Contact Form Privacy Notice

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

As M&A Partners (“our Firm”), we process, as data controller, the personal data of individuals contacting us through the contact form on the www.mapartners.com.tr website (“our Website”). Ensuring and safeguarding the confidentiality of our visitors’ personal data and information security are among our principal priorities. We therefore wish to inform you under the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

This Information Notice on the Processing of Personal Data (“Information Notice”) has been prepared to inform you how and why we collect, process and retain your personal data through our contact form, and to whom and for what reasons we transfer it.

This Information Notice relates solely to the contact form. The conclusion of a legal services/engagement agreement, payments, cookies and commercial electronic communications are outside the scope of this form. Where such activities are carried out separately, separate information is provided about them.

1. When and by what means do we collect your personal data?

Your personal data is collected electronically, by wholly or partly automated means, when you complete and submit the contact form on our Website. Connection and transaction logs generated on the server when the form is submitted may also be obtained through the same channel.

Your personal data is collected in the following circumstances:

• When you complete and submit the contact form;
• When we contact you again in relation to the request you submitted through the form.

2. What personal data do we process?

The data processed through the contact form is limited to the fields on the form and the records necessarily generated by submitting the form.

Identity and contact data: the name entered in the “Your Name” field, email address and telephone number.

Request data: subject and message content, and the record of subsequent correspondence relating to the request.

The message field is a free-text field. You are neither expected nor requested to share special categories of personal data, particularly health data, in this field. Under Article 6 KVKK, special categories of personal data may be processed with the data subject’s explicit consent or where one of the conditions in paragraph 3 of that Article is satisfied. Such data that you voluntarily enter in the message field is processed only for the purpose of resolving your request, where processing is necessary for the establishment, exercise or protection of a right in connection with your request for legal assistance, or where another condition in paragraph 3 is satisfied in the specific case. If no such condition is satisfied, the data is not used beyond the request, is not transferred to another activity and is placed in the destruction process. This notice is not an explicit consent form for special categories of personal data.

3. Why do we process your personal data?

We may obtain, record, store, retain, classify and use your personal data for the following purposes and only within those purposes:

• Receiving, assessing and responding to the contact request and requesting further information where necessary; this includes recording the request;
• Contacting the person making the request and responding through the channel specified in the form;
• Keeping correspondence records, identifying duplicate request records and preventing misuse;
• Fulfilling obligations arising from legislation and applicable within the scope of the contact form;
• Ensuring the security of the electronic systems of our Website and form infrastructure;
• Responding to duly made requests from competent public institutions, organisations and judicial authorities;
• Retaining records necessary for the establishment, exercise or protection of a right in a potential dispute.

4. On what legal grounds do we process your data?

We process your personal data consistently with the purpose of collection and on the relevant ground set out in Article 5 KVKK and, where special categories of personal data are involved, Article 6. A single, specific ground is identified for each purpose.

5. Who has access to your personal data, and to whom and why do we transfer it?

Within our Firm, only persons responsible for assessing your request may access your personal data. Subject to the conditions in Articles 4 and 8 KVKK and the necessary security measures, we may transfer your personal data solely to achieve the purposes above, for the following purposes:

• By designated and authorised persons within our Firm, solely for reading, assessing and responding to the request.
• By our suppliers acting as data processors, for hosting, email, form infrastructure, backup and information security services, on our instructions.
• To legally authorised public institutions, organisations and judicial authorities where there is a legal obligation or a duly made request.

Unless otherwise provided by law, the data processors with whom we share your data may process it only for the purpose of the transfer and on our instructions. If the nature of the request requires a transfer to an independent data controller, the purpose of the transfer and the recipient group will be notified separately before the transfer.

6. Your rights as a data subject

Under Article 11 KVKK, as a data subject, you have the right to:

• Learn whether your personal data is being processed;
• Request information if your personal data has been processed;
• Learn the purpose of processing your personal data and whether it is used in accordance with that purpose;
• Know the third parties to whom your personal data is transferred in Türkiye or abroad;
• Request rectification of incomplete or inaccurate personal data;
• Request erasure or destruction of your personal data subject to Article 7 KVKK, and request that third parties to whom the data has been transferred be notified of the action taken;
• Object to an outcome against you arising from analysis of the processed data exclusively by automated systems;
• Claim compensation for damage suffered as a result of unlawful processing of your personal data.

If you wish to exercise any of these rights under Article 13 KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may submit your request to our Firm through one of the following channels, in Turkish, including information establishing your identity and in accordance with the principles set out in that Communiqué:

• In person, with documents establishing your identity, or through a notary, to İzzetpaşa Mah. Yeni Yol Cad. No: 3 D: 3 Nurol Tower Şişli/İstanbul; or
• To our email address info@mapartners.com.tr, using a secure electronic signature, mobile signature, or an email address previously notified to us and registered in our systems.