1.Key terms
2.Who I am
3.What personal data I collect and store about clients, and how I collect it.
4.Why I collect personal data and what I do with it.
5.How I retain information and how I keep it secure.
6.Your rights and how to exercise them.
7.How I can be contacted.
I.Key terms
The below table sets out some key terms used throughout each of our privacy notices:
1.“Criminal Offence Data”:
Personal data that relates to criminal activity, proven and unproven allegations, investigations, proceedings, convictions (including absence of), penalties, conditions, or restrictions in place as part of the criminal justice process and civil measures which may lead to a criminal penalty if not adhered to.
2.“Data Subject”:
The identified or identifiable living individual to whom personal data relates.
3.“Data Subject Rights”:
Specific individual rights in regard to the data subject's personal data as defined in the UK GDPR (access, informed, rectification, erasure, restriction, objection, portability and not subject to automated decision making).
4.“Information”:
One, or a combination of, criminal offence data, personal data or special category personal data.
5.“Lawful Basis” or “Lawful Bases”:
One, or a combination of, the six lawful bases required for processing personal data as defined in the UK GDPR.
6.“Personal Data”:
Any information relating to ‘data subject’ who can be identified, directly or indirectly, in particular by reference to an identifier. Examples include a name, date of birth, home address, contact information etc.
7.“Special Category Personal Data”:
Personal data that can reveal racial / ethnic origins, political opinions, religious / philosophical beliefs, trade union membership or concerns genetic data, biometric data, health data, sex life or sexual orientation.
8.“UK GDPR”:
The retained EU law version of the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).
9."UK's Data Protection Laws":
This means the UK GDPR and the Data Protection Act 2018.
10."Turkiye's Data Protection Laws":
This means the Law on the Protection of Personal Data (LPPD), No. 6698, enacted in 2016.
11.“I”, “Me”, “My”, and “the Business”:
This means I, Iremsah Turkan, and my business as a freelance solicitor.
II.Who am I?
I am a freelance solicitor and I run my business alone. I act as a “data controller” for the purposes of the data protection laws. That means I am subject to the data protection laws and owe duties to data subjects.
I am registered with the Information Commissioner’s Office (the “ICO” hereafter), the relevant supervisory authority for data protection matters. The ICO has oversight over the manner in which I hold, process and respect data. As detailed below, you have the right to complain to the ICO about how I handle your data.
For your information, my relevant registration details with the ICO are as follow:
Registration number : ZB903399
Registered address : 15-17 Middle Street
BN1 1AL
Brighton and Hove, East Sussex
United Kingdom
If you would like to contact me about this notice, please contact me here.
III.What information do I process from my clients and about my clients?
In the course of offering advice and representations (the “legal services” hereafter), I process personal data of many types. This may include:
1.Personal details including contact details;
2.Financial details;
3.Business information;
4.Family details; and
5.Education details.
I am also likely to process what is known as “special category” data, a term used to indicate that particularly sensitive data might be processed. This includes information as to:
1.Criminal offences, convictions and allegations;
2.Health;
3.Racial or ethnic origin;
4.Political opinions;
5.Religious or philosophical beliefs;
6.Trade union membership;
7.Sexual history; and
8.Sexual orientation.
I process a range of such data, owing to the range of cases on which I am instructed. If you are interested in knowing the express categories of data processed in your particular case, please contact me.
IV.How do I collect personal data?
The primary source of information I receive is directly from clients, to enable me to provide legal services. I also receive information from referral sources, who may have contacted me on behalf of clients and/or prospective clients. Other information may be obtained and collated from public sources, including subscription services. We do so to be able to provide legal services effectively and in full.
V.Whose personal data do I process?
I process personal data about my clients, potential clients, individuals who feature in the matters on which I am instructed, witnesses, experts, opponents, counsel (also known as barristers), court staff, members of the judiciary and others ancillary to your matter.
VI.Lawful basis for processing data
Data protection laws including the General Data Protection Regulation (the “GDPR” hereafter) requires data controllers to have a “lawful reason” or “lawful basis” to process personal data. My lawful basis for processing are set out fully below.
A. Contractual necessity: To fulfil my contractual duties to my clients or to enter into a contract with you.
B. Legitimate interests: My legitimate interests in processing data include:
1.To provide legal services, including advice and representation services to my clients;
2.If the data subject is not my client, to provide legal services to my client from whom or on whose behalf I have collected that data;
3.To carry out billing and administrative services, including collection of fees and disbursements;
4.To deal with complaints and concerns that may arise, including any regulatory or legal proceedings;
5.To provide training to myself;
6.To assess my performance and review my files;
7.For banking and accounting purposes; and
8.For marketing purposes.
Please note that I will note share information concerning you or from which you can be identified, without your consent or it is already publicly available. I will not email you regarding events, services or offers in which you may be interested.
C. Compliance with the law: I will process your data to comply with my legal requirements, including:
1.To comply with regulatory obligations;
2.To comply with financial regulatory requirements, such as money laundering checks;
3.To make statutory returns to HMRC for VAT and income tax purposes; and
4.To submit a file to the Home Office for my own personal immigration file.
D. Special category data: I aim to keep clients updated with how and why I am processing their data. However, this is not always possible. Please therefore note that if I am unable to receive your express consent for processing special category data, I may process such data for:
1.Reasons of substantial public interest; and
2.The purposes of establishing, exercising or defending legal rights.
I will use your data only for the purposes for which it was provided, save where I fairly consider that I need it for another reason. Any such reason will:
1.be compatible with the original purpose; and
2.ensure that my professional obligations to my clients do not prevent such use.
If I need to use your personal information for an unrelated purpose, I will advise you of this in advance and either get your consent or explain the alternative legal basis which allows me to do so.
You should be aware that I may process your personal information without your knowledge or consent. However, I will only do so where this is required or permitted by law or a court order.
VII.Do I share your personal data?
I do so, in order to offer effective and complete legal services. I would not be able to offer such legal services without sharing your information. I explain with whom I may share your data below, as well as the reasons for that sharing (where not self-explanatory).
For the purposes of this notice and further to my professional obligations of confidentiality and privilege to clients, I may provide your personal data to the following:
1.Barristers, other legal representatives or experts with whom I am in touch for further services that are out of my area. Note that I will not instruct such a professional without your consent, save where I cannot receive your consent, in which case, I may share your data on the other above cited lawful bases;
2.Typing, secretarial and administrative services;
3.Document Storage companies who I may use to archive documents and files off-site pursuant to my professional obligations;
4.IT providers, where access to my database is required to solve a technical issue;
5.Opposing legal representatives as part of your case;
6.Accountants and banks;
7.Judges and court staff;
8.Public authorities where our legal/regulatory obligations as well as immigration obligations require me;
9.My regulators, including the Solicitors Regulatory Authority, in the event of a dispute or other legal matter; and
10.Any other party where I have your consent to do so.
My regulators may also conduct audits of my files or may require me to employ independent companies to audit me for regulatory and certification purposes. You can object to your file being passed to my regulators for auditing purposes or to any independent auditors whom I may be required to employ for those purposes. Please let me know if you object to this when I open your file
When my business engages with third parties to process personal data on its behalf, they do so on the basis of written instructions and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
Please note that I do not make any automated decisions with respect to your cases or management of your file.
I will not retain your data in any form that identifies you for longer than necessary. Unless the specific circumstances of your case require otherwise or you indicate otherwise, I will delete, destroy and/or anonymise your information around 7 years after the end of your case, or 7 years after the date of last payment or settling of fees.
I may also retain information for longer for audit purposes, or for legal or compliance reasons. However, should you exercise your rights to erasure over this data, I will oblige where necessary.
I am based in the United Kingdom, and I am qualified in the jurisdictions of Turkiye and England & Wales. As such, your data is processed within the jurisdiction of the UK unless your matter falls within Turkiye’s jurisdiction alone or in addition to that of England & Wales, and this requires me to take an action in Turkiye. In the event that I do so, I will ensure that I comply with Turkiye's data protection laws, i.e. the Law on the Protection of Personal Data (LPPD), No. 6698, enacted in 2016.
I do not often transfer data outside of these jurisdictions. I may however transfer your data to a location outside of the UK if I consider it necessary to do so (for example, for reasons related to the circumstance of your case or to a secure server).
In such cases, I will only transfer your data to an area to which an “adequacy regulation” applies or where the data transfer will be carried out under government approved Standard Contractual Clauses.
I have security measures in place to ensure appropriate security for your personal data. I seek to protect against unauthorised or unlawful processing, as well as protecting against accidental loss, destruction or damage.
I take the following measures to protect your data:
1.Only I will have access to your data as held by me. I will have access only to the data necessary for the purposes to which I have been given access;
2.I will do so in adherence to the law and this notice. Additionally, I understand my professional duties of confidentiality and legal professional privilege;
3.I use secure browsers to protect malware or other unintended intrusions into my database; and
4.When the business engages with third parties to process personal data on its behalf, they do so on the basis of written instructions and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
Although I take such measures, I am not liable for losses caused by the acts of third parties such as a malware attack on external servers which I could not prevent or by loss of information by a third party.
I passionately believe in the exercise of rights, whether over your data or any other fundamental right. Accordingly it is important for me to know that you understand the rights you have over your data. In particular:
A. Right to access:
You have a right to ask for the personal data I hold about you. This will not I will ask for proof of identity before acceding to such a request to preserve your privacy. However, once I am satisfied as to your identity, I will provide you with your data within 30 days (as required by law). If I may take longer, I will let you know and explain the reasons for the same. I will not charge you for such a request, unless I reasonably consider your request to be excessive or repetitive. I will also charge administration fees should, for example, I require to take your information out of storage or archive. I also reserve the right to refuse a request if I reasonably consider it to be unfounded, repetitive or excessive.
If you request access to your personal data, this will override any right I have to hold a lien over your personal data. However, please note that as a legal professional I do not have to release information if it breaches legal professional privilege and duty of confidentiality towards a client.
B. Right to be informed:
The notice provides the information you need about how I collect and use your data. If you require any further information, please contact me.
C. Right to rectification:
If you consider that any information I hold is inaccurate, please let me know and I will take steps to rectify it.
D. Right to erasure:
In certain circumstances, you have the right to have personal data that I process blocked, erased and destroyed.
E. Right to object and restrict:
You can ask for your processing of your personal data to be restricted, for example for marketing purposes. You can also object to the processing of your data entirely but this will affect the service I am able to offer.
F. Right to portability:
You can request your data to be ported to another platform, in certain circumstances.
You should note that these rights are not absolute and can be restricted in certain circumstances. There are instances where the rights will not be available, such as:
1.If the request would interfere with my professional obligations to respect legal professional privilege.
2.I will also need to consider the effect of any right against the effect on:
a. Legal proceedings (including prospective proceedings);
b. Obtaining legal advice; and
c. Defending other legal rights.
Please contact me if you have any further questions.
Further information about your rights are available on the ICO website at https://ico.org.uk/
My website may use cookies. I encourage you to review your cookie policies on my website and any other website you visit.
This notice is liable to change, as the data protection regime evolves. When I make significant changes, I will notify clients by email. I will also revise the published notice on my website, as well as keeping a record of the changes.
I am hopeful that you will not have a need to complain, as I take your data protection and privacy seriously. Indeed, I trust that you will be pleased by the approach taken in this notice. However, should you find it necessary to complain, I suggest that you contact me in the first instance.
In the event that you are not satisfied with the resolution from me, you have a right to complain to the regulator of information, the ICO, under the UK's data protection laws. The ICO has online guidance on how to complain to them at:
https://ico.org.uk/make-a-complaint/
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF
©2025 Iremsah Turkan, Freelance Solicitor
Solicitors Regulation Authority No. 7013545
Union of Turkish Bar Associations No. 140877
Istanbul Bar Association No. 60870