Data controller
Doc City (Moscow) and Mirrefah (Istanbul) are two brands of the same team. For processing that takes place in Türkiye the data controller is the Istanbul business; processing in Russia is subject to Russian law (152-FZ). This text covers the Türkiye side.
Address: Fulya Mah. Büyükdere Cad. Osman Apt. No: 58, Floor 2, Flat 7 · Mecidiyeköy, Şişli / Istanbul · Email: info@doccity.net · Phone: +90 551 052 74 04
Eksik bilgi — yayın öncesi tamamlanacak: legal entity name, tax / MERSİS number and registered electronic mail address to be supplied by the client. Without these three the text is incomplete.
What we collect
There is exactly one place on this site where we ask for personal data: the enquiry form. This is everything it asks for, and there is nothing else.
- Name — required. So we know how to address you.
- Your message — required. So we understand what you are asking for.
- Phone — optional. Only if you type it.
- Email — optional. Only if you type it.
- The service you are interested in, your preferred contact channel, which office you are writing to, and the language of the page.
- If you used the apostille tool, the source and destination country codes you selected.
Two records you did not type
When you submit the form the server keeps two further technical records, neither of which identifies you:
Your IP address is NOT stored in the clear. It is mixed with a secret key (HMAC-SHA256) and only the digest is written. That is enough for us to recognise repeated submissions from the same address, and not enough for anyone who obtains the record to recover the address.
Your browser string (user agent) is digested and truncated the same way.
Personal data is NOT written to logs: name, phone, email and similar fields are masked before the log line is produced.
Why we process it
One purpose only: to come back to you and work on your request. Your enquiry is given a tracking code, and you can check the status of your file yourself with that code.
Your data is NOT used for marketing, profiling, ad targeting or automated decision-making. That is not a promise but a limit of the system: no such component exists.
Legal basis
Processing rests on Article 5(2)(c) of Law No. 6698: it is directly related to the conclusion or performance of a contract. You request a service; we process the data so we can respond to that request.
Where your request requires compliance with a legal obligation (a notarial or consular procedure, for example) Article 5(2)(ç) also applies.
Who we share it with
The content of your enquiry is passed to an institution only when carrying out the work requires it, and only to the extent required: notary, sworn translator, governorate, ministry, consulate, university. We tell you what will be sent where before the work starts.
There is no other transfer to any third party. No advertising network, no analytics provider, no data broker.
Data is stored on Supabase (PostgreSQL). Where transfer abroad is involved, the conditions in Article 9 of Law No. 6698 apply.
Eksik bilgi — yayın öncesi tamamlanacak: hosting region and any cross-border transfer declaration to be confirmed with the client.
How long we keep it
The enquiry record is kept for the period required by applicable legislation after the work is completed, and then deleted or anonymised.
Eksik bilgi — yayın öncesi tamamlanacak: the exact retention period is to be set with the client. Without a stated period this section is incomplete — 'as long as necessary' is not sufficient under KVKK.
Your rights
Article 11 of Law No. 6698 gives you the right to learn whether your data is processed, to request information about it, to learn whether it is used for its purpose, to know the third parties it is transferred to at home or abroad, to have it corrected if incomplete or wrong, to have it deleted or destroyed, to have those actions notified to the parties it was transferred to, to object to analysis carried out solely by automated means, and to claim compensation for damage.
How to apply is set out on a separate page: Data subject request.