This is the DISCLOSURE STATEMENT OF RİVA LAW FIRM – ATTORNEY EYÜP SEYFİ ÜNAL (RİVA LAW FIRM) acting as the “Data Controller" pursuant to Article 10 (titled “Data Controller's Disclosure Obligation) of the Personal Data Protection Law no. 6698 (PDPL), which was published in the Official Gazette on 7 April 2016 under no. 29677 for the purpose of protecting the fundamental rights and freedoms of natural persons, including, in particular, the privacy of personal life, in processing of personal data, and determining the obligations of natural persons or legal entities that process personal data.

This disclosure statement provides information regarding the fact that personal data are processed by RIVA LAW FIRM for the purpose of practicing law and providing consultancy services, in line with the Attorneys' Law no. 1136 and basic principles applicable to the legal profession, the PDPL no. 6698, and other applicable legislation, whereby utmost care and diligence is shown for processing and protection of such data and administrative and technical measures are taken, and accordingly, it provides information about the purpose of, and actions taken by, RIVA LAW FIRM for processing personal data pursuant to both the PDPL no. 6698 and the Attorneys' Law no. 1136.

This Disclosure Statement describes how RIVA LAW FIRM collects, processes, uses and transfers personal data of all private and legal persons that contact and/ or enter into contractual relations with RIVA LAW FIRM, its current and potential customers and clients, its group companies, client employees, all private and legal persons who receive services, and users or visitors of its web site, in connection with all attorney and consultancy services it provides to them. These persons or data subjects also include any parties who work for or are assigned by those persons who are connected with all present or future services provided, their affiliates or other third parties.

RIVA LAW FIRM may collect and process personal data from other sources in line with its legitimate professional requirements and interests, in order to ensure the performance of its obligations under the applicable law and prior to and during a contractual relation, in the course of its services and operations, and in this respect, RIVA LAW FIRM agrees and undertakes to protect personal data collected by it.

PERSONAL DATA

“Personal Data" means any and all data of an identified or identifiable natural person. Personal data also include diverse types of information that may, when combined, lead to the identification of a specific person, and, if still usable, anonymized, encrypted or pseudonymized personal data which may be used to re-identify a person. “Special Category of Personal Data" are “race or ethnic origin details, political beliefs and ideas, union membership, religious or philosophical belief; genetic and biometric and health data when processed with the intention of identifying a person; sexual orientation, and past convictions or crimes".

PURPOSE OF PROCESSING PERSONAL DATA

Personal data are processed for the purpose for providing all attorney and consultancy services by RIVA LAW FIRM, and accordingly, for conducting all necessary works in this respect, contacting data subject, and completion and consummation of all procedures and formalities that are deemed necessary within the scope of its activities.

COLLECTION OF PERSONAL DATA AND LEGAL GROUNDS

Your personal data are collected by RIVA LAW FIRM subject to your explicit consent and in line with the rules stipulated in the Law no. 6698, in order to provide all its services and carry out all its activities within the scope of its attorney and consultancy services. Your personal data collected on the basis of such legal grounds may be processed and transferred also for the purposes set out in this Disclosure Statement, in line with the conditions and objectives of processing personal data as prescribed in Articles 5 and 6 of the Law no. 6698.

TRANSFER OF PERSONAL DATA THAT ARE PROCESSED

RIVA LAW FIRM may transfer personal data processed by it to its third party service providers in Turkey or abroad from which it procures services in connection with the provision of its attorney and consultancy services, to such individuals or entities from whom it receives services and/ or consultancy services (with the option of entering into confidentiality agreements therewith remaining at the sole discretion of RIVA LAW FIRM), to its business partners with which it has a contract, and third parties with whom it is engaged in joint works and collaborations, subject to conditions and purposes of processing personal data as set out in Articles 8 and 9 of the PDPL.

RIVA LAW FIRM is required to store records and documents regarding the procedures it has carried out, for a specific period of time under legal provisions, and if you wish that your personal data be deleted, destroyed or anonymized, such request may only be fulfilled by RIVA LAW FIRM at the end of the time periods set in applicable legal regulations; however, until then, your personal data shall not be processed by RIVA LAW FIRM and shall not be transferred to third parties, other than in the cases required under national and international laws, regulations and contracts.

STORAGE TIME

Personal data shall be stored for such duration as prescribed under a legal obligation applicable to RIVA LAW FIRM, and as long as it is necessary or permitted in line with the purposes of collection of such data, and in any event, until the expiry of the statute of limitations applicable to lawsuits concerning existing contracts, to be extended for the term of any pending legal process. Personal data of other individuals including personal data of recipients shall be processed in line with general principles set out in Article 4 of the PDPL and shall be stored for such storage periods mentioned above pursuant to Article 4-2.(4) of the PDPL.

RIGHTS OF RELEVANT PERSON (DATA SUBJECT) WHOSE PERSONAL DATA ARE PROCESSED

Natural persons who are a party to this Contract may apply to RIVA LAW FIRM to exercise their rights set out below about their personal data in line with the provisions of the PDPL.

• inquire about whether or not their personal data have been processed;
• ask for information in the case that their personal data have been processed;
• inquire about the purpose underlying the processing of their personal data, and whether or not such data have been used in line with that purpose;
• ask for information about third parties to which their personal data have been transferred in Turkey or abroad;
• ask for correction of their personal data which may have been incompletely or inaccurately processed;
• ask for the deletion or destruction of their personal data;
• If their personal data have been corrected, deleted or destroyed, to ask that third parties to which their personal data have been transferred be informed of such transaction;
• object to any consequence that is detrimental to them and that arises from the analysis of their processed data solely by means of automated systems;
• claim damages in the case that they have incurred a loss due to unlawful processing of their personal data.

Requests sent in this respect shall be finalized by RIVA LAW FIRM free of charge at the latest within thirty days; however, if we need to charge a fee as per the decisions of the Personal Data Protection Board, the fee set out in the tariff set shall be collected by RIVA LAW FIRM.

IF YOU WISH TO CONTACT US FOR YOUR REQUESTS

If you wish to contact, send feedback or ask questions to RIVA LAW FIRM in connection with your rights set out above under Article 13-1 of the Law no. 6698, you can submit your request, along with the documents evidencing your identity, to RIVA LAW FIRM, in writing or via other methods stipulated by the Personal Data Protection Board, at RIVA LAW FIRM's mail address (RİVA AVUKATLIK BÜROSU, İSTANBUL – ŞİŞLİ, MECİDİYEKÖY 34388, BÜYÜKDERE CADDESİ NO. 32/5) by means of registered mail with return receipt requested, or to its e-mail address riva@rivaab.com with confirmation of receipt.