KVKK Disclosure

1. Data controller and office-controlled records

OceanLabs acts as data controller for platform account administration, authentication, service security, and support communications. Contact details are provided below. For client and office records, the law office normally determines the processing purposes and means, acts as data controller, and must provide its own notices and lawful instructions. Hufis processes those records on the office’s behalf. This notice does not replace an office’s disclosure obligations.

2. Personal-data categories

• Identity and contact information: account name, email, phone number, office/workspace name, and office-supplied client or party information.
• Account and transaction information: membership roles, invitations, preferences, case and court references, tasks, deadlines, notes, investigations, enforcement matters, and insurance matters.
• Documents and file metadata, import/export information, and support correspondence.
• Security and technical information: IP addresses, session/authentication information, request logs, audit records, app/update information, device platform, notification preferences, push tokens, and installation identifiers used for enabled notification delivery.
• Special-category information, such as health or criminal-conviction information, only insofar as lawfully supplied in office records. The office must establish the relevant processing condition and appropriate safeguards.

3. Collection methods and purposes

Information is obtained electronically through registration, invitations, account actions, office users’ record entry and uploads, imports, authorized integrations, support communications, and technical records generated by the website, mobile app, and service infrastructure.

• Provide contracted workspace and record-management functions and apply access permissions.
• Authenticate users, send verification/security messages, deliver enabled notifications, and provide compatible mobile updates.
• Respond to requests, maintain service security and reliability, investigate misuse, and keep necessary audit records.
• Fulfil applicable legal obligations and establish, exercise, or protect legal rights.

4. Legal grounds for processing

Depending on the activity, processing relies on the relevant conditions in Article 5 of KVKK: necessity for a contract, fulfilment of a legal obligation, establishment/exercise/protection of a right, or legitimate interests that do not violate fundamental rights and freedoms. Explicit consent is sought separately where required; acceptance of terms or reading this notice does not replace it.

Special-category information requires a condition permitted by Article 6 and the prescribed safeguards. Offices must assess the applicable condition for the records they submit; a blanket assumption of consent is not used. Where processing is on behalf of an office, its lawful instructions and processing conditions apply.

5. Recipients and transfers

Data may be made available to authorized office users and integrations, providers of hosting/storage, email/SMS, support, and mobile updates, and legally authorized authorities when necessary for the stated purposes. SMTP2GO may deliver configured service email; Expo delivers mobile updates. Enabled notifications use Google Firebase Cloud Messaging and platform delivery services, including Apple Push Notification service for iOS. Information shared or exported by users is sent to their chosen recipients.

Providers are required to protect data and process it only for authorized purposes. Providers outside Türkiye may involve an international transfer. Such transfers must meet Article 9’s applicable conditions and required safeguards. This notice is not a transfer-consent request and does not assert that a particular statutory transfer mechanism applies to every provider.

6. Retention and security

We apply safeguards including authenticated and role-based access, workspace separation, password hashing, production HTTPS, secure mobile token storage, and security/audit records. Data is retained as necessary for the stated purpose and relevant legal obligations. Offices determine lawful retention of their records. Retention settings are manual expectations rather than an automatic purge, and archiving does not erase data. Account and personal-data deletion requests are handled through the request page; any legally necessary retained records and reasons are explained when the request is assessed.

7. Your rights under Article 11

• Learn whether your personal data is processed and request information about that processing.
• Learn the purpose of processing and whether data is used in accordance with that purpose.
• Know recipients of personal data within Türkiye and abroad.
• Request correction of incomplete or inaccurate data and erasure or destruction under the conditions in Article 7.
• Request notification of correction or erasure/destruction to recipients of your data.
• Object to a result against you arising solely from automated analysis of your data.
• Seek compensation for harm caused by unlawful processing.

8. Making a request

You can send your request to the contact below using the email address previously registered with Hufis. Identify Hufis, your account/workspace, the right you wish to exercise, and the scope of your request. We may ask for information proportionate to verifying your identity or completing a request that needs additional particulars under the applicable request rules. Do not send your password or unrelated confidential case documents.

Requests falling under KVKK are assessed according to their nature and answered as soon as possible, within the statutory maximum of 30 days. For office-controlled records, contact the responsible office; we will assist or coordinate as appropriate. If your request is refused, the response is insufficient, or no timely response is given, you may complain to the Personal Data Protection Board subject to Article 14’s conditions and deadlines.