KVKK Information Notice

1 Data Controller

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Atasa Danışmanlık Hizmetleri Ltd. Şti. as the data controller (MERSIS: 0097067292000001, Address: Ahmet Esin Business Center, Mecidiyeköy Neighborhood, Raşit Rıza Street No. 4, Floor 2, Unit 7, Şişli/Istanbul, Turkey) as the data controller.

Atasa acts as data controller with respect to its own customers and website visitors. However, when processing personal data on behalf of an employer or corporate client (e.g., a bank), it acts in the capacity of data processor and operates solely in accordance with the written instructions and the contract of the relevant data controller.

2 Purposes of Processing Personal Data

Your personal data collected:

• To provide our services
• Providing information, running campaigns, and making announcements
• Managing customer relationships
• To comply with legal obligations
• To manage your requests and complaints,

will be processed in accordance with Articles 5 and 6 of the KVKK for these purposes.

3 Types of Personal Data Processed

First name, last name, phone number, email address, address information, request/message content, and other information shared during the service process. In work permit and residence permit processes, identification/passport information and, where necessary, sensitive personal data (e.g., criminal record certificate, marriage, and birth certificates) are processed solely by with your express consent and with additional security measures.

4 Transfer of Personal Data

Your personal data processed during your application and service processes is stored in secure systems with restricted access In Turkey and is not transferred abroad. Data is transferred only to the extent necessary for the performance of the service; to the relevant to the relevant public institutions and organizations (Immigration Authority, Ministry of Labour and Social Security, Social Security Institution, etc.) and the to an employer/corporate client from whom you receive services, in accordance with Article 8 of the Personal Data Protection Law (KVKK).

Website ad measurement exception: When visiting websites, only with your express consent Through marketing cookies, limited measurement data (e.g., visits/conversions, region) may be transmitted to the servers of platforms such as Google and Meta (Facebook) (U.S.). In this context, Your personal information—such as your first name, last name, and email address—is not sent to these platforms. For more details, Cookie Policy.

5 Methods of Collecting Personal Data and Legal Grounds

Your personal data is collected through our office, website, email, phone, social media, and other communication channels based on the legal grounds of service provision, legal obligations, legitimate interests, and explicit consent.

6 Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK;

• Find out if it has been processed
• Requesting Information
• Find out whether it was processed in accordance with its purpose
• Find out which third parties the data was transferred to
• Requesting correction, deletion, or destruction
• Objecting to the Processing
• Requesting Compensation for Damages

You have those rights.

To exercise your rights KVKK Application You can browse our website. Please submit your applications no later than 30 days is completed within it.

7 Data Security Measures

Your personal data is protected on an infrastructure that complies with Located in Turkey and international information security standards (ISO/IEC 27001, etc.) in accordance with its principles. The technical and administrative measures we implement include encryption during transmission and storage, a firewall, two-factor authentication (2FA), role-based and least-privilege access, logging of access activities, and regular backups. Your data is not stored on personal devices, personal email accounts, or unmonitored cloud or messaging applications.

8 Retention Period and Destruction

Your personal data is retained only for as long as necessary to fulfill the purpose for which it was processed and as required by applicable law; once this period expires, it is securely deleted, destroyed, or anonymized. For more details, Data Retention and Disposal Policy.

9 Data Processors and Third Parties

We work with infrastructure providers and service providers (subprocessors) used to deliver the service solely within the scope of a contract and under equivalent privacy and security obligations. Website analytics and marketing tools (Google, Meta) are activated only with your explicit consent; you can manage your preferences via the “Tercihler” panel. Your personal data is It will not be sold, rented, or shared with unauthorized third parties for marketing purposes under any circumstances; our privacy obligations continue even after the business relationship ends.