Data Protection Notice (KVKK)

Under Türkiye's Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by A&A Partners (“GŞK”, “Company” or “we”) acting as data controller, within the scope set out below. Under KVKK, the data controller is the legal entity that determines the purposes and means of processing of personal data and is responsible for the establishment and management of the data filing system.

This notice covers personal data we collect through our website operated at gurcistansirketkurma.com and in the course of our service delivery.

You can reach the data controller through the following channels:

• E-mail: iletisim@gurcistansirketkurma.com
• Website: gurcistansirketkurma.com

Registered electronic mail (KEP) address, MERSİS number and registered office address will be added once operational setup is finalised.

Within the scope of our activities, the following categories of personal data are processed:

• Identity: First name, surname.
• Contact: E-mail address, telephone and/or WhatsApp number.
• Professional and commercial: Industry, estimated annual revenue band, short text and any free-form information you provide.
• Customer transaction: Request and call history, communications during the advisory engagement.
• Transaction security: IP address, device and browser information, visit time, pages viewed, cookie identifiers.

Depending on the service requested, additional documents and personal data required during contract performance (e.g. ID copy, tax number, banking details) are processed under a separate notice.

Your personal data is processed for the following purposes:

• Responding to your contact request and scheduling a dedicated advisory call.
• Providing information about our services, preparing proposals, and operating the contracting process.
• Performance of the service contract, management of the advisory engagement, and fulfilment of financial obligations.
• Ensuring the security of our website and preventing misuse and fraud attempts.
• Fulfilling our legal obligations (KVKK, Turkish Code of Obligations, Turkish Commercial Code, Tax Procedure Law and other applicable legislation).
• Subject to your explicit consent: marketing communications, announcements about new services, and customer-satisfaction surveys.

Processing is based on the following grounds set out in Article 5(2) of KVKK:

• Necessary for the conclusion or performance of a contract (Art. 5/2-c): evaluating your service request and entering into a contract.
• Necessary for compliance with a legal obligation of the data controller (Art. 5/2-ç): record-keeping and reporting under tax and commercial legislation.
• Necessary for the establishment, exercise or protection of a right (Art. 5/2-e): managing legal disputes, evidence and defence.
• Necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not impaired (Art. 5/2-f): site security, quality improvement, fraud prevention.
• Explicit consent (Art. 5/1): marketing communications, optional cookies and other consent-based processing.

Within the scope of Articles 8 and 9 of KVKK, your personal data may be transferred to the following recipient groups:

• Cloud infrastructure and hosting providers: Our website and form infrastructure run on global CDN and edge-computing providers (established abroad). Such transfers are necessary for service delivery and are protected by standard contractual clauses and technical safeguards.
• Business partners and service providers: Accountant, legal counsel, call and messaging infrastructure, e-mail delivery infrastructure, customer-relationship management software.
• Public authorities: Competent authorities entitled to information under applicable law (courts, tax offices, audit authorities, etc.).

Cross-border transfers are carried out under Article 9 of KVKK, with your explicit consent and/or within the exceptions set out in the law and the decisions of the Authority. Adequate technical and organisational safeguards are applied before transfer.

Your personal data is retained for as long as necessary for the purpose of processing and for the statutory limitation periods set out in applicable law. Typical retention periods are as follows:

• Lead form data (where no contract is concluded): Up to 24 months; thereafter destruction or anonymisation.
• Customer-relationship data: 10 years following termination of the contract, in line with Article 146 of the Turkish Code of Obligations.
• Tax and commercial records: A minimum of 5–10 years under the Tax Procedure Law and the Turkish Commercial Code.
• Cookies and log records: Up to 12 months for transaction security and evidentiary purposes.

Upon expiry of the retention period or where the purpose of processing ceases, your data is destroyed in accordance with Article 7 of KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

You have the right to apply to the data controller and exercise the following rights regarding your personal data:

1. To learn whether your personal data is being processed.
2. To request information about your personal data if it is processed.
3. To learn the purpose of processing and whether the data is used in line with such purpose.
4. To know the third parties to whom the data is transferred domestically or abroad.
5. To request correction of inaccurate or incomplete personal data.
6. To request deletion or destruction of the data within the framework of Article 7 of KVKK.
7. To request notification of the operations carried out under (5) and (6) to the third parties to whom the data has been transferred.
8. To object to the occurrence of a result against you by analysis of your processed data exclusively through automated systems.
9. To claim compensation for damages arising from unlawful processing of your personal data.

Pursuant to Article 13 of KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your request in writing or by means of registered electronic mail (KEP), secure electronic signature, mobile signature, or by using the e-mail address you have previously notified to us and which is registered in our system, to iletisim@gurcistansirketkurma.com. Your application must include your name and surname, Turkish ID number (for foreigners: nationality and passport number), notification address, telephone, e-mail, subject of the request, and supporting information/documents.

Your applications will be processed and concluded free of charge within at most 30 (thirty) days, depending on the nature of the request. However, where the operation entails an additional cost, the fee set by the Personal Data Protection Authority may be charged.

In case your application is rejected, the response is deemed insufficient, or no response is provided within the statutory period, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK.

To prevent unlawful processing and access to your personal data and to ensure its safekeeping at an appropriate level of security, we apply the following technical and organisational measures:

• End-to-end secure transmission via HTTPS/TLS.
• Authorisation matrix, access controls and logging.
• Password policies and multi-factor authentication.
• Regular backups and disaster-recovery planning.
• KVKK and data-security training for staff.
• Data-processor agreements with service providers and audit rights.

The data controller may update this notice in response to legislative changes and changes within the scope of our services. The updated text takes effect on the date of publication on the website. Material changes will be communicated.