Privacy and Personal Data Protection Policy
This is an English translation provided for convenience. This policy is prepared under Turkish law. The Turkish version is legally binding; if the two differ, the Turkish version prevails.
1. Data Controller and Scope of the Service
Under the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”), Lexnavi Hukuk Teknolojileri Anonim Şirketi (“Lexnavi” or the “Company”), with its registered address at Başıbüyük Mh. Süreyyapaşa Başıbüyük Yolu Sk. No: 4/1 Maltepe / Istanbul, processes, as data controller, the personal data collected through the lexnavi.com website and the app.lexnavi.com SaaS portal, in line with the principles described below.
Lexnavi is the “data controller” for user registrations, billing and system access logs. For client information, employee lists and audit findings that a corporate customer (company) or law firm uploads to the platform as part of its own operations, the customer is the “data controller” and Lexnavi is the “data processor” providing the technical infrastructure.
2. Data Residency and Physical Database Isolation
By design, the Lexnavi ecosystem follows strict data sovereignty and isolation rules:
- No transfer of data abroad: No customer data, including cookies, is transferred abroad. Our servers are located within the Republic of Turkey, with data residency in line with the regulations.
- Independent database for each customer: A separate file-based SQLite database is allocated to each company and corporate customer. Access to another organisation’s database is blocked both physically and logically.
- One-way pull: The central regulation engine (Lexnavi Core) does not pull data from company databases and has no access to company-specific profile data.
- Deployment option (on-premises): Corporate customers who wish to may keep all of their data on their own on-premises servers.
3. Attorney-Client Confidentiality and Professional Secrecy (Article 36 of Law No. 1136)
Our platform is designed to comply fully with the professional secrecy obligation in Article 36 of the Turkish Attorneyship Law No. 1136 and with the Professional Rules of the Union of Turkish Bar Associations (privacy by design):
- Separation of multiple firms: If a company works with more than one law firm, each firm can see only the tasks and correspondence of the unit it has been authorised for. The data areas of different firms are completely isolated from each other.
- Protection when a lawyer is replaced: If the company changes its law firm, the previous firm’s Legal Desk opinions, messages and work attachments are not shown to the new firm and cannot be transferred even by copying within the system.
- No administrative inspection: Lexnavi personnel cannot in any way access users’ Legal Desk advisory correspondence or case and audit attachments.
4. AI Assurance: No Model Training and Human Oversight
No document, company profile answer, task correspondence or legal opinion that our customers upload to the system is used to train or update the weights (fine-tune) of any public or private AI model.
AI is used on the platform only to scan publicly available legislation texts and to create general templates. Every sector-specific impact analysis and legal risk alert definition that goes live is uploaded to the system only after it has been checked and approved by our legal experts and legislation analysts, following the “human-in-the-loop” principle.
5. Personal Data Processed, Purposes and Legal Bases
Your personal data is processed in the categories below on the legal bases stated in Article 5 of the KVKK: “conclusion and performance of a contract”, “the data controller’s legal obligation” and “legitimate interest”:
- Identity and contact details: Name, surname, corporate email, telephone number (account opening, identity verification, two-step security verification).
- Transaction and evidence logs: Login times, IP address, SHA-256 cryptographic digests of contract approvals and session security records (Turkish Law No. 5651 on internet publications, and legal evidence obligations).
- Customer transaction information: Subscription package, invoicing name (company title), tax office and number (keeping financial records under the Turkish Commercial Code and the Turkish Tax Procedure Law).
6. Retention Periods, Cryptographic Protection and Breach Notification
Your data is stored securely for as long as you hold an account and for the limitation periods set out in the relevant laws (10 years under the Turkish Code of Obligations and the Turkish Commercial Code; 2 years under Law No. 5651).
- All data in transit is protected with TLS 1.3 encryption; databases at rest and system backups are protected with the AES-256 algorithm.
- Contract and consent approvals are kept with a timestamp in a SHA-256 immutability archive.
- In the event of a personal data security breach, Lexnavi undertakes to notify the Turkish Personal Data Protection Board (KVKK Board) and affected customers within 72 hours at the latest.
8. Your Rights (KVKK Article 11) and How to Apply
Under Article 11 of the KVKK, data subjects have the right to learn whether their personal data is processed, to request information if it has been processed, to learn whether it is used in line with its purpose, to know the third parties to whom it is transferred within Turkey, to request correction of incomplete or incorrect data, and to request its deletion.
You can send your requests by email to hello@lexnavi.com or deliver them in writing to our head office: