As Verdi Law Firm (“Verdi”), we are highly sensitive about the protection of the personal data processed within the scope of the services that we provide.

With this awareness, under the Law on the Protection of Personal Data numbered 6698 (the “Law”), and all the relevant laws and regulations, and the decisions of Personal Data Protection Board, we take the necessary technical and administrative measures for the personal data of; our employees, our employee candidates including the interns, clients, potential clients, suppliers, and the persons who visit our website especially the employees, shareholders and authorized persons of the institutions that we are in cooperation with, and the third persons whose personal data are processed; to be processed in compliance with the laws and to be kept safely, as well as to prevent the unlawful access to these.

As Verdi, being the data controller, we wish to inform you, the real persons whose data are processed, on protection and security of personal data by this Verdi Law Firm Information Note (“Information Note”) within the scope of our obligation to inform pursuant to the Law.

THE PERSONAL DATA AND THE PURPOSES OF PERSONAL DATA PROCESSING
The personal data are processed in order to conduct our activities and in connection with our commercial relationships, limited to, proportionate with, in connection with and for the purposes listed below:

• To maintain the relationships with the clients, to provide the legal consultancy and attorneyship services that the clients need, to fulfill the obligations within the scope of the agreements executed with the clients and to fulfill and/or provide the complementary services to conduct such activities,
• To inform the clients and the potential clients of various legal news and updates with respect to laws, as well as the sector and the news regarding Verdi and our services, to carry out corporate communication activities including sending messages to celebrate fests and special days,
• To determine whether there is a conflict of interest with the potential clients and clients,
• To fulfill the obligations within the scope of the agreements with the suppliers and service providers, to supply the goods and services needed during the conduct of activities,
• To manage the hiring and improvement processes,
• To evaluate the usage of our website and to monitor and manage its performance,
• To use and update the information technology services,
• To keep the data that are obtained for the above-mentioned purposes, in order to use them in the future activities as well,
• To keep the information that must be kept as per the relevant laws; to copy and duplicate in order to prevent information losses, to control the consistency of your information, to take the necessary technical and administrative measures for the security of your information (to make the scans in order to detect the harmful electronic mails, to provide the building’s security with security cameras, to monitor the network traffic, limited with the connected resource and target address, on the wireless internet web which is possible to connect with a password, in order to prevent unpermitted access and detect the unlawful activities),
• To fulfill the legal obligations before the regulatory and supervisory authorities, that are foreseen or deemed compulsory under the legal and vocational regulations including money laundering and/or prevention of forgery, to pursue legal proceedings and processes.

The personal data that we process include the following: the (Republic of Turkey) identification number, name, last name, place and date of birth, marital status, sex, copy of the identity certificate, identification information such as photograph, contact information including address, telephone, electronic mail, fax, the corporation that he/she is working at, job title and duty, occupational information such as information regarding the sector that he/she is working in, bank account information, financial data such as invoice details, visual and audial records, and the occupational experience including the CV, personal file and health information (this applies for the employees and the employee candidates as well), of the real person.

THE METHOD OF COLLECTING PERSONAL DATA AND ITS LEGAL CAUSE
The personal data is lawfully obtained; when the persons get in contact or share with Verdi via face to face means, web site, fax, telephone, mail, courier, hand-delivery, electronic mail and every other written, oral, and electronic means, and/or in the case of getting in a business relationship as a potential client and/or client, colleague, business partner, service provider or supplier, directly from their representatives, officers and/or employees or from the public platforms and authorized persons and authorities. The personal data obtained by the stated methods, may be processed without explicit consent, in compliance with the fundamental principles in the Law, with condition that;

• It is explicitly foreseen in the local or applicable foreign law that Verdi is subject to,
• In the case of a de facto impossibility, when the data subject is not able to express his/her consent or processing of data is compulsory in order to protect the person’s (the person whose consent cannot be deemed legally valid) or somebody else’s life or physical integrity,
• With condition to be directly related to a constitution or fulfilment of an agreement, it is necessary to process the personal data of the parties of the agreement, to be able to provide the demanded goods and services or to fulfill the agreements that you have entered into,
• It is mandatory to process the data for Verdi to fulfill its legal obligations,
• The personal data is publicized by the data subject,
• Processing the data is mandatory to establish, use and protect a right,
• Processing the data is mandatory for Verdi’s legitimate interests, provided that it does not harm your fundamental rights and freedoms.

Whereas, the special categories of personal data, may be processed in accordance and compliance with applicable laws and regulations for the purpose of carrying out the necessary activities, by taking the sufficient measures.

In the event of obtaining data from the clients, business partners, suppliers and outsource service providers about their employees, customers, and other third persons; obtaining such data in compliance with the personal data protection laws with Verdi is the responsibility of the relevant party who has transferred the data.

TRANSFER OF PERSONAL DATA
As Verdi, we share the personal data with our business partners, telecommunication operators, service providers including infrastructure and electronic communication, suppliers, banks and financial institutions and external consultants, for the purposes included in this Information Note hereby, and as much as it is necessary.

Verdi may share the personal data of the right holder clients with courts and public authorities and institutions, in accordance with the related laws, with a legal necessity.

In principle, the personal data may not be transferred abroad. However, if the legal services require, the data may be transferred to the necessary and legally authorized real persons and institutions, in accordance with the personal data protection laws.

PROTECTION, RETAIN AND DELETION OF THE PERSONAL DATA
Verdi processes, protects, retains and deletes the personal data, in compliance with the personal data protection laws. The personal data are kept as printed copies and/or in electronically, on the servers of our external service providers.

The personal data are kept for and during the period that is deemed necessary for the processing purposes in this Information Note hereby, and in any case, up to the period that is foreseen in the legislation. When the mentioned period is over, the personal data shall be erased, destructed, and anonymized as stated in the relevant laws.

In the event when it has become known that the personal data is harmed and/or obtained by third persons and/or disclosed as a consequence of the attacks to the physical media and/or servers and/or other systems that the data are kept; the relevant data subject and the Personal Data Protection Authority shall be informed immediately.

YOUR RIGHTS REGARDING PERSONAL DATA
As per Article 11 of the Law, each personal data subject has a right;

• To know whether his/her data is processed,
• If his/her data is processed, to request information with respect to it,
• To know the purpose of processing his/her data, and whether they are used for this purpose,
• To know the third persons (in Turkey or abroad) to whom his/her personal data are transferred,
• In the case when the personal data are processed incorrectly, to request the correction of these and to request the third persons (to who the personal data) to be informed of such activity within this scope,
• Even though processed in compliance with the provisions of the Law and other laws, in the case when the reasons of processing are extinguished, to request the erasure or destruction of the personal data; and to request the third persons (to who the personal data) to be informed of such activity within this scope,
• To make an objection when the processed data is exclusively analyzed via automatic systems and the result is to the detriment of the person,
• To request the loss to be indemnified if loss occurs because of the unlawful processing of the personal data.

As the data subject, in order to use your rights above, you may apply to the address Levent Cad. Yeni Sulun Sok. No. 1 34330 1. Levent, Beşiktaş in writing, or to the electronic mail address info@verdi.av.tr via electronic mail.

The data subjects, should include in their applications; name/last name, signature, (Republic of Turkey) Identification number for the Turkish Republic citizens, nationality for the foreigners, passport number (identification number, if any), place of residence (for notification) or address, electronic mail address, telephone and fax number and “Personal Data Information Request” submission.

As personal data subjects, in the case when you submit your requests with respect to your rights to Verdi as stated above, Verdi is going to resolve the request, depending on the nature of the request, as soon as possible and in maximum 30 (thirty) days, free of charge. However, if such activity requires a fee, Verdi is going to charge the fee in the tariff determined by the Personal Data Protection Authority.

ABOUT THE INFORMATION NOTE
If necessary, changes could be made in the context of the Information Note hereby, in order to comply with the laws because of the changing data processing procedures. To follow the amendments in the Information Note, we suggest you to visit our website (http://verdi.av.tr/) periodically.