Documents you can hand to a customer, an auditor or your own lawyer. Written from what you actually do — we look at the systems, not at a template — and kept short enough that people read them.
Who it is for
Asked for documents
A customer or a tender wants proof of how you handle their data.
Waiting for an audit
You would rather prepare than explain afterwards.
Using AI without rules
Staff already use public AI tools. It needs a policy, not a ban.
What you get
- A record of processing activities, written for your actual systems
- Technical and organisational measures (TOM) in plain language
- Processor agreements (AVV / DPA) with the providers you actually use
- A deletion and retention concept, per data type and per system
- An AI policy for staff: what may be entered where, and what never may
- An employee briefing session and an annual review
How it works
Inventory
Systems, data types, recipients and retention periods.
Documents
Drafted in your language, with gaps only where the decision is genuinely yours.
Implementation
Forms, briefings and the rules that make the documents true in daily work.
Annual review
Once a year we check whether reality has drifted away from the paperwork.
Questions
No — we are not lawyers and we say so. We prepare the technical and organisational groundwork so that your lawyer or data protection officer reviews a finished document instead of an empty one. That is faster and cheaper for you. Whichever applies to you: GDPR, the Turkish KVKK, or both. The documents are structured so that the same reality satisfies either. At least annually, and whenever you add a system or a processor. The annual update is included in the price above.Is this legal advice?
Which framework do you work to?
How often must this be updated?
Get the paperwork ready
Documents written from your real systems, not from a template.