Privacy notices

Draft for legal review: these notices were prepared for our lawyers and are not yet in force. Points marked [confirm] are still to be decided.

This page brings together four privacy notices, one for each way this website collects personal data: visiting the site, the contact form, the report-a-counterfeit form and the newsletter. Each notice tells you what we collect, why, on what legal basis, who receives it, whether it leaves Türkiye, how long we keep it and what rights you have. The notices are written to meet the duty to inform in Article 10 of the Personal Data Protection Law No. 6698 (KVKK). They follow the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. A section at the end explains what applies in addition if you are in the European Union.

Who we are (the data controller)


Registered title	[Registered title: confirm]
Legal form	[Law firm / company: confirm, depends on who publishes the site]
Address	[Registered address, Istanbul: confirm]
Trade registry / MERSİS	[Trade registry no.: confirm] / [MERSİS no.: confirm]
VERBİS	[Registered with the Data Controllers’ Registry under no. … / exempt from registration: confirm]
Data protection contact	[privacy@…: confirm]
Registered email (KEP)	[KEP address: confirm]

In these notices “we” means the data controller named above. Where another organisation processes data on our behalf, for example our hosting provider, it is a data processor and acts only on our instructions.

1. Website visitors

What we collect. When you open a page, our hosting provider records technical data in its server logs. These are your IP address, browser type and version, operating system, the page you requested, the page you came from, and the date and time. We use no analytics cookies and no advertising cookies, and we do not build profiles of visitors. The only item stored in your browser is casework-consent, which remembers your choice about external content and contains no personal data. The cookie policy describes it.

If you choose to load the map on our contact page, Google receives your IP address and may set its own cookies. If Cloudflare Turnstile spam protection is switched on for our forms [confirm], Cloudflare receives your IP address and technical signals from your browser when you submit a form. It uses them to tell people from automated software.

Why. To deliver the pages you ask for, to keep the site and its forms secure, to detect misuse and to fix errors.

Legal basis. Server logs and spam protection: processing is necessary for our legitimate interest in running a secure, working website, provided this does not harm your fundamental rights and freedoms (KVKK Article 5(2)(f)). Loading the Google map: your explicit consent (Article 5(1)), given in the cookie banner or with the button in place of the map. You can withdraw that consent at any time under “Cookie settings” in the footer. We collect no special categories of personal data (Article 6) when you visit the site.

How we collect it. Automatically, through the web server and, if it is switched on, the Turnstile widget. Through Google’s servers only after you load the map.

Who receives it. Our hosting provider Hostinger (Hostinger International Ltd, Cyprus, and HOSTINGER, UAB, Vilnius, Lithuania) [confirm contracting entity], which keeps the server logs under its data processing agreement with us. Google (Google Ireland Limited / Google LLC), only after you load the map. Cloudflare, Inc. (United States), only if Turnstile is switched on. Public authorities and courts, where the law requires us to disclose.

Transfers abroad. The website is hosted in a Hostinger data centre in the European Union [confirm the data-centre location selected in the hosting panel; Hostinger stores data in Lithuania, the Netherlands, the United Kingdom or Cyprus]. KVKK Article 9 was amended with effect from 1 June 2024. A transfer abroad now requires one of the processing conditions in Article 5 and an adequacy decision of the Personal Data Protection Board. Where there is no adequacy decision, an appropriate safeguard is required instead. The Board has not yet announced any adequacy decisions [confirm current status]. We therefore rely on the standard contract published by the Board. We sign it with the recipient and notify it to the Personal Data Protection Authority within five business days of signature (Article 9(5)) [confirm: standard contracts with Hostinger and, if used, Cloudflare to be signed and notified]. The Google map is loaded only at your request. That is an occasional transfer made with your explicit consent after you have been informed of the possible risks (Article 9(6)(a)) [confirm].

How long we keep it. Server logs: 12 months, then deleted or anonymised [confirm; check Hostinger’s own log retention and any period required of hosting providers by Law No. 5651]. The casework-consent entry: until you clear it or change your choice.

2. Contact form

What we collect. Your name, company or brand, role, work email address, phone number, country, the topic you choose, your message and your confirmation that you have read this notice. If you tick the separate box, we also record your request to receive The Casework Brief (see notice 4). Only your name, company, work email, message and the privacy confirmation are required. Please do not put special categories of personal data in your message, such as health, religious or criminal-record data. We do not ask for them.

Why. To answer your enquiry. To assess and prepare any work you ask us to do, including a check for conflicts of interest [confirm wording for the law-firm route]. To keep a record of our correspondence. To establish, exercise or defend legal claims. And, if you have asked for it, to send you the newsletter.

Legal basis. Answering your enquiry and preparing a possible engagement: processing is necessary for steps taken at your request before a contract and for the performance of a contract (KVKK Article 5(2)(c)). Keeping correspondence and defending claims: the establishment, exercise or protection of a right (Article 5(2)(e)) and our legitimate interests (Article 5(2)(f)). The newsletter: your explicit consent (Article 5(1)), given separately in a box that is never pre-ticked.

How we collect it. Through the form on the contact page. The form sends an email through a mailbox at our hosting provider (SMTP) to our shared inbox. The message is not stored in a separate database on the website.

Who receives it. The people in our team who handle enquiries. Hostinger, as the provider of the web server and the mailbox. Cloudflare, if Turnstile is switched on. [confirm, route B only: the law firm that handles legal actions on our behalf, where your enquiry concerns legal action.] Public authorities and courts, where the law requires it.

Transfers abroad. Your message is transmitted and stored on Hostinger mail servers in the European Union [confirm location] under the standard contract described in notice 1. Beyond that, we do not send your data abroad unless you ask us to involve your own advisers or a partner outside Türkiye. Where that happens, it is an occasional transfer necessary for a contract made at your request (Article 9(6)(b)) [confirm].

How long we keep it. Enquiries that do not lead to work: 2 years from our last exchange, then deleted [confirm]. Enquiries that lead to an engagement: for the life of the engagement, and then for as long as our professional and commercial record-keeping duties require. That is generally 10 years from the end of the matter [confirm against Attorneys Act and Turkish Commercial Code duties].

3. Report-a-counterfeit form

What we collect. The brand and product you report; where you saw it (a link, or a city, market and shop); the date; the details you add; up to five photos; whether you work for the brand; and your confirmation that you have read this notice. Your name and email address are optional. You can report anonymously, but if you leave them out we cannot reply to you. Reports and photos often contain information about other people, such as a seller’s name or address, a shop sign, a marketplace account or a vehicle plate. Please do not include special categories of personal data, and please avoid photographing people’s faces where you can. We do not ask for them.

Why. To assess the report. To verify it with the brand owner. To prepare and support enforcement action, which may include a customs application, a criminal complaint, a civil action or a takedown request. To keep evidence for proceedings. And to produce anonymised statistics about counterfeiting in Türkiye. [confirm, route B only: If we do not yet act for the brand you report, we may contact the brand owner to tell it that a report about its products has been received. We do this on the basis of our and the brand owner’s legitimate interest; we do not pass on your name or email unless you agree.]

Legal basis. Data about the counterfeit and about the seller or outlet: processing is necessary for the establishment, exercise or protection of a right (KVKK Article 5(2)(e)). It is also necessary for our and the rights holder’s legitimate interest in stopping counterfeiting, provided this does not harm the fundamental rights and freedoms of the people concerned (Article 5(2)(f)). Your optional name and email: our legitimate interest in being able to clarify the report and reply to you (Article 5(2)(f)). You control this by choosing whether to give them. If a photo nevertheless shows special categories of data, we delete that part rather than process it [confirm].

How we collect it. Through the form on the report page. The report is emailed through our hosting provider’s mailbox to our shared inbox. Photos that are too large to email are saved in a private folder on the web server, outside the public site, and our team downloads them to our own systems.

Who receives it. The people in our team who handle reports. The brand owner concerned and its advisers, where we act for that brand or it asks us to [confirm]. Customs administrations, public prosecutors, the police, courts and enforcement offices, marketplaces and hosting providers, where enforcement action requires it. Hostinger, as provider of the server, the private folder and the mailbox. Cloudflare, if Turnstile is switched on. We do not disclose a reporter’s name or contact details to the brand owner, a marketplace or the authorities without the reporter’s agreement, unless the law or a court requires it [confirm].

Transfers abroad. Storage and email with Hostinger, as in notice 1. Brand owners are often outside Türkiye. Sending them a report is an occasional transfer necessary for the establishment, exercise or protection of a right (Article 9(6)(d)). Where we act for the brand under a contract, it is necessary for the performance of that contract (Article 9(6)(b)) [confirm]. Where transfers to a brand owner become regular, we put the Board’s standard contract in place and notify it within five business days [confirm].

How long we keep it. Reports we do not take further: 12 months from receipt, then deleted [confirm]. Reports used in an enforcement action: for the duration of the proceedings and for 10 years afterwards, the general limitation period, so that the evidence remains available [confirm]. Photos held in the private server folder: deleted from the server within 30 days of being downloaded to our systems [confirm]. Anonymised statistics are kept indefinitely, because they no longer identify anyone.

What we collect. Your email address, the fact that you consented, the date and time of your consent and the page where you gave it. If you subscribe through the contact form, we also hold the details you entered there (notice 2).

Why. To send you The Casework Brief, a monthly email about counterfeiting and brand protection in Türkiye, and to prove that you asked for it. We do not measure opens or clicks [confirm, depends on the tool chosen].

Legal basis. Your explicit consent (KVKK Article 5(1)), given by ticking a box that is never pre-ticked. The newsletter is a commercial electronic message under the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. Under Article 6(3) of that Regulation, prior consent is not mandatory for recipients who are merchants (tacir) or tradespeople (esnaf). Most of our readers subscribe with a work address and fall into this group. We nevertheless ask everyone for consent. We register recipients’ addresses with the Commercial Electronic Message Management System (İYS) and check İYS before every send, as Article 6(6) requires for merchant recipients [confirm İYS registration of the sender and the process]. Every email carries a free, one-click unsubscribe link, in line with Article 9. We stop sending within three business days of your request (Article 10) and record your refusal in İYS. You can also withdraw your consent by writing to us or through İYS.

How we collect it. Through the newsletter box in the footer or the tick-box on the contact form. Your address is sent to our shared inbox through the hosting provider’s mailbox and added to our subscriber list [confirm which sending tool is used; if a newsletter platform is adopted, its name, location and transfer basis will be added here].

Who receives it. The people in our team who prepare the newsletter. Hostinger, as provider of the mailbox and server. İYS (İleti Yönetim Sistemi A.Ş., Türkiye), which holds the record of your consent or refusal as the law requires. [confirm: the newsletter sending platform, if any.]

Transfers abroad. Hostinger, as in notice 1. No other transfer, unless a sending platform outside Türkiye is adopted [confirm].

How long we keep it. Your address: until you unsubscribe or withdraw consent. After that, we keep the record of your consent and of your unsubscribe for one year, as Article 13 of the Regulation requires for proof. We also keep your address on a suppression list so that we do not email you again by mistake [confirm].

Security

We take the technical and organisational measures required by KVKK Article 12 and the Authority’s Guide on Personal Data Security. The site and its forms use HTTPS. Access to the shared inbox and to the private upload folder is limited to named people with strong authentication. Photos are removed from the server once downloaded. Our processors are bound by written data processing terms. If a breach affects your data, we notify the Board within 72 hours and inform you where required.

Your rights

Under Article 11 of KVKK you may ask us:

whether we process your personal data and, if so, for information about it;
what the purpose is and whether the data is used for that purpose;
which third parties in Türkiye or abroad receive it;
to correct data that is incomplete or wrong;
to delete or destroy data when the reasons for processing no longer exist (Article 7);
to notify those corrections or deletions to the third parties who received the data;
to object to a result against you that arises solely from automated analysis (we make no such decisions); and
to claim compensation for damage caused by unlawful processing.

How to apply. Under Article 13 of KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request:

in writing, by hand or post, to [Registered address: confirm], marked “KVKK request”;
from our registered email address [KEP address: confirm], if you have a KEP account;
signed with a secure electronic signature or mobile signature, to [privacy@…: confirm]; or
from an email address you have previously notified to us and which is registered in our system, to [privacy@…: confirm].

Please include your name and surname, your Turkish ID number or, for foreign nationals, your nationality and passport or ID number, a postal or email address for the reply, and what you are asking for. We reply free of charge as soon as possible and at the latest within 30 days. If a reply has a separate cost, we may charge the fee set in the Board’s tariff. If we refuse your request, we explain why.

Complaint to the Authority. If we reject your request, if you find our reply insufficient or if we do not reply in time, you may complain to the Personal Data Protection Board. The deadline is 30 days from learning our reply and in any case 60 days from your application (KVKK Article 14). Applying to us first is a condition for a complaint. Board: Kişisel Verileri Koruma Kurumu, Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No. 4, Balgat, Çankaya, Ankara; www.kvkk.gov.tr.

If you are in the European Union

Most of our visitors work for brands in the EU. Where we offer our services to people in the EU or the EEA, the General Data Protection Regulation (EU) 2016/679 (GDPR) applies alongside KVKK under its Article 3(2) [confirm]. For the GDPR, the controller is the organisation named at the top of this page. We have [not appointed / appointed] a representative in the EU under GDPR Article 27 [confirm]. Our legal bases are: consent (Article 6(1)(a)) for the newsletter and the Google map; performance of a contract, or steps before a contract at your request (Article 6(1)(b)), for enquiries and engagements; and our and rights holders’ legitimate interests (Article 6(1)(f)) for server logs, spam protection, counterfeit reports and the defence of legal claims. We do not process special categories of data on purpose, and we make no automated decisions with legal effect.

You have the rights of access, rectification, erasure, restriction, data portability and objection (GDPR Articles 15 to 21). You may withdraw consent at any time without affecting processing that took place before withdrawal. Use the contact details above; we reply within one month. You may lodge a complaint with the supervisory authority of the EU country where you live or work, or with the authority of the place of the alleged infringement.

Data you send us from the EU is processed in Türkiye, which is not covered by an adequacy decision of the European Commission. When you contact us directly, you send the data to us yourself. Where we engage a processor outside the EEA for your data (for example Cloudflare in the United States, if Turnstile is on), we rely on the European Commission’s standard contractual clauses. Where the recipient is certified, we rely on the EU-US Data Privacy Framework [confirm].

Changes to these notices

We update these notices when the site or the law changes, and we show the date at the top. If we make a material change to a notice that relies on your consent, we bring it to your attention before it applies.