Last Updated: April 2026
1. Purpose and Scope
This Privacy Policy has been prepared by Joseph Mews, acting in the capacity of data controller, in accordance with the Personal Data Protection Law No. 6698 (“PDPL”) and the General Data Protection Regulation of the European Union (“GDPR”, Regulation (EU) 2016/679), together with all other applicable data protection legislation currently in force.[OK1]
This Policy has been drawn up for the purpose of setting out the legal basis upon which, and the purposes and methods by which, the personal data of natural persons who visit this website, complete contact forms, or submit any request through the website are processed; identifying the parties with whom such data may be shared; specifying the periods for which such data will be retained; and informing data subjects of the rights afforded to them under applicable legislation.
Your continued use of this website shall constitute acknowledgement that you have read and understood the terms set out in this Privacy Policy. Any amendments made to this Policy shall enter into force on the date on which they are published on this page.
2. Identity and Contact Details of the Data Controller
Pursuant to Article 4 of the GDPR and Article 3 of the PDPL, the data controller is the natural or legal person who determines the purposes and means of processing personal data. The data controller within the scope of this Policy is identified as follows:
Data Controller: Joseph Mews Address: [To be provided by +971 50 694 7442] E-mail: marketing@joseph-mews.com Telephone: [Tuna Başara’s TR number]
For any questions, requests or complaints relating to the processing of your personal data, you may contact us through the channels set out above.
3. Categories of Personal Data Processed and Methods of Collection
Your personal data is collected and processed, through both automated and non-automated means, under the following categories:
a) Data Provided Directly by You
Data communicated to us through the website’s contact form, subscription form or similar interaction tools, including:
- Identity data: First name, surname
- Contact data: E-mail address, telephone number
- Message content: Free-text information submitted to us
b) Data Collected Automatically
Data processed automatically through technical systems when you visit our website, including:
- Network and connection data: IP address, internet service provider
- Device and software data: Browser type and version, operating system, screen resolution
- Behavioural data: Pages visited, time spent on the website, click and navigation patterns, referrer URL
c) Data Collected via Cookies
Usage and behavioural data processed through session cookies, preference cookies and analytical cookies, within the scope of our Cookie Policy.
4. Purposes of Processing Personal Data
The personal data collected is processed solely for the following purposes:
- Receiving, evaluating and concluding communications, requests and complaints submitted by you
- Ensuring the technical operation of the website, protecting its security and preventing unauthorised access
- Measuring site performance, analysing and improving the user experience
- Conducting statistical analysis and reporting activities
- Fulfilling obligations arising from applicable legislation currently in force
- Providing information and documents in response to requests from competent public authorities and institutions
5. Legal Bases for the Processing of Personal Data
Your personal data is processed pursuant to the following legal bases under Article 6 of the GDPR and Article 5 of the PDPL:
- Explicit Consent (GDPR Article 6(1)(a); PDPL Article 5(1)): Processing activities such as the use of non-essential cookies and marketing communications are based on your explicit consent. You retain the right to withdraw your consent at any time.
- Performance of a Contract (GDPR Article 6(1)(b); PDPL Article 5(2)(c)): Processing activities necessary for contacting you further to your request or for the provision of services are carried out under this legal basis.
- Compliance with a Legal Obligation (GDPR Article 6(1)(c); PDPL Article 5(2)(ç)): Data processed for the purpose of fulfilling legal obligations to which we are subject in our capacity as data controller falls within the scope of this legal basis.
- Legitimate Interests (GDPR Article 6(1)(f); PDPL Article 5(2)(f)): This legal basis is relied upon for purposes such as ensuring site security, preventing fraud and operating the technical infrastructure, in circumstances where it has been assessed that your fundamental rights and freedoms will not be adversely affected.
6. Transfer of Personal Data
Your personal data shall not be shared with, sold to or rented to third parties, save for the exceptions set out below:
- Service Providers: Data may be shared, to the extent strictly necessary for the performance of the relevant service, with third-party providers who supply technical services such as website hosting, e-mail infrastructure and analytical services, and with whom a Data Processing Agreement has been executed.
- Legal Obligation: Relevant data may be disclosed to competent judicial authorities, public prosecutors’ offices, and regulatory and supervisory bodies and institutions where there is a legal basis for such a request.
- International Transfers: Where the transfer of your personal data outside the European Economic Area (“EEA”) or Turkey is in question, such transfer shall only be carried out provided that appropriate safeguards under Article 46 of the GDPR and Article 9 of the PDPL are in place — namely, Standard Contractual Clauses approved by the European Commission or adequate protection conditions determined by the Personal Data Protection Board.
7. Retention Periods for Personal Data
Your personal data shall be retained for the period required by the purpose of processing and, in any event, without exceeding the maximum periods prescribed by applicable legislation; upon expiry of such periods, it shall be irreversibly deleted, destroyed or anonymised.
| Category of Data | Retention Period |
| Contact form data | 2 years from the date of last communication |
| Technical logs and access records | 90 days |
| Cookie data | Until end of session or 1 year, depending on cookie type |
| Data subject to a legal obligation | For the period prescribed by applicable legislation |
8. Rights of Data Subjects
Pursuant to Articles 15–22 of the GDPR and Article 11 of the PDPL, you hold the following rights in respect of your personal data:
- Right of Access: The right to request information regarding whether your personal data is being processed and to obtain a copy thereof.
- Right to Rectification: The right to request the immediate correction of any data that is inaccurate, incomplete or no longer up to date.
- Right to Erasure (“Right to be Forgotten”): The right to request the deletion of your personal data where certain conditions are met.
- Right to Restriction of Processing: The right to request that the processing of your personal data be suspended in certain circumstances.
- Right to Data Portability: The right to receive the data you have provided in a structured, commonly used and machine-readable format, and to request that it be transmitted to another data controller.
- Right to Object: The right to object, on grounds relating to your particular situation, to processing activities based on legitimate interests.
- Right to Object to Automated Decision-Making: The right to request human intervention in respect of decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
- Right to Withdraw Consent: The right to withdraw, at any time and without retroactive effect, the consent you have given in respect of any processing activity based on consent.
To exercise your rights, you may submit a written application to us at marketing@joseph-mews.com. Your applications will be responded to within the legal time limits and, in any event, within 30 days.
9. Right to Lodge a Complaint with a Supervisory Authority
Should you consider that the processing of your personal data is not in compliance with applicable legislation, you retain the right to lodge a complaint with the following competent authorities:
- For users in Turkey: Personal Data Protection Authority (KVKK) — kvkk.gov.tr
- For users in the EU/EEA: The competent data protection authority in the country in which you reside or work — edpb.europa.eu
10. Policy Amendments
This Privacy Policy may be updated in line with changes to our data processing activities, applicable legislation or business processes. Material changes will be notified through this page within a reasonable period prior to the date on which they enter into force and, where appropriate, by e-mail. The current version of the Policy is published on this page at all times and may be monitored by reference to the “Last Updated” date.
[OK1]Since the domain transfer process is uncertain, the Data Controller designation in this section should be written according to your business risk assessment! As of April 17, 2026, the domain owner is the Data Controller.
