Clear answers to the questions on your mind.

Yes; in the systems we set up, access to documents is role-based, and every view and download is logged with the user and the time. That traceability is valuable in two quite different ways.The first is compliance: the Personal Data Protection Law (No. 6698) places duties of accountability and data security on the controller, and being able to answer who accessed which personal data is decisive in the investigation of a breach. The second is transaction management: in a sale or an investment process, reading from…

You can, but recruitment and performance are among the most exposed uses there are. The AI Act places systems used in hiring, promotion and performance evaluation in the high-risk class, which brings obligations of transparency, record-keeping and human oversight. In Türkiye the same process runs into the Personal Data Protection Law (No. 6698): candidates have to be given an information notice, and the law gives a data subject rights against a decision produced by automated processing, including the right to obje…

Yes — if the system's output is used in the EU, or if you place AI-containing products/services on the EU market, being established in Türkiye does not take you outside its scope. For companies that export to Germany or have customers there, the AI Act is a direct commercial requirement, similar to the LkSG.

AI is not a line that puts the fee up by itself; more often it is an efficiency tool that shortens the time spent on high-volume work. When the first pass over thousands of documents gets faster, the time saved moves from routine reading to analysis and strategy, which can bring down the total hours on comparable matters.For suitable work of defined scope, fixed-price models can be set up so that the cost is predictable. In every case the fee is set by the nature, the scope and the complexity of the work, and is p…

A standard transaction data room is usually working within a few days, once the folder structure is built, the access roles are defined and the first documents are loaded. What decides the timetable is not the technical set-up but how ready the documents are: paperwork that is missing or scattered across the business is the thing that actually stretches the process.Access roles are defined separately for buyer, seller and advisers, and at the level of view-only or download rather than all-or-nothing. For documents…

Keeping everything forever is neither necessary nor compliant. The workable method is a retention-and-destruction policy that sets the statutory period for each type of document — and those periods do not come from one place. The Turkish Commercial Code (No. 6102) requires commercial books and records to be kept for ten years. Tax documents follow the Tax Procedure Law. For personal data, the Personal Data Protection Law (No. 6698) applies a different kind of test altogether: the period laid down in the relevant l…

The control and distribution clauses matter as much as the valuation, and sometimes more. The main ones are the liquidation preference, anti-dilution protection, investor veto and affirmative voting rights, the composition of the board, restrictions on the transfer of founder shares and their vesting, rights of first refusal and tag-along and drag-along rights — and whose stake the option pool is carved out of.A term sheet reads like a statement of intent, and many of its clauses are not binding. That is misleadin…

We work with document sets in three languages: Turkish, German and English. This covers mixed-language data rooms, cross-border correspondence chains and contract bundles where a single file may combine, for example, a Turkish original with a German annex and English side letters. Our review, due diligence and drafting workflows are built around these three working languages, which reflect the firm’s Turkish–German commercial focus and the typical make-up of files in trade between Türkiye, Germany and the wider EU…

A written acceptable-use policy is strongly advisable for any company whose staff use ChatGPT-like generative AI tools. Without one, employees can paste customer data, trade secrets and personal data into external tools whose terms may permit further processing, creating exposure under Türkiye's Personal Data Protection Law (KVKK, Law 6698) and, for EU-facing data, the GDPR. A concise policy typically defines approved tools, prohibited data categories, human review of outputs, and a record of who may use what. Pai…

Yes. Process automations can be designed to exchange data with the ERP, CRM and document management systems you already run. The aim is not to move the legal steps into a separate piece of software but to embed them in the workflow you have, so that nobody ends up entering the same data twice.In practice the integration is built through ready-made API connections, webhooks or a middleware layer, with the access permissions defined separately for each system. Where personal data moves between them, the data securit…

Start with an inventory rather than a scanner. Instead of digitising a scattered archive all at once, the existing contracts are gathered, classified by type, and their critical fields — the parties, the subject matter, the term, the renewal date, the value, the termination condition — turned into structured data.Then a set of standard templates and a drafting-and-approval flow is put in place for new contracts, so the archive keeps its order as it grows instead of losing it again. The sequence follows risk: high-…

We follow a structured route. First we clarify the use cases and the data boundaries and decide which work is genuinely suited to AI. Then come tool selection, a pilot workflow, a use policy and training for the team; starting with a small, measurable pilot both protects the budget and earns the team’s confidence.The legal side of the set-up matters at least as much as the technical side: whether your data may be used for training, and the retention and confidentiality terms, have to be secured in the supplier con…

We manage the hallucination risk by designing the process so that nothing relies blindly on what the model produces. Outputs are generated against the source document wherever possible, which means a finding can be traced back to the document it rests on. Critical findings are always checked by a lawyer against the original source, and only results that have passed that check reach the client.AI does not decide anything here. It is a first-pass tool that makes high-volume work faster; the legal assessment and the…

A few headings decide this contract. The first is data: whether your inputs will be used to train the model, how long they are retained, which sub-processors are involved and in which country the processing happens — written down rather than assumed. Where personal data is processed, a data processor agreement under the Personal Data Protection Law (No. 6698) has to be annexed, with GDPR terms where EU data is involved.The second is the outputs: who may use the generated content, and how widely. The third is liabi…

For start-ups planning to raise investment, the joint-stock company is the most workable structure in practice. Investors prefer it because share transfers are free and straightforward, because privileged shares and an option pool (ESOP) can be set up, and because corporate records such as the share ledger can be kept in proper order.Both joint-stock and limited liability companies are governed by the Turkish Commercial Code (No. 6102); in a limited liability company a share transfer requires a notary and registra…

Start where the volume is high, the rules are clear and the cost of an error is visible. The usual candidates are NDA approvals, tracking powers of attorney, and contract renewals. A short discovery exercise scores the candidates on an impact-and-difficulty matrix, and we begin with the one that produces a quick win.Compliance belongs in the design rather than in a later review. Where a process handles personal data at volume, the requirements of the Personal Data Protection Law (No. 6698) go into the specificatio…

No. In the tools we use under enterprise agreements your documents are kept out of model training — your inputs are not used to feed the general model. That is secured both by an express clause in the supplier contract and by the technical setting itself, and the retention period, the access rules and the deletion terms are given in writing as well.We work to an internal protocol that decides which data may be processed in which environment, and documents containing personal data are handled under the Personal Dat…

You find out early by running a short regulatory scan that sets your business model against the legislative map. The scan shows which regulatory regimes actually engage: if personal data is processed, the Personal Data Protection Law (No. 6698) and, for the EU market, the GDPR; if there is a payments, credit or crypto dimension, financial regulation and its licensing regimes; and in sectors such as health, food and e-commerce, their own permits and limits.Establishing where the permit, notification and prohibition…

Yes, and it is the fastest payback a digital contract system offers. Every contract’s expiry, renewal and termination-notice windows are defined in the system, and automatic reminders reach the people responsible before the window closes rather than after it.That is what puts an end to unwanted silent renewals and to missed notice periods. It matters most on fixed-term contracts, because under the Turkish Code of Obligations (No. 6098) a termination notice has to be given within the period and in the manner the co…

Automation does not shed legal responsibility. It stays where it was — with the person who takes the decision and with the company. Automation does not decide anything; it prepares the decision.So our designs put human approval at the critical steps, build an audit trail showing who did what and when, and define the system’s legal limits in writing. Where an automation processes personal data, the controller’s accountability and record-keeping obligations under the Personal Data Protection Law (No. 6698) continue…

Retention periods vary according to the type of document and the relevant legislation; personal data, however, must be destroyed once its purpose has ceased to exist. We set retention and destruction rules for each category of document and establish a system to track these periods systematically.

In the event of a data breach, both the KVKK and GDPR require notification to the competent authority within specific timeframes and, where necessary, to the affected data subjects. Establishing a response plan in advance is critical; and when a breach occurs, we provide you with legal guidance through the steps of detection, containment, notification, and record-keeping.

As a rule, a secure electronic signature produces the same legal effect as a handwritten signature. That said, official form requirements may apply to certain transactions. We structure the process with the appropriate electronic signature or KEP (registered electronic mail) solution according to the type of document to be signed.