Protection of Personal Data — Information Notice

Last updated: 9 July 2026 · Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK")

This English translation is provided for convenience only. In the event of any discrepancy, the Turkish original prevails.

1. Data Controller and Data Processor

LaborLawCases (laborlawcases.com) is a multi-tenant software service (SaaS) through which law firms and companies manage their labor law litigation processes. Within this structure there are two distinct roles:

• Data controller with respect to your account data: LaborLawCases Inc., the operator of the Platform ("Platform"). The name, e-mail address and firm details you provide at registration fall within this scope.
• With respect to the case/employee data you enter into the application: the data controller is our customer (the law firm/company) that opens the account and enters the data. For this data, the Platform acts solely as a data processor within the meaning of the KVKK and does not use the data for any purpose other than the customer's instructions. Details are set out in the Confidentiality Agreement annexed to the Terms of Use.

2. Personal Data Processed

• Account and authentication data: full name, e-mail address, password (stored as an irreversible hash), firm/office name.
• Usage and security records: date/time, IP address and transaction details of login attempts and write operations (audit trail); retained for system security and account protection.
• Content data processed by the customer: case records, plaintiff names, hearing notes and uploaded documents. Lawful collection of this data and informing the data subjects is the obligation of the customer in its capacity as data controller.
• Communication data: e-mail address, used for invitation/verification/password-reset e-mails.

3. Purposes of Processing and Legal Grounds

• Establishing membership and providing the service — KVKK Art. 5/2(c): formation and performance of a contract.
• Account security, authorization and audit trail — KVKK Art. 5/2(f): legitimate interest.
• Mandatory service notifications (verification, password reset, invitations) — performance of the contract.
• Compliance with legal obligations — KVKK Art. 5/2(ç).

4. Transfer of Data

• E-mail delivery: verification/invitation e-mails are delivered through our e-mail infrastructure provider (Mailgun); in this context the recipient e-mail address and message content are transferred to the provider.
• AI analyses: only if the customer, at its own choice, configures an external AI provider (e.g. OpenAI, Anthropic, Google), case summary data within the scope of the analysis is transmitted to that provider upon the customer's instruction. In the default (local/rule-based) analysis, no data is sent externally.
• Transfers to authorized public institutions and bodies may take place only where legally required and upon a duly made request.
• Beyond the above, personal data is not sold, rented, or shared with third parties for marketing purposes.

5. Retention and Security

• Each customer's data is kept in its own database-level isolated environment (tenant).
• Records are archived (logical deletion) instead of being physically deleted; every operation leaves a who/when trail. Daily automated backups are applied; communication is encrypted with TLS.
• Upon termination of membership, data is deleted, destroyed or anonymized taking into account the periods set out in the Terms of Use and applicable legislation.

6. Your Rights Under KVKK Art. 11

You have the right to learn whether your personal data is processed; to request information if it has been processed; to learn whether it is used in accordance with its purpose; to request correction of incomplete/inaccurate data; to request its deletion or destruction; to request notification of these operations to third parties to whom the data has been transferred; to object to a result arising to your detriment through analysis exclusively by automated systems; and to claim compensation in case of damage.

You may submit your requests to destek@laborlawcases.com. Requests are concluded free of charge within 30 days at the latest.

Note: data subjects of the case/employee data you enter into the application (e.g. plaintiffs) should direct their KVKK rights to the relevant law firm/company acting as data controller.