Privacy Policy

Who We Are

NLI Global is a law firm registered and operating in Istanbul, Turkey, providing legal services in the areas of Turkish citizenship by investment, real estate law, corporate law, company formation, and immigration law. References to "NLI Global," "we," "us," or "our" throughout this policy refer to NLI Global and its legal professionals.

This Privacy Policy governs the collection and processing of personal data through our website at nli.global, through direct client engagement, and in connection with the provision of legal services.

Personal Data We Collect

The categories of personal data we collect depend on whether you are visiting our website, making an inquiry, or engaging us for legal services.

Information you provide directly:

• Full name, nationality, and country of residence
• Email address, telephone number, and postal address
• Passport details and identity documents (where required for legal file opening)
• Financial information relevant to investment thresholds and source of funds
• Details of intended real estate, corporate, or citizenship transactions
• Information submitted via contact forms, consultation requests, or direct correspondence

Information collected automatically:

• IP address, browser type, and operating system
• Pages visited, time spent, and referral sources
• Cookie identifiers and session data (see Section 09)

We do not collect special category data (such as health data or biometric data) unless it is strictly required for a specific legal matter and you have explicitly provided it in that context.

How We Use Your Data

We use personal data only for purposes that are directly connected to the provision of legal services and the operation of our firm:

• Responding to inquiries and providing initial legal consultations
• Establishing and managing a client engagement, including executing client identification and due diligence obligations required by Turkish law
• Preparing and filing legal documents, applications, and submissions on your behalf
• Conducting title deed verification, land registry searches, and contract review in connection with real estate matters
• Managing citizenship and immigration applications with the relevant Turkish government authorities
• Complying with anti-money laundering (AML) and know-your-client (KYC) obligations
• Sending service-related communications, including updates on your matter
• Improving the functionality and content of our website
• Complying with legal and regulatory obligations applicable to legal practitioners in Turkey

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Legal Basis for Processing

Our processing of personal data rests on the following legal grounds under the Turkish Personal Data Protection Law (KVKK No. 6698) and, where applicable, the EU General Data Protection Regulation (GDPR):

• Performance of a contract — processing necessary to deliver legal services you have engaged us to provide
• Legal obligation — compliance with AML, KYC, tax, and bar association requirements applicable to law firms in Turkey
• Legitimate interests — operating our website, managing our business, and protecting against legal claims, where those interests are not overridden by your rights
• Consent — where we send marketing communications or process data for a purpose not covered by the above, we will seek your explicit consent and you may withdraw it at any time

Sharing & Disclosure

NLI Global does not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Turkish government authorities — the Presidency for Citizenship and Migration Management (İGM), the Land Registry and Cadastre Directorate (TKGM), the Revenue Administration (GİB), and other bodies where required by the legal service being performed
• Correspondent law firms or notaries — third-party professionals engaged to assist with your matter, bound by equivalent confidentiality obligations
• Service providers — hosting, IT, and communications providers engaged to support our firm's operations, under appropriate data processing agreements
• Legal or regulatory requirement — where disclosure is required by a court order, regulatory authority, or applicable law

All third parties with whom we share data are required to handle it in accordance with applicable law and our instructions.

International Data Transfers

Our primary operations are based in Istanbul, Turkey. Client data is generally processed and stored within Turkey. Where data is transferred to a country outside Turkey, we ensure that appropriate safeguards are in place — including standard contractual clauses or other mechanisms recognised under KVKK — to protect your data to a standard equivalent to Turkish law.

If you are based in the European Economic Area (EEA), transfers of your data to Turkey are conducted in compliance with GDPR requirements applicable to international data transfers.

Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. In practice:

• Client matter files are retained for a minimum of 10 years following the close of the matter, in accordance with Turkish Bar Association and AML requirements
• Inquiry and pre-engagement data is retained for up to 24 months from the date of last contact
• Website analytics data is retained for up to 26 months

When data is no longer required and no legal obligation requires its retention, it is securely deleted or anonymised.

Your Rights

Under KVKK and, where applicable, the GDPR, you have the following rights with respect to your personal data:

• Right to be informed — to know whether your data is being processed and to receive information about that processing
• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of data where there is no lawful basis for continued processing
• Right to restriction — to request that we limit processing in certain circumstances
• Right to object — to object to processing based on our legitimate interests
• Right to data portability — to receive your data in a structured, machine-readable format (where processing is based on consent or contract)

To exercise any of these rights, please contact us using the details in Section 13. We will respond within the timeframes required by applicable law.

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK) or, if you are located in the EEA, with your local supervisory authority.

Cookies

Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device that help us operate the site and understand how it is used.

Types of cookies we use:

• Strictly necessary cookies — required for basic site functionality; cannot be disabled
• Analytics cookies — used to understand traffic patterns and improve the site (e.g., Google Analytics); subject to your consent
• Preference cookies — used to remember your settings and choices

You can manage or withdraw consent to non-essential cookies at any time through your browser settings or our cookie preference tool. Disabling certain cookies may affect site functionality.

Security

We implement technical and organisational measures appropriate to the sensitivity of the data we process. These include encrypted communications, access controls, and secure document handling procedures consistent with legal professional standards.

No method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant authorities and, where required, you directly, in accordance with applicable law.

Children

Our legal services are directed to adults and business entities. We do not knowingly collect personal data from individuals under the age of 18. If you believe that a minor's data has been submitted to us inadvertently, please contact us and we will take steps to delete it promptly.

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will revise the "Last updated" date at the top of this page.

Continued use of our website or our services following an update constitutes acknowledgement of the revised policy.

Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or the handling of your personal data, please contact our data compliance team:

We will acknowledge your request promptly and respond within the period required by applicable law — ordinarily 30 days, subject to extension where permitted.