Protection of Personal Data
Clarification Notice pursuant to Law No. 6698
This English version is provided for information purposes only. In the event of any discrepancy between the two versions, the Turkish version shall prevail.
1. Identity of the Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data (the "Law"), the entity acting in the capacity of data controller is set out below:
Trade Name: Merit İzmir Serbest Muhasebeci Mali Müşavirlik A.Ş. (the "Company")
Central Registration System (MERSİS) No: 0617093718500001
Tax Office / Tax Identification No: Torbalı Tax Office / 6170937185
Address: Alpkent Mah. Cemali Tuncer Bul. Batıkent Sit. No: 26/20 35860 Torbalı-İzmir/TÜRKİYE
Telephone: +90 539 356 37 48
E-mail: merit@meritizmir.com.tr
Registered Electronic Mail (KEP) Address: meritizmir@hs01.kep.tr
2. Personal Data Processed and Method of Collection
No personal data is collected through our website by means of forms, membership, registration or any other method. No cookies or third-party software for the purposes of visitor tracking, analytics or advertising are operated on our website.
Transaction security logs (IP address, date and time of access, page requested and browser information) are recorded automatically, as a matter of technical necessity, on the server on which our website is hosted. Such logs are not used by the Company for commercial, marketing or profiling purposes.
Where you contact us by telephone, e-mail or WhatsApp, your name and surname, contact details (including, where you use WhatsApp, your telephone number and profile information) and the content of your message are processed for the purpose of responding to your request. The provision of such data is entirely at your own initiative.
3. Purposes of Processing
• Ensuring the security of the website and identifying technical issues;
• Responding to requests, enquiries and applications submitted by you;
• Conducting preliminary discussions with a view to establishing a professional service relationship;
• Fulfilling obligations arising under the applicable legislation.
4. Legal Grounds
Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the Law:
• Article 5(2)(c): the processing is directly related to the conclusion or performance of a contract (in respect of your service requests);
• Article 5(2)(ç): the processing is necessary for compliance with a legal obligation to which the data controller is subject;
• Article 5(2)(f): the processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed (in respect of website security logs).
The use of our website is not conditional upon the granting of explicit consent.
5. Transfer of Personal Data within Türkiye and Abroad
Within Türkiye: Your personal data is primarily stored, within the scope of Article 8 of the Law, by our service provider acting in the capacity of data processor, which provides the hosting service for our website and whose servers are located in İstanbul, Türkiye. Data processing activities relating to server, backup and security logs are carried out in Türkiye.
Abroad (limited and technical in nature): Owing to certain technical services required for the uninterrupted operation of the hosting infrastructure, technical connection data may be processed abroad in the limited circumstances set out below. Such transfers are carried out within the framework of Article 9 of the Law:
• Domain name (DNS) resolution: For the purposes of service continuity and geographic redundancy, one of the DNS servers for our domain name is located abroad (France). Where a domain name query is directed to that server during a visit, technical data such as the IP address of the resolver transmitting the query may be processed abroad.
• Protection against cyber attacks: Within the scope of a protection service activated temporarily and solely in the event of a high-volume cyber attack (DDoS), technical data relating to connection traffic may be processed through infrastructure located abroad. This constitutes an exceptional circumstance which does not apply to ordinary visits.
Communication by e-mail: E-mails sent to the Company are received on the servers of our hosting service provider in Türkiye. E-mails sent by the Company, together with the sender and recipient addresses, header information and message content, may pass through an e-mail relay service located abroad and used by our hosting service provider. In addition, owing to the cloud infrastructure of the e-mail application used by the Company, e-mail correspondence may be processed on servers located abroad. Where you use your own e-mail service provider (for example, Gmail or Outlook), your message may also be processed abroad, subject to the terms of that provider.
Communication by WhatsApp: Where you click on the "Message us on WhatsApp" link on our service pages, you are redirected to the WhatsApp service. Where you use this channel, your telephone number, profile information and data relating to your messaging may be processed on the infrastructure of WhatsApp located abroad, and the privacy policy of WhatsApp shall apply.
Your choice of channel: The use of e-mail and WhatsApp is not mandatory; you may also contact us by telephone, post or Registered Electronic Mail (KEP). You are requested not to send identity information, special categories of personal data or personal data of third parties through these channels.
Other than in the cases set out under this heading, your personal data is not transferred to third parties or abroad. Where you click on the Google Maps link or the links to public institutions on our website, you are redirected to the website of the relevant third party; such redirection occurs at your own election, whereupon the privacy policy of the relevant party applies. The Company shall bear no responsibility for such processing activities.
6. Retention Period
Server access and security logs are retained by our hosting service provider for a period of two years for the purposes of examining security incidents and responding to requests duly submitted by the competent authorities. Data submitted through our communication channels is retained, following the conclusion of your request, for the limitation periods prescribed by the applicable legislation; upon expiry of such periods, it is erased, destroyed or anonymised in accordance with Article 7 of the Law.
7. Rights of the Data Subject (Article 11 of the Law)
Pursuant to Article 11 of the Law, you have the right to: learn whether your personal data has been processed; request information in that regard if it has been processed; learn the purpose of the processing and whether the data has been used in accordance with that purpose; know the third parties, within Türkiye or abroad, to whom the data has been transferred; request the rectification of data that is incomplete or inaccurately processed; request the erasure or destruction of the data under the conditions set out in Article 7 of the Law; request that such rectification, erasure or destruction be notified to the third parties to whom the data has been transferred; object to any adverse outcome arising from analysis of the data exclusively by means of automated systems; and claim compensation for damage incurred as a result of unlawful processing.
8. Application Procedure
You may submit requests concerning your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette dated 10.03.2018, No. 30356), by the following means:
• in person or through a notary public, by a petition bearing a wet-ink signature, to the address stated above;
• by secure electronic signature, to our Registered Electronic Mail (KEP) address;
• from your e-mail address registered in our system, to merit@meritizmir.com.tr.
Your application shall be concluded free of charge as soon as possible, depending on the nature of the request, and in any event within thirty days at the latest. Where the procedure entails an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.
9. Entry into Force
This Clarification Notice was published on 01.10.2026 and updated on 01.11.2026. Any amendments to this text shall be announced on this page.