1. Personal Data We Collect
When you contact us through the website, the inquiry form, WhatsApp or email, we may collect the following categories of personal data:
- →Identity data: name, surname, date of birth, nationality, passport number (only during an active application)
- →Contact data: phone number, email address, residential address
- →Application data: details of the work permit / residence permit / citizenship application, current visa or permit status you declare
- →Technical data: IP address, browser data, page-view metrics, cookie identifiers
2. Purposes of Processing
We process your personal data under Articles 5 and 6 of KVKK, and Article 6 GDPR where applicable, for the following purposes:
- →Delivering and managing the consultancy service you request
- →Preparing and following up official applications (Directorate of Migration Management, Ministry of Labour, etc.)
- →Meeting legal obligations (tax, accounting, foreigners-law notifications)
- →Performing contractual rights and obligations
- →Improving service quality through anonymous/aggregated website analytics
3. Legal Basis
We rely on one or more of the following legal bases:
- →Your explicit consent (KVKK Art. 5/1, GDPR Art. 6/1-a)
- →Necessary for the performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6/1-b)
- →Compliance with a legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6/1-c)
- →Legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6/1-f) — e.g. fraud prevention, service security
4. Sharing With Third Parties
We share your personal data only to the extent strictly necessary, and only with the following parties:
- →Public authorities: Directorate of Migration Management, Ministry of Labour and Social Security, relevant tax offices
- →Contracted accountants, legal counsel and translation agencies (bound by confidentiality agreements)
- →Hosting infrastructure: our own server located in Türkiye (the website and application data are processed there)
- →CDN/WAF: Cloudflare, Inc. (US-based), operating in proxy mode — site traffic is TLS-terminated at the edge node closest to the visitor. This means IP addresses and request metadata are transferred through Cloudflare's global network (including EU, US and other regions). Cloudflare is GDPR-compliant and operates under Standard Contractual Clauses (SCCs).
- →Analytics services: Google Analytics 4, Yandex.Metrica (anonymous/aggregated data, subject to your consent)
5. Data Retention
We keep your personal data only for as long as required by the processing purpose and the minimum statutory retention periods.
After the consultancy contract ends, accounting and legal obligations may require retention up to 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
Inquiries that do not turn into a contract are deleted or anonymised within 12 months at the latest.
6. Cookies
Our website uses the following cookie categories:
- →Strictly necessary cookies — required for the site to work, cannot be disabled. Cloudflare bot-management and load-balancing cookies (`__cf_bm`, `_cflb`) fall in this category; they do not collect personal data and are used solely to filter bot traffic.
- →Performance / analytics cookies — Google Analytics 4 and Yandex.Metrica, anonymous/aggregated visitor behaviour, subject to consent.
- →Third-party cookies — WhatsApp, social media embeds.
7. Data Security
We apply technical and organisational measures to protect your data against unauthorised access, loss or alteration: HTTPS/TLS encryption, access control, periodic security checks and confidentiality agreements with all staff.
Site traffic is protected by two TLS hops: (1) TLS 1.2/1.3 between the visitor's browser and the Cloudflare edge node, and (2) a separate TLS connection between Cloudflare edge and our origin server. This means Cloudflare terminates TLS at the edge and re-encrypts traffic to the origin — it is not a single end-to-end connection.
No transmission over the internet can be guaranteed 100% secure. In case of a data breach, we notify Turkey's Personal Data Protection Authority within 72 hours, as required by KVKK Art. 12/5.
