Privacy Policy

At A&A Partners, we attach great importance to the privacy, security and control of your personal data. This Privacy Policy explains how we collect, process, retain and share personal data through our website operated at gurcistansirketkurma.com, our content and our services.

This policy has been prepared in light of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”), the EU General Data Protection Regulation (“GDPR”) and international good-practice standards. For details specific to KVKK, including how to exercise data-subject rights, please also see our Data Protection Notice.

We may collect the following categories of data:

• Data you provide directly: Through our contact form: name, e-mail, industry, revenue band, telephone/WhatsApp and any notes you enter in the free-text field.
• Data collected automatically: IP address, browser type and version, device type, operating system, time and duration of visit, referring site, pages visited.
• Data collected via cookies: Session ID, language preference, user preferences. For details see our Cookie Policy.
• Data shared during service delivery: Once an engagement begins, your identity and financial information is processed under a separate contract and notice.

We use your data to:

• Respond to your requests and questions and schedule calls.
• Prepare dedicated proposals and operate the advisory engagement.
• Measure and improve service quality.
• Secure our website and detect technical issues.
• Comply with our legal obligations.
• With your explicit consent, send marketing communications and announcements.

We do not sell, rent, or transfer your personal data to third parties for marketing purposes. We share your data only with the categories of recipients below, and only to the extent necessary for service delivery:

• Infrastructure providers: Cloud hosting, content-delivery network (CDN), e-mail delivery infrastructure, customer-relationship management software. Data-processor agreements are signed with each provider.
• Professional advisors: Accountant, lawyer, auditor.
• Public authorities: Where required by law or by decision of a competent authority.
• In case of merger or transfer of the business: To the acquiring legal entity, with appropriate legal protections in place.

Our website and form infrastructure run on Cloudflare and similar global infrastructure providers. Their servers may be located in the European Union, the United States and other jurisdictions.

Cross-border transfers are carried out with appropriate safeguards under Article 9 of KVKK and Chapter V of the GDPR, including standard contractual clauses, supplementary technical measures, and your explicit consent where required.

Applicable law grants you the following rights:

• Right of access, rectification and erasure of your data.
• Right to restrict processing.
• Right to object to processing.
• Right to data portability — to receive your data in a structured, commonly used and machine-readable format.
• Right to withdraw consent where processing is based on consent.
• Right to lodge a complaint with a supervisory authority (in Türkiye: the Personal Data Protection Authority).

To exercise these rights, contact iletisim@gurcistansirketkurma.com. For the formal application procedure under KVKK, please see our Data Protection Notice.

We apply industry-standard technical and organisational measures to protect your data:

• End-to-end encryption via HTTPS/TLS.
• Access controls and authorisation matrix.
• Security-event management and log analysis.
• Regular backups stored in different geographies.
• Periodic data-protection training for staff.
• Data-processor agreements with third-party providers.

No security measure is absolute. In the event of a personal-data breach, we will provide notifications within the statutory timeframes.

Our services are not designed for individuals under 18. We do not knowingly collect personal data from minors. If you become aware of any personal data of a minor that has been processed in error, please contact us; we will arrange for its deletion.

Our website may contain links to third-party sites we do not control. We are not responsible for the privacy practices of those sites. We recommend that you review the privacy policy of any third-party site you visit.

This policy may be updated in response to legislative changes and changes within the scope of our services. We will announce material changes on the website. The most current version of the policy is always available on this page. You are responsible for periodically reviewing changes.