KVKK Privacy Notice

Last updated: 15 October 2026

As Weroglobal (the “Company” or “Data Controller”), we process your personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”) and its secondary legislation while providing our visa and study-abroad consultancy services. This notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, and applies to all of our channels listed below:

• weroglobal.com (corporate site), weroglobalvisa.com (visa consultancy), weroglobalstudent.com (study-abroad consultancy),
• system.weroglobal.com (client file tracking, online payment, online appointments),
• b2b.weroglobal.com (partner portal) and the communication we conduct at our office and by phone, email, SMS and WhatsApp.

1. Data controller

Name: Weroglobal
Address: Muratpaşa, Antalya
Email: [email protected]

2. Categories of personal data processed

• Identity: first name, surname, date of birth, nationality; passport details within the scope of the application (the passport number is stored encrypted in our systems) and passport expiry date.
• Contact: phone number, email address, address, city.
• Educational and professional information: education level, school and department, diploma, transcript, language test results, CV, work experience.
• Client transaction information: the country and service you are interested in, the content of requests and messages, initial consultation appointment, application file status, document checklist, appointment and decision dates, residence permit expiry date, consultant notes.
• Legal transaction information: notes and deadlines kept by the lawyer in residence permit, family reunification and post-refusal appeal files (visible only to the lawyer assigned to the file and authorised administrators; stored encrypted).
• Financial information: service fee, payment and receipt records; bank statements and sponsor documents required by the application. In online payments, your card details never reach our Company; they are processed directly on the secure page of the licensed payment institution (PayTR / iyzico), and only the result of the payment and the transaction number are transmitted to us. For invoicing: full name / company name, Turkish ID number or tax number, tax office and billing address (if you do not provide these, the invoice is issued in the name of the end consumer).
• Visual records: biometric photograph for the application; with your explicit consent, a photograph used in reviews.
• Marketing / campaign source: which advertisement or link brought you to our site (e.g. Google Ads, Instagram ad, search engine, referring site, campaign name, first page visited). This information is linked to your identity only when you submit a form or book an appointment.
• Transaction security: IP address, form submission time, session information, login and two-factor authentication records, audit logs of file tracking and document upload operations.
• Special categories of personal data: only where your application requires it (e.g. a medical report or criminal record for a visa) and in accordance with the conditions in Article 6 of the KVKK; your explicit consent is obtained for health data.

3. Purposes of processing and legal grounds

• Establishment and performance of the consultancy contract (KVKK Art. 5/2-c): responding to your request, planning initial consultations and appointments, preparing and following up school / programme / visa applications, collecting documents, notifying you of your file status (email, SMS, WhatsApp), online payment, receipts and refunds.
• Fulfilment of legal obligations (Art. 5/2-ç): accounting and tax records, requests from competent authorities.
• Establishment, exercise or protection of a right (Art. 5/2-e): post-refusal appeals and legal proceedings, evidence in disputes.
• Legitimate interest (Art. 5/2-f): system and information security, prevention of misuse, service quality and reporting (aggregate statistics such as how many requests come from which channel), reminders on important dates such as passport and residence permit expiry dates.
• Explicit consent (Art. 5/1): newsletters and promotional messages, non-essential cookies and persistent storage of campaign source information in your browser, special categories of data and the international transfers stated in Section 6 of this notice as being based on explicit consent.

4. Method of collection

Your personal data is collected by automated and partially automated means through the contact, initial consultation, online appointment, KVKK request and careers forms on our websites, the file tracking and document upload pages, the online payment page, face to face at our office, and by phone, email, SMS and WhatsApp; and, for applications made through our partners abroad, through the information the partner shares with us (the partner is responsible for informing you about this transfer and obtaining the necessary consent).

5. Domestic transfers

Your personal data is shared only to the extent necessary for the above purposes with the following recipients: our branches and consultants handling your file, contracted lawyers assigned to your file, online payment institutions (PayTR, iyzico), the SMS service provider (Netgsm), suppliers from whom we obtain hosting, email and backup services, our financial advisor, the e-invoice / e-archive service provider (Paraşüt) and the Revenue Administration (as required by tax legislation), and legally authorised public institutions and organisations.

6. International transfers

Due to the nature of the service, some data is transferred abroad. These transfers are carried out in accordance with Article 9 of the KVKK:

• Consulates, embassies and visa application centres; the schools and universities you apply to: the information and documents necessary for your application to be made, as a necessary and incidental transfer for the performance of the contract (Art. 9/6-b) or based on your explicit consent.
• Our partners abroad (agencies): if your application was made through a partner, file status and document information, with your explicit consent and/or under the standard contract set by the Board.
• WhatsApp (Meta Platforms): file status, appointment and payment notifications are sent via WhatsApp only if you have given explicit consent for international transfer; otherwise, SMS and email are used.
• Analytics and advertising services (e.g. Google Analytics): only when you give your approval in your cookie preferences.

Transfers based on a standard contract are notified to the Personal Data Protection Authority within 5 business days of signature.

7. Retention periods

• Request and appointment records that do not lead to a result: if they do not turn into a client file, they are anonymised at the end of the retention period set in the KVKK Centre.
• Client files, documents and correspondence: for the general limitation period (10 years) from the end of the service; accounting records for the period set in the relevant legislation (10 years).
• Security and system logs: 90 days; audit logs: for as long as the related file is retained.
• Newsletter and promotional consents: until you withdraw your consent. Campaign source information in your browser: a maximum of 90 days.
• Data whose retention period has expired is deleted, destroyed or anonymised.

8. Security measures

Sensitive fields such as documents and passport numbers are stored encrypted with AES-256; the admin panel is accessed with two-factor authentication; each user sees only the files they are authorised to access; file views, downloads and changes are recorded in audit logs; connections are encrypted (HTTPS) and backups are taken regularly.

9. Your rights under Article 11 of the KVKK

You have the right to learn whether your personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in accordance with that purpose; to know the third parties to whom it has been transferred domestically or abroad; to request its correction if it has been processed incompletely or incorrectly; to request its deletion or destruction within the framework of the conditions in Article 7 of the KVKK and the notification of these operations to the third parties to whom it has been transferred; to object to a result arising against you through analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing. No decision is made about you based solely on automated processing.

10. How to submit a request

You can submit your requests via the KVKK Request Form on our websites, from your registered email address to [email protected], or in writing to our company address together with documents proving your identity. Your request will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the tariff set by the Board may apply. You may withdraw your explicit consent at any time through the same channels.