PRIVACY POLICY
Last Updated: 01 January 2026
1. Purpose and Scope
This Privacy Policy sets out the principles governing the processing, protection, retention, and confidentiality of personal data processed by Aigerim Sabit Bikmaz, Attorney-at-Law, in the course of her professional legal activities.
This Policy has been prepared in accordance with:
- the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”),
- Regulation (EU) 2016/679 (“GDPR”), where applicable,
- the Attorneyship Act No. 1136, in particular Articles 36 and 39,
- the Union of Turkish Bar Associations’ Professional Rules, and
- binding decisions, guidelines, and established practice of the Turkish Personal Data Protection Authority.
2. Data Controller
The data controller within the meaning of KVKK and, where applicable, the GDPR is:
Aigerim Sabit Bikmaz
Attorney-at-Law
Registered with the Ankara Bar Association under No. 41640
Registered Address: Mustafa Kemal Mahallesi Dumlupınar Bulvarı
No: 274/2 D:75, Çankaya, Ankara, Türkiye
Email: abikmaz@gratanet.com
3. Attorney–Client Privilege and Professional Secrecy
The protection of confidentiality constitutes a fundamental and indispensable principle of the legal profession.
Pursuant to Article 36 of the Attorneyship Act, attorneys are under a statutory obligation to keep confidential all information and documents entrusted to them or acquired in the course of their professional activities, irrespective of their source.
This obligation:
- applies to clients, former clients, prospective clients, and third persons;
- is not limited in time and continues indefinitely, even after the termination or completion of the legal mandate;
- prevails over general disclosure obligations, except where disclosure is expressly mandated by law.
Nothing in this Privacy Policy shall be interpreted as limiting or narrowing the scope of professional secrecy under the Attorneyship Act.
4. Categories of Personal Data Processed
Depending on the nature of the professional legal services provided, the following categories of personal data may be processed:
- Identity and contact information,
- Information relating to legal disputes, projects, transactions, and legal matters,
- Case files, project files, advisory files, legal opinions, correspondence, pleadings, contracts, and evidentiary documents,
- Financial and billing information,
- Special categories of personal data, where strictly necessary for the establishment, exercise, or defense of legal claims,
- Information submitted through website contact forms and electronic communications,
- Technical data required to ensure system security and operational integrity.
5. Purposes of Processing
Personal data is processed exclusively for lawful, specific, and legitimate purposes, including but not limited to:
- provision of legal consultancy, advisory, and representation services;
- conduct of litigation, arbitration, mediation, enforcement, and regulatory proceedings;
- execution of project-based legal work, transactional matters, and compliance assignments;
- fulfillment of obligations arising from the Attorneyship Act and professional rules;
- establishment, exercise, or defense of legal rights and claims;
- management of professional communications, files, and records;
- ensuring confidentiality, integrity, and information security.
6. Legal Grounds for Processing
Personal data is processed on the legal bases set forth under Articles 5 and 6 of KVKK and, where applicable, Articles 6 and 9 of the GDPR, including:
- processing being explicitly required or permitted by law, in particular under the Attorneyship Act;
- processing being necessary for the performance of a legal mandate or contractual relationship;
- processing being mandatory for compliance with legal obligations;
- processing being necessary for the establishment, exercise, or protection of a legal right;
- processing being necessary for legitimate interests, provided that fundamental rights and freedoms of data subjects are not adversely affected.
7. Transfer of Personal Data
Personal data may be transferred, where permitted or required by law and subject to professional secrecy obligations, to:
- courts, arbitral tribunals, judicial and administrative authorities;
- enforcement offices, experts, and court-appointed professionals;
- banks, insurers, auditors, and financial institutions, where necessary;
- technical and professional service providers strictly required for the performance of legal services.
8. Data Security Measures
Appropriate technical and organizational measures are implemented to protect personal data against unauthorized access, disclosure, loss, or alteration, in accordance with KVKK, GDPR, and the Attorneyship Act.
These measures include restricted physical access, secured electronic systems, encryption where appropriate, access control mechanisms, secure communication channels, regular backups, and controlled archiving and destruction procedures.
9. Retention Periods and File Storage Obligations
Pursuant to Article 39 of the Attorneyship Act No. 1136, all files created or maintained within the scope of professional legal activities are retained for a period of three (3) years following the completion or finalization of the relevant work.
For the avoidance of doubt, this retention obligation applies not only to litigation, arbitration, and enforcement case files, but equally to:
- project-based legal work,
- transactional matters,
- legal consultancy and advisory services,
- compliance projects,
- legal opinions and non-contentious assignments, and
- any other professional legal services, regardless of whether such work results in judicial or administrative proceedings.
Notwithstanding the expiration of the statutory retention period, the confidentiality and professional secrecy obligations attached to the information and documents contained in such files shall continue indefinitely.
10. Website Communications and Contact Forms
Personal data submitted through website contact forms or electronic communications is processed solely for the purpose of responding to inquiries.
Such communications do not constitute legal advice unless explicitly agreed and are nevertheless treated as confidential and protected under professional secrecy, even where no formal attorney–client relationship is established.
The website is maintained for informational purposes only and is operated in compliance with the Attorneyship Act and professional advertising restrictions.
11. Rights of Data Subjects
Data subjects may exercise the rights granted under Article 11 of KVKK and, where applicable, Articles 12 to 22 of the GDPR.
The exercise of such rights is subject to statutory limitations arising from professional secrecy, the Attorneyship Act, and overriding legal obligations.
12. Contact
Requests relating to the processing of personal data may be submitted to:
E-mail: abikmaz@gratanet.com
Registered office address: Mustafa Kemal Mahallesi Dumlupınar Bulvarı No: 274/2 D:75, Çankaya, Ankara, Türkiye
Requests shall be assessed and responded to in accordance with applicable legislation and professional duties.
13. Amendments
This Privacy Policy may be updated to reflect changes in legislation, regulatory practice, or professional standards. The updated version shall become effective upon publication.
14. Final Provision
This Privacy Policy shall be interpreted in a manner consistent with the Attorneyship Act, attorney–client privilege, professional secrecy, and the independence of the legal profession. In the event of any conflict, statutory obligations arising from the Attorneyship Act shall prevail.
