Confidentiality and data protection

Which laws apply to us

Hacettepe Translation is a company established in Ankara. Because we offer services to people in the UK, the UK GDPR applies to our processing of their personal data under Article 3(2), in addition to Türkiye's Personal Data Protection Law (KVKK, Law 6698) which applies to us at home. Where the UK GDPR requires a controller outside the UK to designate a representative in the UK under Article 27, the representative's details are published on our company information page. You send your documents to us directly, so there is no UK organisation transferring your data abroad; you are dealing with the Turkish controller from the start, and this page and our privacy notice are the Article 13 information you are entitled to.

Who sees your documents

• The project manager who receives your order and prepares the quote.
• The translator assigned to it.
• The reviser who checks it.
• For notarised translations, the Turkish notary, who by law sees the document being certified.
• Nobody else. We do not share documents with marketing partners, and we do not use them as samples or training material.

Translators and revisers work under written confidentiality obligations. Documents containing special-category data (health, criminal records, religion, ethnicity, which appears on some older Turkish records) are assigned to a smaller pool of staff and are not sent to freelance translators without a specific confidentiality agreement.

Where your documents are stored

On our own systems in Ankara, encrypted at rest, with access logged. Files sent by e-mail or WhatsApp are moved to those systems and the working copies are deleted from mailboxes on a schedule. Nothing is uploaded to public machine-translation or AI services. Where we use machine translation at all (our post-editing service, for large non-certified texts, at the client's request) it runs on tools whose terms exclude training on the input, and never on certified personal documents.

How long we keep them

For a limited period after delivery, stated in the privacy notice, so that we can re-send a PDF, re-certify a translation, or answer a caseworker's verification query. Invoices and order records are kept as long as Turkish tax and commercial law require. At any time you can ask us to delete your source documents and translations early; we confirm deletion in writing. The only exception is data we must keep by law, which is the accounting record, not the documents themselves.

Your rights

Under UK GDPR and KVKK you can ask what we hold about you, obtain a copy, have it corrected or deleted, and object to processing. Write to the address on the contact page; we respond within the one-month period the UK GDPR sets. If you are not satisfied you can complain to the UK Information Commissioner's Office or to Türkiye's Personal Data Protection Authority (KVKK Kurumu).

Practical confidentiality

• We do not contact the issuing authority or the receiving body about your document unless you ask us to (for example, to answer a caseworker's verification query).
• We do not discuss your order with anyone else who calls, including family members, without your authority.
• Verification queries from a receiving body are answered by confirming that we issued the translation and the date; we do not send them a copy of your document.
• Business clients can have a non-disclosure agreement signed before sending anything. See also confidentiality and GDPR FAQs.

Cookies and the website

The website itself follows the UK's PECR cookie rules: analytics is opt-out, advertising is opt-in, and the upload form sends files over an encrypted connection. Details are on the cookies page.