Privacy Policy

Effective October 2026

1. Introduction

Welcome to aliciaavsaroglu.com (the "Website").

Your privacy is important to us. This Privacy Policy explains how Alicia Avsaroglu ("we", "us", or "our") collects, uses, processes, stores and protects personal information when you visit our Website, contact us, enquire about our services or engage with us professionally.

We are committed to handling personal information responsibly and transparently, in accordance with applicable data protection legislation, including, where applicable:

  • The European Union General Data Protection Regulation (EU GDPR).

  • The United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

  • Türkiye's Personal Data Protection Law No. 6698 (KVKK).

  • The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

  • Other applicable United States state consumer privacy legislation.

The rights and obligations described in this Policy apply to the extent required by the laws governing our activities and your personal information.

2. Data Controller

For the purposes of applicable data protection legislation, the party responsible for determining how and why personal information is processed is:

Data Controller: AVS Advisory
Website: https://aliciaavsaroglu.com
Business Address: Kalamis Marine, Istanbul, Turkiye
Privacy Contact: privacy@avsadvisory.com

Where legally required, details of an appointed data protection representative will be provided here.

3. Information We Collect

Depending on how you interact with our Website and services, we may collect the following categories of personal information.

Information you provide directly:

  • Full name and professional title.

  • Email address and telephone number.

  • Company name and business information.

  • Information submitted through contact or enquiry forms.

  • Meeting requests and correspondence.

  • Information voluntarily shared during consultations or professional engagements.

  • Billing and contractual information where applicable.

Information collected automatically:

Depending on the technologies enabled on our Website, this may include:

  • IP address.

  • Browser type and device information.

  • Operating system.

  • Website usage and navigation information.

  • Referral sources.

  • Cookie identifiers.

  • Approximate geographic location derived from technical information.

Information from third parties:

Where relevant, we may receive professional contact information through referrals, professional networking platforms, publicly available business sources or service providers.

Where required, we will inform individuals when their personal information has been obtained indirectly.

We ask that you do not submit sensitive personal information through general Website enquiry forms unless specifically requested and an appropriate lawful basis and safeguards have been established.

4. How We Use Your Information

We process personal information only for specified, legitimate purposes, including:

  1. Responding to enquiries and communicating with prospective clients.

  2. Providing consultancy, advisory and professional services.

  3. Arranging consultations, meetings and appointments.

  4. Preparing proposals, agreements and commercial documentation.

  5. Managing professional and contractual relationships.

  6. Maintaining the security, functionality and performance of our Website.

  7. Understanding Website usage and improving visitor experience.

  8. Sending professional updates or marketing communications where permitted by law.

  9. Complying with applicable legal, accounting and regulatory obligations.

  10. Establishing, exercising or defending legal claims.

We will not use personal information for materially incompatible purposes without providing any additional notice or obtaining consent where required.

5. Legal Basis for Processing

Where the GDPR or equivalent legislation applies, we rely on one or more of the following lawful bases:

Processing activity - Legal basis

Responding to enquiries - Legitimate interests or steps taken before entering a contract

Providing contracted services - Performance of a contract

Managing client relationships - Contractual necessity or legitimate interests

Maintaining Website security - Legitimate interests

Non-essential analytics and cookies - Consent where required

Optional marketing communications - Consent or another basis permitted by applicable law

Accounting and statutory records - Legal obligation

Establishing or defending legal claims - Legitimate interests or other applicable legal grounds

Our legitimate interests include operating and protecting our business, responding to professional enquiries, maintaining business relationships and improving our services, provided these interests are not overridden by individuals' rights and freedoms.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

For processing governed by Türkiye's KVKK, we rely on the applicable processing conditions under Articles 5 and, where relevant, 6 of Law No. 6698. GDPR lawful bases are not automatically treated as interchangeable with KVKK processing conditions.

6. Cookies and Tracking Technologies

Our Website may use cookies and similar technologies to support its operation and, where enabled, measure Website performance.

These technologies may include:

  • Strictly necessary cookies required for core Website functionality.

  • Preference cookies that remember visitor settings.

  • Analytics cookies that help us understand Website performance.

  • Marketing cookies, where such functionality is implemented.

Where legally required, non-essential cookies and tracking technologies will only be activated after you provide valid consent.

You may withdraw or modify your consent through the Website's cookie preference mechanism, where available.

You can also manage cookies through your browser settings.

Additional information about the cookies actually deployed, their providers, purposes and retention periods should be made available through our Cookie Policy or cookie preference interface.

7. Sharing Personal Information

We may disclose personal information to trusted third parties where reasonably necessary for the purposes described in this Policy.

Depending on our business operations, these may include:

  • Website hosting and infrastructure providers.

  • Business email and communication platforms.

  • Scheduling and appointment-management providers.

  • Cloud storage and document-management services.

  • Professional advisers, including legal and accounting professionals.

  • Website analytics providers, where enabled.

  • Contractors or service providers assisting with authorised business activities.

  • Regulatory authorities where disclosure is legally required.

Where third parties process personal information on our behalf, we require appropriate contractual, confidentiality and security safeguards as required by applicable law.

We do not disclose personal information to unrelated third parties for their independent marketing purposes without an appropriate lawful basis.

Any sale or sharing of personal information, as defined by applicable US privacy legislation, must be separately disclosed and accompanied by the legally required opt-out mechanisms.

8. International Data Transfers

As our Website may be accessible internationally, personal information may be processed in countries outside your country of residence.

Where personal information is transferred internationally, we will implement the safeguards required by applicable legislation.

These may include:

  • European Commission adequacy decisions.

  • Applicable Standard Contractual Clauses.

  • The UK International Data Transfer Agreement or UK Addendum.

  • Appropriate contractual, organisational and technical safeguards.

  • Transfer mechanisms recognised under Türkiye's KVKK, including applicable adequacy decisions or approved standard contracts, where required.

International transfers will be assessed according to the requirements of the jurisdiction from which the personal information originates.

You may contact us for further information about applicable transfer safeguards and how to obtain a copy where legally available.

9. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including applicable legal, accounting, contractual and regulatory requirements.

Retention periods are determined by considering:

  • The nature and sensitivity of the information.

  • The purpose for which it was collected.

  • Whether an ongoing professional relationship exists.

  • Applicable statutory retention requirements.

  • Potential legal claims.

  • The availability of less intrusive alternatives.

When personal information is no longer required, we will securely delete, destroy or anonymise it, subject to applicable legal obligations.

10. Information Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.

Such measures are selected according to the nature of the information, processing activities and associated risks.

No internet-based transmission or electronic storage system can be guaranteed to be completely secure.

Where a personal data breach occurs, we will assess the incident and notify affected individuals and relevant supervisory authorities when required by applicable law.

11. Your Privacy Rights

Depending on your location and the legislation applicable to our processing activities, you may have the right to:

  • Request access to personal information held about you.

  • Request correction of inaccurate or incomplete information.

  • Request deletion of personal information.

  • Request restriction of certain processing activities.

  • Object to processing based on legitimate interests.

  • Withdraw previously provided consent.

  • Request portability of eligible personal information.

  • Object to or opt out of certain direct marketing activities.

  • Exercise applicable rights relating to automated decision-making and profiling.

  • Submit a complaint to an appropriate data protection authority.

These rights are subject to applicable legal conditions and exemptions.

To submit a privacy-related request, contact:

privacy@avsadvisory.com

We may request information reasonably necessary to verify your identity before responding.

We will respond within the period required by applicable legislation.

12. Additional Rights for European Union and UK Residents

Where the EU GDPR or UK GDPR applies, you may exercise your rights under the relevant data protection framework.

You also have the right to lodge a complaint with the competent supervisory authority in your jurisdiction.

Where consent is the legal basis for processing, withdrawing consent will not affect processing lawfully undertaken before that withdrawal.

We will respond to eligible requests without undue delay and generally within one month, subject to lawful extensions.

Where legally required, details of our appointed EU or UK representative will be provided in this Policy.

13. Additional Rights for Residents of Türkiye

In accordance with Article 11 of Türkiye's Personal Data Protection Law No. 6698 (KVKK), eligible individuals have the right to:

  1. Learn whether their personal data is being processed.

  2. Request information concerning the processing of their personal data.

  3. Learn the purpose of processing and whether their data is used in accordance with that purpose.

  4. Know the third parties to whom their personal data is transferred domestically or internationally.

  5. Request correction of incomplete or inaccurate personal data.

  6. Request deletion or destruction of personal data where the applicable legal conditions are satisfied.

  7. Request notification of correction, deletion or destruction to relevant third parties.

  8. Object to results arising against them through analysis conducted exclusively by automated systems.

  9. Request compensation for damages arising from unlawful processing of personal data.

Requests may be submitted to the Data Controller using the methods prescribed under applicable KVKK legislation.

We will respond within the legally prescribed period, which is generally no later than 30 days.

Individuals may also have the right to submit a complaint to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), subject to applicable procedural requirements.

Authority website: https://www.kvkk.gov.tr

A separate KVKK-specific clarification notice (Aydınlatma Metni) will be provided at relevant collection points where required.

14. Additional Rights for United States Residents

Residents of certain US states, including California, Colorado, Connecticut, Virginia and other states with applicable comprehensive privacy legislation, may have additional rights.

Subject to the relevant law and its applicability to our business, these may include:

  • The right to know or confirm whether personal information is being processed.

  • The right to access personal information.

  • The right to request deletion.

  • The right to correct inaccuracies.

  • The right to obtain a portable copy of eligible information.

  • The right to opt out of qualifying targeted advertising.

  • The right to opt out of the sale of personal information.

  • The right to opt out of certain profiling activities.

  • The right to limit certain uses of sensitive personal information.

  • The right to appeal a denied privacy request, where applicable.

  • The right not to be unlawfully discriminated against for exercising privacy rights.

Where applicable law requires us to recognise browser-based opt-out preference signals, including Global Privacy Control, we will honour those signals in accordance with that law.

California-specific disclosures

Where the CCPA applies to our business, California residents may request information about the categories and specific pieces of personal information collected, the purposes of collection, sources of information and categories of recipients.

The personal information categories described in Section 3 may include identifiers, internet or electronic network activity information, professional or employment-related information, commercial information and other information provided in the course of an enquiry or business relationship.

Our California disclosures must reflect our actual collection, disclosure, sale and sharing practices during the preceding 12 months.

Where required, we will provide an appropriate Notice at Collection and any applicable opt-out mechanisms.

To exercise applicable US privacy rights, please contact:

privacy@avsadvisory.com

Where an applicable state law provides an appeal mechanism, you may request an appeal by replying to our decision and identifying your request as a privacy appeal.

15. Marketing Communications

We may occasionally communicate with individuals regarding our services, professional activities or relevant business updates where permitted by applicable law.

Where consent is legally required, marketing communications will only be sent after obtaining that consent.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided or by contacting us directly.

Withdrawing consent to marketing will not prevent us from sending necessary service-related or contractual communications.

16. Third-Party Websites

Our Website may contain links to third-party websites, platforms or services.

We are not responsible for the privacy practices or content of independently operated third-party websites.

We encourage visitors to review the privacy notices of external services before providing personal information.

17. Children's Privacy

Our Website and professional services are intended for adults and business professionals.

We do not knowingly solicit personal information from children or intentionally direct our services towards them.

If we become aware that we have collected a child's personal information without the legally required authorisation, we will take appropriate steps to delete it or otherwise comply with applicable law.

Parents or legal guardians who believe a child has provided personal information may contact us using the details provided in this Policy.

18. Automated Decision-Making

Where we use automated tools in connection with our business activities, we will assess whether their use triggers additional transparency, consent or individual-rights requirements.

We will provide any additional disclosures required by applicable law before implementing solely automated decisions that produce legal or similarly significant effects on individuals.

19. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, data processing practices, technology or applicable legislation.

Any revised version will be published on this page with an updated effective date.

Where changes materially affect how personal information is processed, we will provide additional notification or obtain consent where legally required.

20. Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights or have concerns regarding the handling of your personal information, please contact:

Alicia Avsaroglu
Website: https://aliciaavsaroglu.com
Email: privacy@avsadvisory.com
Business Address: Kalamis Marine, Istanbul, Turkiye

We are committed to addressing legitimate privacy enquiries transparently and in accordance with applicable data protection legislation.

© 2026 Alicia Avsaroglu. All rights reserved.