Privacy and Cookie Policy

1. Data controller

Av. Cihan Topcu (Topcu Legal), lawyer registered with the Istanbul Bar Association under no. 59739. NEF 09 Offices, Sultan Selim Mahallesi, Hümeyra Sokak No: 7/108, Kağıthane, İstanbul, Türkiye. Email: help@topculegal.com. Phone and WhatsApp: +90 536 388 49 42.

2. Applicable law

The controller is subject to the Turkish Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, “KVKK”). For visitors located in the European Union, Regulation (EU) 2016/679 (“GDPR”) may also apply in the cases set out in its Article 3(2).

3. Data we process, purposes and legal bases

• Technical server logs: the site is hosted by Vercel Inc. (USA), which logs the IP address, browser user agent, requested URL and time of each request, for security and operation. Basis: our legitimate interest in a secure and functioning website.
• Cookieless statistics: Vercel Web Analytics provides us with aggregated page-view statistics without using cookies. Basis: legitimate interest.
• Analytics and advertising measurement: we use Google Analytics 4 (Google Ireland Ltd / Google LLC) with Google Consent Mode v2. By default all storage is denied; only if you click “Accept” in the cookie banner are cookies set and advertising measurement enabled, which allows clicks on the WhatsApp, phone and email buttons to be measured as conversions if the firm runs Google Ads campaigns. Without consent, Google receives only cookieless pings without identifiers. According to Google, Google Analytics 4 does not log or store IP addresses. Basis: your consent.
• Enquiries and legal services: if you contact us by WhatsApp, phone or email, we process the data you provide (name, contact details and the content of your enquiry) to answer you and, if you instruct us, to provide legal services. Basis: steps taken at your request prior to an engagement, performance of the engagement, and compliance with the lawyer’s legal and professional obligations. This information is protected by professional secrecy.

4. Cookies and local storage

No cookies are set without your consent. Fonts and the home-page video are hosted on our own server; no requests are made to Google Fonts.

• tl_consent_v1 (browser local storage, not a cookie): stores your choice in the cookie banner, with no expiry date. It is technically necessary to respect your decision.
• _ga and _ga_* (Google Analytics): visit statistics; only with your consent.
• Google advertising measurement (ad_storage, ad_user_data, ad_personalization): only with your consent; in that case Google may set its own advertising cookies.

5. How to change your choice

You may change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page, or by clearing the stored preference (this site’s data) in your browser, after which the banner will be shown again. Withdrawal does not affect the lawfulness of processing carried out before it (GDPR Article 7(3)). Google cookies already set can be removed in the same way.

6. Recipients and international transfers

Data are disclosed only to the providers named above (Vercel Inc.; Google Ireland Ltd / Google LLC) and, for enquiries, to the messaging, telephone and email providers used; WhatsApp is governed by its own privacy policy. We do not sell personal data.

Because these providers are used, data may be processed outside Türkiye and the European Economic Area, in particular in the United States. Such transfers are subject to the requirements of the KVKK and, where applicable, the GDPR on international transfers.

7. Retention

• Google Analytics data: 14 months.
• Server logs: for the limited period determined by the hosting provider.
• Enquiries: for as long as necessary to handle them and, if an engagement follows, for the periods required by applicable legal and professional obligations.

8. Your rights

Under Article 11 of the KVKK, you have the right, by applying to the controller, to:

• learn whether your personal data are processed;
• request information on the processing, if they have been processed;
• learn the purpose of the processing and whether the data are used in line with it;
• know the third parties, in Türkiye or abroad, to whom they have been transferred;
• request rectification of incomplete or inaccurate data;
• request their erasure or destruction under the conditions laid down in the KVKK;
• request that rectification, erasure or destruction be notified to the third parties to whom the data have been transferred;
• object to an outcome adverse to you arising from the analysis of your data exclusively by automated systems;
• claim compensation for damage caused by unlawful processing.

9. Additional rights in the European Union

If the GDPR applies to you, you also have, under the conditions of its Articles 15 to 22, the rights of access, rectification, erasure, restriction of processing, data portability, objection, and not to be subject to decisions based solely on automated processing.

10. Requests and complaints

Send your request in writing to help@topculegal.com; we may ask for what is needed to verify your identity. Under Article 13 of the KVKK, requests are concluded as soon as possible and at the latest within thirty days, free of charge, unless they entail an additional cost, in which case the fee set by the Personal Data Protection Board may be charged. Requests under the GDPR are answered within one month, extendable by two further months where necessary (GDPR Article 12(3)).

If your request is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, the decision-making body of the KVK Kurumu authority). Under Article 14 of the KVKK, you must first apply to the controller and file the complaint within thirty days of learning of the answer and in any event within sixty days of your request.

If you reside in the European Union, you may lodge a complaint with the supervisory authority of your Member State (GDPR Article 77); in Spain, the Agencia Española de Protección de Datos (AEPD).

11. Changes

This policy may be updated when the services used on the site or the applicable law change. The date of the last update is shown at the top.