Privacy Notice (KVKK and GDPR)

This notice explains how Gordion Partners Organizasyon Danışmanlık Limited Şirketi ("Gordion Partners", "we") processes personal data as the data controller under the Turkish Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKK") and, where it applies, the EU General Data Protection Regulation 2016/679 ("GDPR"). It is our information notice under KVKK art. 10 and GDPR art. 13.

Gordion Partners is a limited liability company that provides investment and immigration consulting and real-estate brokerage services to foreign clients (our director holds real-estate broker licence TTBS 3408704), as well as yacht brokerage.

• Address: Merkez Mahallesi Hasat Sokak No: 12A, 34384 Şişli, İstanbul, Türkiye
• MERSİS no.: 0396136152300001
• Trade registry: İstanbul Ticaret Sicili Müdürlüğü, no. 308755-5
• Email: contact@investment.com.tr
• Telephone: +90 533 140 04 96

• Identity and contact data: name, email address, telephone or WhatsApp number, country.
• Request data: the service, programme or project you ask about, the content of your message and the page from which you sent the form.
• Client data (only if you become a client, and only as far as the service requires): passport and identity document details, nationality, date of birth, address, details of family members included in an application, and financial and transaction data such as the purchase price, payment and bank details for a property or yacht transaction.
• Communication records: emails, WhatsApp messages and call notes exchanged with us.
• Technical data: IP address, browser type, date and time of a form submission, and server and security logs kept by our hosting provider.
• Analytics data (only with your consent): pages visited, approximate location (country or city), device type and similar usage statistics collected by Google Analytics.

Passport and identity data are not special categories of personal data. We do not ask for special categories of personal data (such as health, biometric or criminal record data) through this website. If a service exceptionally requires such data (for example a document requested by an authority), we process it only under the conditions of KVKK art. 6, for example with your explicit consent or where a law expressly provides for it, and we inform you separately. Please do not send such data unless it is necessary for your request.

• To answer your enquiry and take the steps you ask for before a contract (for example, sending information about citizenship, residence or a property project): KVKK art. 5(2)(c); GDPR art. 6(1)(b).
• To perform our consulting and brokerage services once you become a client, including coordination with the parties and authorities involved: KVKK art. 5(2)(c); GDPR art. 6(1)(b).
• To meet our legal obligations (for example commercial and tax record keeping, the obligations of real-estate brokers, identification and record-keeping duties under anti-money-laundering legislation where applicable, and requests from public authorities): KVKK art. 5(2)(ç); GDPR art. 6(1)(c).
• To establish, exercise or defend legal claims: KVKK art. 5(2)(e); GDPR art. 6(1)(f).
• To keep the website and our systems secure and to prevent misuse of the form: our legitimate interest, provided it does not harm your fundamental rights and freedoms, KVKK art. 5(2)(f); GDPR art. 6(1)(f).
• To measure how the website is used (analytics cookies): your explicit consent, KVKK art. 5(1); GDPR art. 6(1)(a). You can withdraw it at any time through "Cookie settings" at the bottom of every page.
• To send commercial electronic messages (newsletters, offers): only with your prior consent under Law No. 6563 on the Regulation of Electronic Commerce, KVKK art. 5(1); GDPR art. 6(1)(a). You can opt out at any time, free of charge, through the link in the message or by writing to us.

Providing personal data is voluntary. Without contact data we cannot answer your enquiry, and for client services some data is required by law or by the authorities handling your application; without it we cannot provide that service. We do not take decisions based solely on automated processing that produce legal or similarly significant effects for you, and we do not sell personal data.

We collect personal data by partly automated and non-automated means: directly from you when you fill in the enquiry form, email us, write to us on WhatsApp, call or meet us, or send us documents; from the parties involved in your transaction or application (for example a developer or an authority) where the service requires it; and when you browse the website (cookies and server logs, see the Cookie Policy). We process it on the legal bases listed in section 3.

Under KVKK arts. 8 and 9 we share personal data only as far as needed for the purposes in section 3:

• Hosting and email: Amazon Web Services, as our service provider (data processor). The website is hosted, and enquiry form emails are delivered to us through Amazon Simple Email Service, in the AWS Frankfurt, Germany region (eu-central-1).
• Analytics: Google (Google Analytics 4), only if you accept analytics cookies.
• Messaging: WhatsApp (Meta), only when you choose to contact us on WhatsApp; WhatsApp's own terms and privacy policy apply to that service.
• Other service providers we may use to organise enquiries (for example email or customer relationship tools), acting on our instructions.
• Our group companies Turkey Residence Agency (residentturkey.com, immigration advisory) and Turkish Council (turkishcouncil.org, Turkish language course visa programme), only where your request concerns their services and sharing is needed to answer it, or you ask us to put you in touch.
• Parties involved in your request, only when needed and with your knowledge: for example property developers, sellers or buyers, yacht sellers and brokers, appraisal firms, notaries, translators, banks, lawyers, and public authorities handling your application (such as land registry offices and the Presidency of Migration Management).
• Our accountants and legal advisers, who are bound by confidentiality, to meet legal obligations and to handle legal claims.
• Public authorities and courts when the law requires it.

AWS hosts the website and processes enquiry emails in its Frankfurt, Germany region. Google may process analytics data in other countries, including the United States, and WhatsApp (Meta) processes messages on its own infrastructure, which may be outside Türkiye. Some parties involved in your request may also be abroad.

We transfer personal data abroad only in line with KVKK art. 9 as amended by Law No. 7499 (in force since 1 June 2024): on the basis of an adequacy decision of the Personal Data Protection Board, where one exists for the country concerned; otherwise on appropriate safeguards, in particular the standard contract published by the Board, which is notified to the Personal Data Protection Authority within five business days of signature; or, for occasional transfers only, on one of the exceptions in art. 9(6), for example where the transfer is necessary for the performance of a contract with you or, exceptionally, with your explicit consent after you have been informed of the possible risks.

If the GDPR applies to you: data you send us from the European Economic Area is received by us in Türkiye, which does not have an EU adequacy decision, and is used to answer your request and provide the services you ask for. Where our service providers process data outside the European Economic Area, they rely on the safeguards in their data processing terms, such as the EU Standard Contractual Clauses.

• Enquiries that do not lead to a client relationship: up to 2 years after our last contact.
• Client files, contracts and commercial records: for the duration of the relationship and then for the statutory retention and limitation periods, generally 10 years (for example, commercial books and supporting documents under art. 82 of the Turkish Commercial Code, and the general limitation period under art. 146 of the Turkish Code of Obligations).
• Records of consent to commercial electronic messages: while the consent is valid and for 3 years after it ends, as required by the legislation under Law No. 6563.
• Server and security logs: for a short period (our hosting logs are currently deleted automatically after 14 days), longer only if needed to investigate a specific incident.
• Analytics data: according to the retention setting in Google Analytics, at most 14 months.

When a period ends, or the reason for processing no longer exists, the data is deleted, destroyed or anonymised in line with KVKK art. 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

Under KVKK art. 11 you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions of KVKK art. 7; request that third parties to whom the data was transferred are notified of a correction or deletion; object to a result against you that arises solely from analysis by automated systems; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection (GDPR arts. 15 to 21), the right to withdraw consent at any time without affecting the lawfulness of earlier processing, and the right to lodge a complaint with a supervisory authority.

In line with KVKK art. 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request:

• in writing, with your signature, to our address above;
• by registered electronic mail (KEP), or with a secure electronic signature or mobile signature;
• by email to contact@investment.com.tr from an email address you have previously notified to us and that is registered in our records.

Please include your name and surname; for Turkish citizens your T.R. identity number, and for foreign nationals your nationality and passport or identity number; your address for notification; your email address and telephone number, if any; and the subject of your request, with any supporting documents. We may ask for additional information to verify your identity.

We answer as soon as possible and at the latest within 30 days, free of charge. If the action requires an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your request is rejected, you find the answer insufficient or we do not answer in time, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) within 30 days of learning of our answer, and in any case within 60 days of your application (KVKK art. 14). If the GDPR applies to you, you may also complain to the supervisory authority of the EEA country where you live or work or where the alleged infringement took place.

We take technical and administrative measures under KVKK art. 12 to protect personal data, including encrypted connections (HTTPS), access restrictions, spam protection on the form and limited retention. No transmission over the internet is completely secure. If personal data is obtained by others unlawfully, we notify the persons concerned and the Personal Data Protection Board as required by law.

This website is not directed at children under 18, and we do not knowingly collect their data through it. Data of minors included in a family's residence, citizenship or property application is processed only as provided by their parent or legal guardian and only for that service.

We may update this notice when our services or the law change. The date of the latest version is shown at the top of this page. This version is effective from 16 October 2026.