Last updated: September 2026
Protecting your personal data is important to us. Below we explain, in accordance with the General Data Protection Regulation (GDPR), what personal data we collect, for what purposes we use it, and what rights you have.
1. Data Controller
The controller responsible for data processing within the meaning of the GDPR is:
Caner Law Firm (Caner Law Firm)
Mansuroğlu Mah. 288/3 Sok. No:3, Selvili2 Apt. B-Blok D:17 K:6
35535 Bayraklı / İzmir, Türkiye
Phone: +90 232 464 06 30
WhatsApp: +90 531 217 48 40
E-mail: [email protected]
2. Processing When You Contact Us
When you contact us by phone, e-mail, WhatsApp or a contact form, we process the data you provide (e.g. your name, contact details and the information about your matter) in order to handle and respond to your enquiry. Providing this data is voluntary; however, without it we cannot deal with your request.
Legal basis: Art. 6(1)(b) GDPR (initiation or performance of a mandate) and Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).
WhatsApp note: If you contact us via WhatsApp, data is processed through the servers of the provider (WhatsApp Ireland Ltd. / Meta). For confidential matters we recommend contacting us by phone or e-mail.
3. Categories of Data Processed and Purposes
Depending on your matter, we process in particular the following categories of data: identity data (e.g. name), contact data (phone, e-mail, address), data relating to your legal matter / mandate (details of your case, correspondence), financial and billing data (where required for fees/costs) and, where applicable, image and audio data contained in documents you submit.
We process this data for the following purposes: handling your enquiry and initiating a mandate; performing the mandate/contractual relationship; communicating with you; establishing, exercising and defending legal claims; and complying with legal and professional obligations.
Special categories of personal data: Where your matter requires it (for example in medical malpractice or personal-injury cases), we may also process health data (Art. 9 GDPR) and, exceptionally, data relating to criminal convictions (Art. 10 GDPR). This is done only where necessary and relies in particular on Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims) and on your consent. As a law firm, we are also bound by professional confidentiality.
4. Lead Ads on Facebook and Instagram
We run ads on Facebook and Instagram (provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) using so-called instant forms (lead ads). If you complete and submit such a form, Meta transmits to us the data you entered — typically your first name, last name, phone number, e-mail address and details of your matter.
We use this data solely to contact you for the initial consultation you requested and to handle your matter.
Legal basis: Art. 6(1)(a) GDPR (your consent by submitting the form) and Art. 6(1)(b) GDPR (initiation of a mandate). Meta's processing of your data when delivering the ads is governed by Meta's own privacy policy.
5. Website Hosting
Our website is hosted as a static site by Cloudflare (Cloudflare, Inc.). When the website is accessed, technically necessary access data (e.g. IP address, date and time of access, page requested, browser used) is processed to ensure delivery and security of the site.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).
6. Fonts (Google Fonts)
To display fonts consistently, this website uses Google Fonts (provider: Google Ireland Ltd.). When a page is loaded, a connection to Google servers is established for this purpose, in the course of which your IP address may be transmitted.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing, consistent presentation of our website).
7. Data Retention
We store personal data only for as long as necessary for the stated purposes or as long as statutory or professional retention obligations (such as lawyers' retention periods for case files) apply. Data from an enquiry that does not lead to a mandate is deleted once it is no longer needed. After the relevant periods expire, data is deleted or anonymised.
8. Disclosure to Third Parties
Your data is disclosed to third parties only where necessary to handle your matter, where you have consented, or where we are legally obliged to do so. When using services such as Meta, Cloudflare or Google, processing may also take place outside Türkiye or the EU.
9. Your Rights
Within the limits of the law, you have the following rights: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.
To exercise your rights, a message to [email protected] is sufficient. You also have the right to lodge a complaint with a competent data protection supervisory authority.
10. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or reflects changes to our services. The version in force at the time of your visit applies.