the right to:

• learn whether their personal data are processed,
• request information if their personal data have been processed,
• learn the purpose of processing and whether the data are used in line with that purpose,
• know the third parties in Türkiye or abroad to whom their personal data are transferred,
• request correction if their personal data are incomplete or inaccurate,
• request deletion or destruction of their personal data under the conditions set out in Article 7 of the KVKK,
• request that correction, deletion or destruction be notified to third parties to whom the personal data were transferred,
• object to a result against them arising from analysis of the processed data exclusively through automated systems,
• claim compensation for damage suffered due to unlawful processing of their personal data.

11. How to apply

Users may submit requests concerning the above rights to the Data Controller’s electronic notification address, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• Electronic notification (UETS) address: 16566-65271-84575
• Account deletion requests are also fulfilled within the app (Profilim › Hesap ve gizlilik › Hesabı sil).

The application must include the name, surname, Turkish ID number (for foreigners, nationality, passport number or foreign identity number if any), residential or business address for service, e-mail address for notification, phone number and the subject of the request. Depending on the nature of the request, the Data Controller will conclude the application free of charge within thirty (30) days at the latest. However, if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

A User whose application is rejected, who finds the response insufficient or who does not receive a response in time may lodge a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

12. Entry into force and changes

This Policy enters into force on the date it is published on the Platform. The Data Controller reserves the right to unilaterally update the provisions of the Policy in line with changes in legislation, Board decisions or new Platform services. The updated text becomes binding as of its publication on the Platform.

Acceptance by the parties

By registering with the Platform or using the Platform modules (“Tevkil”, “Adliyedeyim”, “Courthouse Guide”), the User irrevocably declares and undertakes that they have read and understood this Privacy Agreement and Personal Data Protection Policy and accept the data processing activities, location sharing and transfer conditions described in it.