Privacy Policy

1. Data controller and scope

For the purposes of this policy the data controller is the company operating the Delilim software infrastructure. The policy applies to all users holding an account and to visitors of the platform's public pages.

Personal data is processed within the framework of Turkish Personal Data Protection Law no. 6698 and the related legislation.

2. Personal data processed

The following categories of data are processed in order to deliver the service:

• Identity and contact data: name, national identification number, email address, telephone number, province and address.
• Professional data: bar association and registration details, title and organisation, for regulated professions.
• Account security data: password hash, two-factor authentication records, session and sign-in records.
• Activity records: audit trails of the actions you perform on the platform, with date and time.
• Content data: documents you upload, requests you create and messages you send.
• Payment data: subscription and invoicing details. Card details are not stored by Delilim.

3. Purposes and legal grounds of processing

Data is processed to create and manage your account, to provide access to the software, to maintain security and prevent misuse, to issue invoices and to comply with legal obligations.

Depending on the case, the legal grounds are the conclusion and performance of the contract, compliance with a legal obligation, legitimate interest and explicit consent. Where processing rests on consent, you may withdraw that consent at any time.

4. Transfers and service providers

Data may be shared with service providers for technical services such as hosting, email delivery, security and AI/OCR, only to the extent the service requires. Recipients, sub-processors, countries and transfer mechanisms by function: [İŞLEV BAZINDA ALICI, ALT İŞLEYEN, ÜLKE VE AKTARIM MEKANİZMASI LİSTESİ - TEYİT GEREKLİ] (function-level list of recipients, sub-processors, countries and transfer mechanism – to be confirmed). Providers' training, human-access and exceptional-retention terms: [SAĞLAYICI BAZINDA EĞİTİM, İNSAN ERİŞİMİ VE İSTİSNAİ SAKLAMA KOŞULLARI - SÖZLEŞMESEL TEYİT GEREKLİ] (provider-level training, human-access and exceptional-retention terms – contractual confirmation required).

AI features run only for an action the user starts and only with the content needed for that action. Outputs are generated automatically and are not automated decisions with legal effect concerning a person; the user evaluates the output. Delilim staff do not review outputs one by one.

When live legislation and case law query features are enabled, technical queries (statutory citations or filtered search terms derived from the user request) may be sent to official public portals (mevzuat.gov.tr and bedesten.adalet.gov.tr) solely to query and verify statutory provisions and judicial decisions; no private user files or case document contents are transferred to these portals.

If you allow the “Analytics” choice, the following is passed to Google Analytics to understand which pages and features of the platform are used: the page path (identifier numbers removed, without any query string), browser and device information, and an approximate location derived from the IP address. This includes the pages after you sign in; your name, e-mail, account identifier, and the content of cases, documents and messages are not passed on. The transfer is made to servers outside Türkiye and rests only on this permission; if you do not give it, or withdraw it later, no data is passed to Google Analytics. Details are in the Cookie Policy.

Transfers to competent public authorities take place only in the cases and within the limits prescribed by law.

Data is not sold or assigned to third parties for marketing purposes.

5. Retention periods

Personal data is retained for as long as the purpose of processing requires and until the limitation and retention periods set by law have expired.

You can request deletion of your account from the Privacy center; the request is reviewed and processed by hand and answered within the period prescribed by law. Retention periods by category and the disposal method are described in the Retention and Disposal Policy; records that must be kept by law fall outside this scope.

Retention and Disposal Policy

6. Security measures

Technical and organisational measures are applied, including access authorisation, encryption in transit and at rest, two-factor authentication, audit logging and regular security reviews.

In the event of a data breach, the notification obligations prescribed by law are fulfilled.

7. Your rights

Under article 11 of the Personal Data Protection Law you have the right to learn whether your personal data is being processed, to request information where it is, to learn the purpose of processing and whether the data is used in line with that purpose, to know the third parties to whom the data is transferred domestically or abroad, to request correction of incomplete or inaccurate data, to request erasure or destruction, and to request that these operations be notified to the third parties to whom the data was transferred.

You also have the right to object to a result adverse to you arising exclusively from automated analysis of the processed data, and to claim compensation for damage suffered as a result of unlawful processing.

8. Cookies and requests

The platform uses the cookies and similar identifiers necessary for session management, language and theme preference and security in order to operate the site and apply your privacy choice; they are not used for advertising. Optional analytics and marketing technologies run only with your separate choice. See the Cookie Policy for details.

You can submit requests concerning your rights through the support channel on the platform. Requests are answered within the period prescribed by law.

Cookie Policy