Skip to content
Leo Patent ve Marka

Privacy Notice (KVKK)

Last updated: 16 October 2026

This Privacy Notice has been prepared under article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform the people who visit the www.leopatent.com website (the “Site”), use the contact form on the Site or contact us by email, phone or WhatsApp about how their personal data is processed.

1. Data controller

The data controller for your personal data is Gordion Partners, which provides trademark and patent attorney services under the “Leo Patent” trade mark (“Gordion Partners”, “Leo Patent” or “we”). Gordion Partners provides its industrial property attorney services through patent and trademark attorneys entered in the register kept by the Turkish Patent and Trademark Office (TÜRKPATENT); it is not a law firm.

2. Personal data processed, purposes and legal grounds

2.1. Contact form

When you use the contact form on the Site (in any of its language versions), the following personal data is processed:

  • Identity data: your first name and surname;
  • Contact data: your email address and, if you choose to provide it, your phone number;
  • Customer transaction data: the content of your message;
  • Transaction record data: the language and address (URL) of the page from which the form was sent, the date and time of sending, and the fact that the box confirming that you have read and understood this Privacy Notice was ticked.

This data is processed in order to assess and answer your enquiry, to provide information and a fee quotation for the service you request, and to conduct pre-contractual discussions with a view to a possible engagement, on the legal ground that processing personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract (KVKK art. 5(2)(c)). Where your enquiry is a general question not related to a possible engagement, the same data is processed in order to answer it, on the legal ground that processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f)).

The language and page from which the message was sent are processed so that we can answer you in the right language and on the right subject; the time of sending and the checkbox information are processed to evidence that the obligation to inform has been fulfilled and to keep orderly correspondence records. These are processed on the legal ground that processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f)).

To send the form, you only need to confirm that you have read and understood this Privacy Notice. This confirmation is not a declaration of explicit consent; the processing and transfers carried out in connection with the contact form are not based on explicit consent, and no explicit consent is requested from you for this purpose.

The form is delivered as an email to our business mailbox by a function (AWS Lambda) running on the Amazon Web Services (AWS) infrastructure that hosts the Site, through Amazon Simple Email Service (Amazon SES). The Site does not store form data in any database. On the AWS infrastructure, only records of technical errors occurring during sending are kept, and these records are deleted after 14 days.

Please do not include in your message special categories of personal data listed in KVKK art. 6, such as data on health, religion, ethnic origin or criminal convictions, or personal data of third parties that is not necessary for your enquiry.

2.2. Technical data processed when visiting the Site

The Site is delivered through the AWS content delivery network (Amazon CloudFront) and storage service (Amazon S3). When you visit the Site, request data such as your IP address, the requested page, the time of the request and the technical information your browser sends as standard (e.g. browser and operating system type) is processed by CloudFront so that the pages can be delivered to your browser. This processing is based on the legal ground that processing is necessary for our legitimate interests (KVKK art. 5(2)(f)), for the purposes of technically delivering the Site, ensuring information security and preventing misuse and attacks.

2.3. Analytics cookies (Google Analytics 4)

The Google Analytics 4 service is used to measure how the Site is used and to improve its content only if you give your explicit consent by choosing the accept option in the cookie banner. In this context, usage data such as online identifiers (cookie ID), pages visited, visit duration, interactions on the Site, device and browser information and approximate location is processed. The use of analytics cookies and the related processing are based on your explicit consent (KVKK art. 5(1)).

Unless you choose the accept option, the Google Analytics code is not loaded on the Site at all and no request is sent to Google; storage for advertising purposes is never used. Not giving explicit consent does not prevent you from using the Site. You may withdraw your consent at any time with the “Cookie preferences” button at the bottom of the Site; analytics measurement then stops and the Google Analytics cookies set through the Site are deleted. Withdrawal does not affect the lawfulness of processing carried out before it. For details, please see the Cookie Policy.

2.4. Map and video content

The Google Maps content on the contact page is loaded only if you click the “Show map” button, and the YouTube videos on the Site only if you click on the video. Video preview images are served from the Site's own servers. Unless you open this content, no request is sent to Google. When you open the map or a video, your browser connects directly to Google's servers (including youtube-nocookie.com); your IP address and browser information are then transmitted to Google, and Google may use cookies and similar technologies under its own policies. Displaying the content you request is based on our legitimate interest (KVKK art. 5(2)(f)); the processing that Google carries out on its own behalf in this context is under its own responsibility as data controller and is subject to the Google Privacy Policy.

2.5. Contact by email, phone and WhatsApp

The email, phone and WhatsApp links on the Site open the respective external services. The identity, contact and message content data you send us through these channels is processed for the purposes stated in section 2.1 and on the same legal grounds (KVKK art. 5(2)(c) and 5(2)(f)). Processing carried out by WhatsApp, your telephone operator and your email provider is subject to those service providers' own terms and policies.

2.6. Data processed in the course of a client engagement

If you engage us, the identity, contact, application and file, legal transaction and financial (invoicing) data that you send outside the Site (e.g. by email or WhatsApp) is processed for the purposes of preparing trademark, patent, design and other industrial property applications, prosecuting them before TÜRKPATENT and competent foreign offices, managing client relations and invoicing. This processing is based on the establishment and performance of the contract (KVKK art. 5(2)(c)); our legal obligations under Industrial Property Law No. 6769 and related legislation, Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102 (KVKK art. 5(2)(ç)); and the establishment, exercise or protection of a right (KVKK art. 5(2)(e)). Detailed information on the engagement is provided separately when it is established.

3. Method of collection

Your personal data is collected electronically, by automated or partly automated means, through the contact form on the Site, cookies and similar technologies, the server infrastructure that delivers the Site, and the email, phone and WhatsApp channels.

4. Recipients and purposes of transfer

Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in accordance with KVKK articles 8 and 9:

  • Hosting and email delivery provider (data processor): Amazon Web Services, for hosting and delivering the Site (CloudFront, S3), processing the contact form (Lambda) and delivering it by email (SES). The AWS region used is Frankfurt (Germany, eu-central-1); the content delivery network may deliver pages through edge servers close to the visitor.
  • Analytics provider (data processor): Google (Google Ireland Limited, Ireland and Google LLC, USA), only if you give your explicit consent, for measuring the use of the Site (Google Analytics 4).
  • Our business email service provider (data processor): for receiving and storing contact form messages and your emails in our mailbox.
  • Competent public authorities and judicial authorities: to fulfil our legal obligations and upon request.
  • If an engagement is established: TÜRKPATENT, the industrial property offices of foreign countries and the relevant international organisations, and the foreign attorneys we work with on foreign filings (for filing and prosecuting applications), and the persons providing us with accounting and financial advisory services (for statutory bookkeeping and tax obligations).

Your personal data is not sold and is not shared with third parties for advertising purposes.

Transfers abroad

Since the servers of AWS (Germany, European Union) and Google (Ireland and USA) are located outside Türkiye, the processing relating to the contact form, the delivery of the Site and (if you give explicit consent) analytics measurement constitutes a transfer of personal data abroad. Where the servers of our business email provider are located abroad, the receipt and storage of contact form messages and of your emails in our mailbox is also such a transfer. To the extent that no adequacy decision has been issued by the Personal Data Protection Board for these countries, these regular transfers are made in accordance with the appropriate safeguards provided for in KVKK art. 9(4) as amended by Law No. 7499, on the basis of the standard contract published by the Board. Standard contracts are notified to the Personal Data Protection Authority within five business days of their signature. Regular transfers are not based on explicit consent. When you open a map or a video, your browser connects directly to Google's servers at your request, as described in section 2.4.

Transfers to foreign industrial property offices, international organisations and foreign attorneys in the course of a client engagement are made on an occasional basis and on the ground that they are necessary for the performance of the contract (KVKK art. 9(6)(b)), necessary for the establishment or performance of a contract to be concluded in your interest between us and another natural or legal person (KVKK art. 9(6)(c)), or necessary for the establishment, exercise or protection of a right (KVKK art. 9(6)(d)). Where such transfers are not occasional, they are based on the appropriate safeguards described above.

5. Retention periods

  • Contact enquiries that do not lead to an engagement (form, email, WhatsApp): for as long as needed to answer the enquiry and in any case for no more than 2 years;
  • Enquiries that lead to an engagement and client files: for the duration of the engagement and for 10 years after it ends, the general limitation period under article 146 of the Turkish Code of Obligations No. 6098; retention periods required by tax and commercial legislation remain reserved;
  • AWS error records: 14 days;
  • Google Analytics data (only with explicit consent): 14 months;
  • Your cookie choice (the “lp-consent” entry in your browser): until you delete it from your browser.

When these periods expire, your personal data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, at the latest within 3 months of the end of the period. If you request the deletion of your personal data and all conditions for processing have ceased to exist, your request is concluded within 30 days at the latest.

6. Data security

In accordance with KVKK art. 12, we take appropriate technical and organisational measures to prevent the unlawful processing of and access to your personal data and to ensure its safekeeping. Connections to the Site and the contact form are encrypted (HTTPS), form data is not kept in a database by the Site, and access to the data is limited to the persons who need it for their work.

7. Automated decision-making and profiling

Your personal data is not sold and is not used for advertising. No profiling or decision-making based solely on automated processing takes place on the Site.

8. Your rights under KVKK art. 11

Under KVKK art. 11, by applying to the data controller you have the right to:

  • a) learn whether your personal data is processed,
  • b) request information about the processing if your personal data has been processed,
  • c) learn the purpose of the processing and whether the data is used in accordance with that purpose,
  • ç) know the third parties in Türkiye or abroad to whom your personal data is transferred,
  • d) request the rectification of your personal data if it is incomplete or inaccurate,
  • e) request the deletion or destruction of your personal data under the conditions set out in KVKK art. 7,
  • f) request that the operations carried out under paragraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
  • g) object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
  • ğ) claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

9. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send requests concerning your rights by the methods provided for in that Communiqué, in particular by one of the following means:

  • In writing: a signed (wet-ink) letter delivered by hand, by post or through a notary to our address above;
  • Signed with a secure electronic signature or mobile signature, to contact@leopatent.com;
  • From an email address you have previously notified to us and that is registered in our system, to contact@leopatent.com.

Your application must include your first name, surname and, if the application is in writing, your signature; your Turkish identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or, if any, identity number if you are a foreign national; your residential or business address for notifications; if any, your email address, phone and fax number for notifications; and the subject of your request. Information and documents relating to the request should be attached. Applications made on behalf of another person require a power of attorney granting specific authority. We may ask for additional information to verify your identity.

Your application will be concluded free of charge as soon as possible according to the nature of the request and within 30 days at the latest. If the operation entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged: no fee is charged for written answers of up to ten pages, and a processing fee of 1 Turkish lira may be charged for each page above ten; if the answer is provided on a recording medium such as a CD or flash drive, the cost of the medium may be requested. If the application results from an error of the data controller, any fee charged is refunded.

If your application is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the date of your application (KVKK art. 14). A complaint cannot be filed before the application to the data controller has been exhausted. The Authority's website: www.kvkk.gov.tr.

10. Changes

This Privacy Notice may be updated following changes in the legislation or in our processing activities. The current text is always published on this page; the date at the top of the page shows the date of the last update.

Related pages: Cookie Policy and Legal Notice.

This text is a translation of the Turkish original. In case of any discrepancy between the language versions, the Turkish version shall prevail.

ContactCallWhatsApp