Privacy Policy (KVKK and GDPR)

This notice explains how Gordion Partners Organizasyon Danışmanlık Limited Şirketi ("Golden Visa Partners") ("Golden Visa Partners", "we") processes personal data as the data controller under the Turkish Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKK") and, where it applies, the EU General Data Protection Regulation 2016/679 ("GDPR"). It is our information notice under KVKK art. 10 and GDPR art. 13.

Golden Visa Partners is an Istanbul-based advisory that helps private clients with citizenship by investment, residence by investment (golden visas), digital nomad and retirement visas, and property investment in Türkiye and abroad. Gordion Partners does not provide real estate brokerage: where a client needs it in Türkiye, it is provided by our founder Burak Ünal, a registered real estate broker, through his own brokerage, and abroad by licensed brokers in the country concerned.

Golden Visa Partners is the brand Gordion Partners Organizasyon Danışmanlık Limited Şirketi uses for its investment advisory services.

• Address: Merkez Mahallesi Hasat Sokak No:12A, 34384 Şişli, İstanbul, Türkiye
• MERSIS no.: 0396136152300001
• Trade registry: İstanbul Ticaret Sicili Müdürlüğü, no. 308755-5
• Email: contact@goldenvisa.com.tr
• Telephone: +90 533 140 04 96

• Identity and contact data: name, email address, telephone or WhatsApp number, nationality, country of residence.
• Enquiry data: the programme or country you ask about, preferences such as budget and timing, the content of your message, the page and language from which you wrote; the results of the eligibility quiz or cost calculator if you send them to us.
• Client data (only if you become a client, and only as far as the application requires): passport, identity, birth and marriage documents; address; education and employment details; details of the spouse, children and parents included in the application; bank, tax, company and transaction documents showing the source of funds and wealth; investment, payment and title deed details.
• Communication records: emails, WhatsApp messages, call notes and appointment records.
• Technical data: IP address, browser type, date and time of a form submission, and server and security logs kept by our hosting provider.
• Analytics data (only with your consent): pages visited, approximate location (country or city), device type and similar usage statistics collected by Google Analytics.

Investment migration applications in many countries require a police clearance certificate (criminal record), a medical certificate or health insurance, and biometric data (photographs, fingerprints) taken by the authorities. These are special categories of personal data under KVKK art. 6 (and GDPR arts. 9 and 10).

We do not ask for them through the forms on this website; please do not send them that way. If you become a client, we process them only as far as the application you instruct us to make requires, as a rule on the basis of your explicit consent obtained separately when the service contract is signed (KVKK art. 6(3)(a)), or where a law expressly provides for it or it is necessary to establish, exercise or protect a right (art. 6(3)(b) and (e)), with the adequate measures set by the Personal Data Protection Board. Biometric data is collected directly by the authorities handling the application or their appointed centres.

• To answer your enquiry, assess which programmes suit you and give you information before a contract: necessary for entering into or performing a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
• To perform our advisory services: preparing the application file, translating and legalising documents, coordinating the investment, filing the application with the competent authorities and following it up (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
• To meet our legal obligations: commercial and tax record keeping, identification and record-keeping duties under anti-money-laundering legislation where applicable, and requests from public authorities (KVKK art. 5(2)(ç); GDPR art. 6(1)(c)).
• To establish, exercise or defend legal claims (KVKK art. 5(2)(e); GDPR art. 6(1)(f)).
• To keep the website and our systems secure and prevent misuse of the form: our legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f); GDPR art. 6(1)(f)).
• To measure how the website is used (analytics cookies): your explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). You can withdraw it at any time through "Cookie Settings" at the bottom of every page.
• To send commercial electronic messages (newsletters, updates): only with your prior consent under Turkish Law No. 6563 on the Regulation of Electronic Commerce (KVKK art. 5(1); GDPR art. 6(1)(a)). You can opt out at any time, free of charge, through the link in the message or by writing to us.

Providing personal data is voluntary, but without contact data we cannot answer your enquiry, and without the documents an application requires we cannot provide that service. We do not take decisions based solely on automated processing that significantly affect you, and we do not sell personal data. The eligibility quiz and the cost calculator are information tools that run in your browser.

We collect personal data by partly automated and non-automated means: directly from you when you fill in the contact form, email or message us on WhatsApp, call or meet us, or send us documents; from parties involved in your application where the service requires it (for example authorities, property developers or banks); and when you browse the website, through cookies and server logs (see the Cookie Policy). We process it on the legal bases listed in section 4.

Under KVKK arts. 8 and 9 we share personal data only as far as needed for the purposes in section 4, with:

• Hosting and form emails: Amazon Web Services, as our data processor. The website is hosted in the AWS Frankfurt (Germany) region, and form messages reach us through Amazon Simple Email Service.
• Email and productivity tools: email service providers (for example Google) and similar business tools acting on our instructions.
• Analytics: Google (Google Analytics 4), only if you accept analytics cookies.
• Messaging: WhatsApp (Meta), only when you choose to contact us on WhatsApp; WhatsApp's own terms apply to that service.
• Authorities handling your application: citizenship and residence by investment units, immigration services, consulates, land registries and, in Türkiye, bodies such as the General Directorate of Population and Citizenship Affairs and the Presidency of Migration Management.
• Partners an application requires, with your knowledge: authorised or licensed agents required by a programme, lawyers, notaries, sworn translators and apostille services, due diligence firms, property developers and sellers, real estate brokers (including our founder Burak Ünal's brokerage when you ask for brokerage in Türkiye), escrow agents, banks and payment institutions, investment fund managers, valuation firms and insurers.
• Our accountants and legal advisers, who are bound by confidentiality, to meet legal obligations and handle legal claims.
• Public authorities and courts when the law requires it.

Our service involves international transfers by its nature: your application is sent to the authorities of the country you instruct us to apply to, and to our partners there. In addition, the website and form emails are processed in the AWS Germany region, Google may process analytics data in other countries including the United States, and WhatsApp messages are processed on Meta's infrastructure.

We transfer personal data abroad only in line with KVKK art. 9 as amended by Law No. 7499 (in force since 1 June 2024): on the basis of an adequacy decision of the Personal Data Protection Board where one exists for the country concerned; otherwise on appropriate safeguards, in particular the standard contract published by the Board and notified to the Personal Data Protection Authority within five business days of signature; or, for occasional transfers, on one of the exceptions in art. 9(6), in particular where the transfer is necessary for the performance of our contract with you (art. 9(6)(b)) or, with your explicit consent after you have been informed of the possible risks (art. 9(6)(a)).

If the GDPR applies to you: data you send us from the European Economic Area is received by us in Türkiye, which does not have an EU adequacy decision, and is used to provide the service you request (GDPR art. 49(1)(b)). Where our service providers process data outside the EEA, they rely on safeguards such as the EU Standard Contractual Clauses.

• Enquiries that do not lead to a client relationship: up to 2 years after our last contact.
• Client files, contracts and commercial records: for the duration of the relationship and then for the statutory retention and limitation periods, generally 10 years (art. 82 of the Turkish Commercial Code No. 6102; art. 146 of the Turkish Code of Obligations No. 6098).
• Special categories of data: after the application is decided, only for as long as a legal obligation or a possible dispute requires.
• Records of consent to commercial electronic messages: while the consent is valid and for 3 years after it ends.
• Server and security logs: a short period (our hosting logs are deleted automatically after 14 days), longer only if needed to investigate a specific incident.
• Analytics data: according to the retention setting in Google Analytics, at most 14 months.

When a period ends, or the reason for processing no longer exists, the data is deleted, destroyed or anonymised in line with KVKK art. 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

Under KVKK art. 11 you have the right to learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under KVKK art. 7; request that third parties to whom the data was transferred are notified of a correction or deletion; object to a result against you that arises solely from analysis by automated systems; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection (GDPR arts. 15 to 21), the right to withdraw consent at any time without affecting the lawfulness of earlier processing, and the right to lodge a complaint with a supervisory authority.

In line with KVKK art. 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request:

• in writing, with your wet signature, to Merkez Mahallesi Hasat Sokak No:12A, 34384 Şişli, İstanbul, Türkiye, in person or through a notary;
• by registered electronic mail (KEP), or with a secure electronic signature or mobile signature;
• by email to contact@goldenvisa.com.tr from an email address you have previously notified to us and that is in our records.

Please include your name and surname, your signature for written requests, for Turkish citizens your T.R. identity number and for foreign nationals your nationality and passport or identity number, your address for notification, your email address and telephone number if any, and the subject of your request. We may ask for additional information to verify your identity.

We answer as soon as possible and at the latest within 30 days, free of charge; if the action requires an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your request is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) within 30 days of learning of our answer, and in any case within 60 days of your application (KVKK art. 14). If the GDPR applies to you, you may also complain to the supervisory authority of the EEA country where you live or work or where the alleged infringement took place.

Under KVKK art. 12 we take technical and administrative measures to protect personal data, including encrypted connections (HTTPS), access authorisation, spam protection on the form, limited retention and confidentiality obligations. No transmission over the internet is completely secure; if personal data is obtained by others unlawfully, we notify the persons concerned and the Board as the law requires.

This website is not directed at children under 18, and we do not knowingly collect their data through it. Data of children included in a family application is processed only as provided by their parent or legal guardian and only for that application.

We may update this notice when our services or the law change. The date of the latest version is shown at the top of this page. This version is effective from 19 October 2026.