Privacy notice (KVKK aydınlatma metni)

Version 0.1 · 24.10.2026 · Law 6698 on the Protection of Personal Data (as amended by Law 7499, in force 01.06.2024), art. 10; Communiqué on the Procedures and Principles of Fulfilling the Obligation to Inform.

1. Data controller

Rostu Organizasyon Danışmanlık Limited Şirketi, Atatürk Mah. Ertuğrul Gazi Sok. Metropol İstanbul C1 Blok 2B/101, Ataşehir, 34758, İstanbul, MERSİS 0735208476300001 ("ROSTU", "we"). Contact for data matters: [DPO-EQUIVALENT NAME], [email protected], KEP [address]. VERBİS registration: [status — exemption under the current thresholds is being assessed with counsel; if registration is required it will be completed before launch].

2. What personal data we process, and why

We do not process data of family members or employees you enter unless you confirm that you are authorised to provide it and that you have given them this notice.

3. Legal bases (art. 5 and 6)

• Necessity for the performance of a contract to which you are party (art. 5/2-c): identity, contact, documents, status and transaction data needed to deliver the service you ordered.
• Compliance with legal obligations (art. 5/2-ç): invoicing, tax and commercial records, records required by the Distance Contracts Regulation and Law 6563, responses to lawful requests from authorities.
• Legitimate interests (art. 5/2-f): security logging, fraud prevention, improvement of checklists and templates using de-identified information — never overriding your rights.
• Establishment or protection of a right (art. 5/2-e): keeping instructions and consents as evidence for limitation periods.
• Explicit consent (art. 5/1 and 6/2): special-category data; transfers abroad without another lawful mechanism; the document vault and renewal reminders; marketing messages. Requested separately; refusable; revocable at any time without affecting earlier processing.

We do not take copies of identity documents by default (Board principle decision 2025/2120). A copy is processed only when the procedure you ordered requires a notarised translation or a document pack containing it.

4. Who receives your data (art. 10/1-ç)

• Contracted translators (our data processors) — only the documents to be translated, with time-limited access.
• Notaries, authorities, registries, banks, schools — only when you take the document there yourself or instruct us to deliver it; they are independent controllers.
• Licensed professionals you retain (SMMM, customs broker) — only the documents you instruct us to hand over.
• Couriers contracted as your carrier — name, address, telephone, sealed documents.
• Payment institution (TCMB-licensed) — payment data; e-invoice integrator — invoice data.
• Hosting, storage, e-mail and messaging providers — our processors, under written agreements; see transfers below.
• Public authorities and courts — where a lawful request obliges us.

We do not sell, rent or share data with advertisers. We do not share one customer's data with another.

5. Transfers abroad (art. 9)

Documents, identity data and logs are stored on servers located in Türkiye. Some tools we use (for example WhatsApp Business via a Meta business solution provider, e-mail delivery, cloud AI services used for summarisation of redacted text) process data outside Türkiye. No adequacy decision exists for any country at the date of this notice; such transfers are made under a standard contract approved by the Board, notified to the Board within five business days of signature, or — where no other mechanism is available and you choose it — under your explicit consent given in the separate consent text. The current list of foreign recipients and mechanisms is available on request from [email protected].

6. Automated processing

We use software to classify documents, count pages, extract fields needed for a checklist, and draft translations and letters for human review. No decision with legal effect on you is made solely by automated means; a named person reviews every plan, translation and letter before it reaches you. Uploaded documents are never used to train external models.

7. Retention

Our retention and destruction policy (saklama ve imha politikası) is available on request. Legal holds override these periods.

8. Security

Encryption in transit and at rest; field-level encryption of identity numbers; access on a need-to-know basis with logging of every document view; two-factor authentication for staff and processors; signed, short-lived links for document access; no identity data in logs; backups in Türkiye; incident procedure with notice to the Board within 72 hours and to you without undue delay in case of a breach affecting you.

9. Your rights (art. 11)

You may, at any time: learn whether we process your data; request information about it; learn the purpose and whether it is used accordingly; learn the recipients in Türkiye and abroad; request correction of incomplete or inaccurate data; request deletion or destruction where the conditions of art. 7 are met; request that correction, deletion or destruction be notified to recipients; object to a result against you produced exclusively by automated analysis; claim compensation for damage caused by unlawful processing.

How to apply: in writing to Atatürk Mah. Ertuğrul Gazi Sok. Metropol İstanbul C1 Blok 2B/101, Ataşehir, 34758, İstanbul; by KEP to [address]; by e-mail from the address registered with us to [email protected]; or through the form at help/contact, stating your name, contact details and request. We answer within 30 days, free of charge unless a fee under the Board's tariff applies. If you are not satisfied, you may complain to the Personal Data Protection Board (kvkk.gov.tr).

10. Changes

This notice is versioned. Material changes are announced on this page and, for active customers, by message. The version you were shown at each order is kept with the order record.

Related: Explicit consent text (separate) · Cookies · Distance sales contract · Pre-contract information