Contact · Maslak, İstanbul
Contact us
Tell us what you process, where it goes, and what is already documented. Substantive enquiries get a substantive first response within one business day: a written answer to the question you asked, not a calendar link.
If you are outside Türkiye and unsure whether Law No. 6698 reaches you at all, that is a question worth asking before it becomes a letter from the Authority. Ask it here.
Enquiry
Send an enquiry
How this form works
It posts to gdpr.com.tr and nowhere else — no third-party form service, no tracker, no cookie. Your enquiry is written to our own database on Cloudflare’s network, emailed to us, and deleted twelve months later by a job that runs every day. The rest is set out line by line in the notice below.
If you would rather not use a form at all, write to us directly: info@gdpr.com.tr
Not sent
Your enquiry was not sent and nothing was stored. What needs fixing is marked below, beside the field it belongs to. Correct it and send again — or write to info@gdpr.com.tr directly, so nothing is lost.
- Our end failed, not yours. Nothing was stored. Please write to info@gdpr.com.tr so your enquiry is not lost.
- Too many enquiries have been sent from this connection in the last hour. Write to info@gdpr.com.tr instead.
- This page was open for a while and the form’s security token expired. Reload the page and send again — your text is still in the fields.
- This was sent the instant the form opened. Wait a second and try again.
- The field marked “Leave this field empty” had something in it. Clear it and send again.
- First name — This is longer than the form accepts. Shorten it, or send it to info@gdpr.com.tr as email.
- Last name — This is longer than the form accepts. Shorten it, or send it to info@gdpr.com.tr as email.
- Email — Enter an email address we can reply to.
- Phone — This is longer than the form accepts. Shorten it, or send it to info@gdpr.com.tr as email.
- Organisation — This is longer than the form accepts. Shorten it, or send it to info@gdpr.com.tr as email.
- Is your organisation established in Türkiye? — Choose one of the options listed.
- What is this about? — Choose one of the options listed.
- How can we help? — This field is required.
- How can we help? — This is longer than the form accepts. Shorten it, or send it to info@gdpr.com.tr as email.
- Tick the box to confirm you have read the notice. It records that you read it; it is not a consent.
Your reference Quote it if you write again about the same matter.
Notice
Article 10, Law No. 6698
Contact Form Privacy Notice
What happens to an enquiry sent from this page — the whole mechanism, as it is.
- Controller
- Lexis Medikolegal Danışmanlık Ltd. Şti. — Büyükdere Cd. No:239, Maslak, 34485, Sarıyer / İstanbul, Türkiye. This is the controller of the personal data you send through this form; gdpr.com.tr is that company’s publication, not a separate legal person.
- What is processed
- Only what you type into the form: your first and last name (optional), your email address, your telephone number (optional), your organisation (optional), whether your organisation is established in Türkiye, the subject you choose, and the text of your enquiry. To that is added the record itself: the date and time you sent it, and the reference number we give you.
- What is not kept
- Your IP address is not stored in the enquiry record. Cloudflare’s request logs for the contact page and the form keep each request’s metadata for seven days; that metadata can include your IP address and the location Cloudflare derives from it, such as your country. To limit automated bulk submission from one connection we use an irreversible SHA-256 value derived from the IP address and a salt that changes every day; the IP address cannot be recovered from it, it becomes a different value for the same connection the next day, and it is used for nothing else. No browser fingerprint is taken, no cookie is set, no analytics script runs, and no request is made to any third-party server.
- How it reaches us
- The form posts to a Cloudflare Worker running on the same domain as the site itself. No hosted form service is used. The record is written first to our own Cloudflare D1 database, then sent by Cloudflare Email Sending to info@gdpr.com.tr as email, with your own address as the reply-to.
- Purpose
- To read your enquiry, to check that acting on it would put us in no conflict, to answer you, and to keep a record of the answer we gave.
- Legal basis
- Article 5(2)(f) of Law No. 6698 — processing necessary for our legitimate interests, provided your fundamental rights are not harmed — and, where the enquiry concerns an engagement, Article 5(2)(c), being directly related to the conclusion or performance of a contract. We do not rely on consent. The tick-box on the form records that you have read this notice; it is an acknowledgement, not a consent, and it is the legal basis for nothing.
- Processor
- Cloudflare, Inc. (Workers, D1 and Email Sending). Cloudflare hosts and transmits this data on our behalf and on our instructions, and does not use its content for its own purposes. There is no other processor.
- Recipients
- Two processors, and no one else. Cloudflare, Inc. hosts the endpoint and the database and carries the email. Google LLC operates the mailbox the enquiry is delivered to, because the firm's mail runs on Google Workspace — so your enquiry is stored there as well. Beyond those two, enquiries are not shared with third parties, not sold, not used for marketing, and never added to a mailing list.
- Transfer abroad
- Yes, there is a transfer, and we are not hiding it: the record is held on Cloudflare, Inc.’s infrastructure in its Western Europe region, and the email travels over the same infrastructure. The lawful basis for that transfer, and the evidence of it, are recorded in our transfer inventory and are available on request to any data subject. Transfers abroad are carried out in accordance with Article 9 of Law No. 6698.
- Retention
- Kept while your enquiry is live, and while any engagement that follows it is live. If no engagement follows, the record is deleted within twelve months. That is not a promise but a running job: a scheduled task runs every day and deletes rows older than twelve months from the database.
- Your rights
- Article 11: to learn whether your personal data is processed, to request information about it, to have it corrected or erased, and to object. Write to the address above, or to info@gdpr.com.tr; quoting your reference number makes the record faster to find. We answer within thirty days, as Article 13 requires.
- On your device
- This form stores nothing in your browser — no cookie, no local storage, no draft. The form carries one hidden field: a signed, expiring token issued for this page alone, used to weed out automated submissions. It contains no personal data. Everything the site does store is listed key by key, with a button to delete each one, on the storage page.
- No automated decision
- Your enquiry is not assessed by an automated system, not scored, not profiled, and never given to any AI model as training data. A person reads it.
The Turkish text of this notice is the binding one. Where this translation and the Turkish diverge, the Turkish governs.