The right starting point
for your application.

Formal applications under KVKK must follow the methods and contain the mandatory elements in the Communiqué. For email applications, you must use an email address previously notified to the controller and registered in its system.

This limited draft does not include every mandatory field of a formal application; complete identity and notification details through a secure and appropriate channel. Take into account the signature requirement for written applications.

You do not have to use this form or grant marketing consent to make a GDPR request. If there is reasonable doubt about your identity, additional information necessary for verification may be requested; identity documents are not required for every application. Identity-number conditions specific to KVKK applications do not automatically apply to GDPR requests.

KVKK requests are resolved as soon as possible according to their nature, and within 30 days at the latest. For GDPR requests, information about action taken is provided without delay and generally within one month of receipt. If necessary due to complexity or the number of requests, the GDPR period may be extended by two further months; the extension and reasons are communicated within the first month. Preparing a draft does not start these periods; the request must reach the data controller.

No. A text draft is prepared only in the browser. Form data is not sent to the server and no application record is created. Preparing the draft is not the same as submitting the application.

In the reported live infrastructure, the origin server is in Türkiye; Cloudflare is used for DNS, proxy, WAF, Web Analytics and security layers, and Google Gmail infrastructure for email. This local preview is not served through the live Cloudflare deployment and does not load analytics code.

An origin server in Türkiye does not establish that processing or transfers in Cloudflare and Google services occur only in Türkiye. Provider contracts, subprocessors, account region and a suitable transfer mechanism must be verified separately before publication.

The browser’s privacy preference record expires after 180 days. This is not an automatic deletion period for server records or email/backups. Server access logs, application files and backups need separate retention schedules and disposal procedures; actual log/backup settings have not yet been verified.

Disposal records for erasure, destruction and anonymisation are retained for at least three years, without prejudice to other legal obligations. This rule does not mean that all server logs or all personal data must be kept for three years.