This Privacy Policy explains what personal data SHURA GRUP DANIŞMANLIK VE TİCARET LİMİTED ŞİRKETİ (“SHURA Group”, “we” or “us”) collects, why we collect it, how long we keep it and what rights you have. We are committed to handling your personal data carefully, lawfully and transparently.
This Policy also serves as our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Where the EU General Data Protection Regulation (“GDPR”) applies to our processing, we also comply with it.
Contents
- Scope of This Policy
- Who We Are (Data Controller)
- Personal Data We Collect
- Why We Use Your Data and on What Legal Basis
- How Long We Keep Your Data
- Who We Share Your Data With
- International Transfers
- Cookies
- Automated Decisions
- Your Rights
- How to Exercise Your Rights
- Children
- Data Security
- Changes to This Policy
- Contact
1Scope of This Policy
This Policy applies to personal data we process when you:
- visit our website at shuragroup.ltd (the “Website”);
- contact us by e-mail, telephone, post or in person;
- are a prospective or existing client, or a contact person at a client, supplier or business partner.
When you engage us for a specific service, we may give you an additional notice about the data needed for that service.
2Who We Are (Data Controller)
SHURA Group is the data controller for the personal data described in this Policy.
| Trade name | SHURA GRUP DANIŞMANLIK VE TİCARET LİMİTED ŞİRKETİ |
|---|---|
| Address | Bahçelievler Mah. Ressam Halim Sk. Kadir Has Sitesi No: 7 İç Kapı No: 36, Bahçelievler / Istanbul, Türkiye |
| Privacy contact | support@shuragroup.ltd |
3Personal Data We Collect
a) Data you give us
- Identity: name and surname, and your title or company if you write on behalf of a business.
- Contact: e-mail address, telephone number and postal address.
- Communication: the content of your messages and any files you choose to attach.
b) Data collected automatically when you visit the Website
When your browser loads the Website, our hosting provider automatically records technical data in its server logs: your IP address, browser and device type, the page requested, the referring page and the date and time of the request. This is needed to deliver the pages and to keep the Website secure.
The Website has no contact forms, user accounts, analytics tools, advertising trackers or social-media plug-ins.
c) Data needed for client services
If you become a client, we process the data needed to carry out the agreed service. For example, for residence or work permit support this may include passport and identity details, nationality, family information, address, education and employment history, and copies of supporting documents. Where a service requires special categories of personal data (such as health data or biometric photographs), we process them only as permitted by Article 6 of KVKK, including with your explicit consent where required.
4Why We Use Your Data and on What Legal Basis
| Purpose | Legal basis (KVKK Art. 5(2) / GDPR Art. 6(1)) |
|---|---|
| Answering your enquiries and preparing proposals | Steps needed before entering into a contract (5(2)(c) / 6(1)(b)); our legitimate interest in replying to messages (5(2)(f) / 6(1)(f)) |
| Providing the services you have engaged us for, including preparing and following up applications | Performance of a contract (5(2)(c) / 6(1)(b)); explicit consent for special-category data where required (KVKK Art. 6 / GDPR Art. 9) |
| Invoicing, accounting and keeping commercial records | Compliance with legal obligations under commercial and tax law (5(2)(ç) / 6(1)(c)) |
| Running and securing the Website | Our legitimate interest in a working, secure website (5(2)(f) / 6(1)(f)) |
| Establishing, exercising or defending legal claims | 5(2)(e) / 6(1)(f) |
| Responding to lawful requests from courts and public authorities | Compliance with legal obligations (5(2)(ç) / 6(1)(c)) |
We do not send marketing messages unless you have given prior consent as required by the Law on the Regulation of Electronic Commerce No. 6563. You can withdraw that consent at any time.
5How Long We Keep Your Data
- Enquiries that do not lead to an engagement: up to 2 years after our last contact.
- Client files, contracts, invoices and commercial correspondence: for the periods required by law, generally 10 years under Article 82 of the Turkish Commercial Code No. 6102 and 5 years under Article 253 of the Tax Procedure Law No. 213, counted from the end of the relevant year.
- Website server logs: kept by our hosting provider for a short period under its own retention policy. We do not keep separate copies.
Once a retention period ends, or the data is no longer needed for its purpose, we delete, destroy or anonymise it in line with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
6Who We Share Your Data With
We do not sell your personal data. We share it only where necessary and only with:
- Service providers who support our business, such as our website hosting provider (Vercel Inc.), e-mail and IT service providers, and our accountants. They may use the data only on our instructions and only for the service they provide to us.
- Professional advisers such as lawyers, financial advisers and auditors, where needed.
- Public authorities and institutions involved in a service you have asked us to handle, such as the Presidency of Migration Management, the Ministry of Labour and Social Security, consulates or notaries, on your instruction.
- Courts, enforcement offices and other authorities where the law requires us to disclose data.
7International Transfers
Some of our service providers, including our hosting provider, store or process data on servers outside Türkiye. When personal data is transferred abroad, we rely on the mechanisms in Article 9 of KVKK: an adequacy decision, appropriate safeguards such as standard contracts, or, where neither is available, the occasional-transfer conditions set by the law. For data covered by the GDPR, we use the safeguards provided by that regulation, such as the European Commission’s Standard Contractual Clauses.
8Cookies
The Website does not use cookies or similar tracking technologies. It does not load fonts, scripts, analytics or advertising from third parties. If this changes, we will update this Policy and, where required, ask for your consent first.
9Automated Decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
10Your Rights
Under Article 11 of KVKK, you have the right to:
- learn whether we process your personal data;
- request information about the processing if we do;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- ask us to correct incomplete or inaccurate data;
- ask us to delete or destroy your data under the conditions in Article 7 of KVKK;
- ask us to notify the third parties who received your data of any correction, deletion or destruction;
- object to a result against you that arises solely from automated analysis of your data;
- claim compensation if you suffer damage because your data was processed unlawfully.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection (including to direct marketing). Where we rely on your consent, you can withdraw it at any time without affecting processing carried out before the withdrawal.
11How to Exercise Your Rights
Under the Communiqué on the Principles and Procedures for Applications to the Data Controller, you can send us your request:
- in writing, signed, to our head office address shown in Section 2;
- by e-mail to support@shuragroup.ltd from the e-mail address you have previously given us or that is registered in our records;
- by registered electronic mail (KEP), or with a secure electronic signature or mobile signature.
Your request should include your name and surname, your signature for written requests, your Turkish ID number (or nationality and passport number if you are not a Turkish citizen), your address, your e-mail or telephone number and a clear description of what you are asking for.
We will respond as soon as possible and within 30 days at the latest. Requests are handled free of charge. If handling a request involves an additional cost, we may charge the fee set by the Personal Data Protection Board.
If your request is rejected, you find our answer insufficient or we do not reply in time, you may complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning of our answer and in any case within 60 days of your application. If the GDPR applies to you, you may also complain to the supervisory authority where you live or work.
12Children
The Website and our services are not aimed at people under 18, and we do not knowingly collect their personal data without the involvement of a parent or legal guardian. Where a service concerns a minor, such as a family residence permit application, we process the minor’s data only through and on the instruction of the parent or legal guardian. If you believe a minor has sent us personal data without such involvement, please contact us and we will delete it.
13Data Security
We take appropriate technical and organisational measures, as required by Article 12 of KVKK, to protect personal data against unauthorised access, loss, misuse, disclosure or alteration. These include encrypted (HTTPS) connections to the Website, access controls limiting data to staff who need it, and confidentiality obligations for our staff and service providers. No method of transmission or storage is completely secure, so please avoid sending sensitive documents by ordinary e-mail unless we have agreed a method with you.
14Changes to This Policy
We may update this Policy when our processing changes or the law requires it. The current version is always published on this page with its effective date. If we make significant changes, we will make them clear on the Website and, for existing clients, may also inform you by e-mail.
15Contact
For any question about this Policy or your personal data:
SHURA GRUP DANIŞMANLIK VE TİCARET LTD. ŞTİ.
Bahçelievler Mah. Ressam Halim Sk. Kadir Has Sitesi No: 7 İç Kapı No: 36
Bahçelievler / Istanbul, Türkiye
E-mail: support@shuragroup.ltd
This Policy is available in Turkish and English. If the two versions differ, the Turkish version prevails.