Last updated: 13 August 2026
This “Privacy Policy” addresses any processing of personal data by Saga International B.V.("Saga", “us”or “we”) when you access Saga’s platforms, products, services, technologies, and websites (“Platform Services”), or social media, and portals. Saga processes personal data both as a data controller and as a dataprocessor. This Privacy Policy applies when we are the data controller and determine the purpose of the processing. When we act as the data processor, the relevant Service Agreement and Data Processing Agreement apply between Saga and its customers.
Depending on your country of residence, you may have rights to request information from us including how we share certain categories of your information with third parties. Appendix 1 includes country specific rights that may apply to the process of your personal data.
Individuals located in Türkiye should also refer to Appendix 1 (KVKK Information Notice – Aydınlatma Metni), which forms an integral part of this Privacy Policy and contains additional information required under the Turkish Personal Data Protection Law No. 6698 ("KVKK").
Saga processes personal data related to the following data subjects:
We have listed the typical purposes for our processing of personal data, the categories of personal datawe typically process, and the legal bases for the processing below
When contacting a potential customer or onboarding acustomer, we will register the contact person’s details in our systems. Weprimarily gather the name, telephone number, and email address. The basis forthis processing is outlined in Article 6(1)(b) GDPR to take steps prior toentering into a direct contract with you or in balancing the interests asoutlined in Article 6 (1)(f) GDPR, where our interest lies in entering into anagreement with our customer (if applicable, this is your employer), following upon this agreement, invoicing, and communicating with our customer.
We process personal data about our contacts at suppliers and partners to manage the contracts and relationships with these entities. We mainly process the names, phone numbers, and email addresses of contact persons at each party. The basis for this processing is outlined in Article 6 (1) (f) GDPR, where our legitimate interest is in fulfilling our agreements and managing our relationships with suppliers and partners.
When you use our platform, we collect and process certain personal data to provide our services. To access our services, you will need an account. When you or your employer creates your user account, we process personal data such as your name, email address, mobile phone number, role, language preferences, and account credentials. If you are entering into the contract directly with us, then the basis for this processing is to fulfil this contract, in accordance with Article 6(1)(b) GDPR. If your employer has entered into the contract with us, then the basis for this processing is in accordance with documented instructions as part of the data processing agreement, in accordance with Article 28 GDPR.
As you visit, use, and interact with our services, we automatically collect certain technical information about your activities, which are functionally necessary and help secure our Platform Services. Each time you visit our online services, for example, your browser automatically sends us information like your IP address, browser type and settings, the date and time of your request, information about the device you're using to access our online services, the operating system, browser, referring pages, exit pages, and time stamps. The basis for this processing is outlined in Article 6 (1) (f) GDPR, where our legitimate interests are providing our website and in ensuring the security of our Platform Services against fraud or other misuse.
Additionally, we process how you use and interact with our Platform Services to improve our offerings and your experience. The specific information collected can vary depending on your device type and its settings. We process data such as the features you use, actions you take, your time zone, location, dates and times of access, the amount of time spent within the services, the types and volumes of queries you submit. The basis for this processing is outlined in Article 6(1)(f) GDPR, where our legitimate interest is improving the product or service to make it more efficient and more attractive.
We use various types of cookies and other similar technologies to ensure our Platform Services function effectively and to enhance the user experience.
We never process any data you upload, download, or otherwise process in the Platform Services beyond what is necessary to provide you with the service itself. These data types are not used for analytical or marketing purposes.
Our website offers information as an overview of our service offerings. We use various types of cookies and other similar technologies to ensure our website functions effectively and to enhance the user experience.
Essential cookies are strictly necessary for our website, enabling core functionalities such as page navigation and access to secure areas. Without these cookies, our website cannot function properly. The basis for this processing is outlined in Article 6(1)(f) GDPR, where our legitimate interest is providing our website in a secure and reliable manner; and in accordance with Article 5(3) ePrivacy Directive and subsequent domestic legislation as it is strictly necessary to provide the service explicitly requested by you as the user.
Analytics cookies are for us to collect information about how visitors use our website, such as which pages are visited, for how long, and what features they interact with. This data helps us understand our website performance, identify areas for improvement, and optimize your experience. The basis for this processing is your consent in accordance with Article 6(1)(a) GDPR.
You can find more information, manage your cookie preferences, and withdraw your consent through our cookie banner or your browser settings. Please be aware that if you block cookies, there may be functions and services that depend on cookies that you will no longer be able to use.
We organize a variety of seminars, courses, and other events for our clients, partners, students, and other interested individuals. In connection with these events, we collect and process personal data about participants, typically including their name, email address, telephone number, any disclosed food allergies or other preferences, and details such as the company they work for.
This personal data is processed primarily to manage event registrations effectively and, where appropriate, to accommodate any specific dietary requirements or other preferences participants may have, ensuring a smooth and tailored experience. Should you choose not to provide the requested personal data, we may unfortunately be unable to process your event registration.
Some events are recorded where the presenter’s image and audio will be captured. If you are an attendee, your name, image or audio may be captured during the session, for example depending on if you put your camera on and unmute yourself. We will inform you in advance about recording.
Our processing of this data is necessary for the performance of a contract with the participant, in accordance with Article 6(1)(b) GDPR and based on a balancing of interests, in accordance with Article 6(1)(f) GDPR, where our legitimate interest lies in being able to provide you and other interested parties with the recording of the event. When we process sensitive information, such as health data pertaining to food allergies, we will explicitly obtain your consent for this specific purpose, aligning with the requirements of Article 9(2)(a) GDPR.
When you submit a job application to us, we processpersonal data to evaluate your suitability for a potential position ortraineeship. The personal data processed for this purpose typically includesyour CV, diplomas, application texts, certificates, and any references youprovide, along with any other information you choose to submit within yourapplication. The inability to provide such personal data would prevent us fromassessing your application. This processing is based on Article 6(1)(b) GDPR, asit is necessary to take steps at your request with a view to entering into anemployment contract. The personal data is primarily obtained directly from you,the applicant, and from any references you have provided.
We may also receive personal data about potentialcandidates from individuals in their professional or personal network who referthem to Saga for a specific role. This information may include the candidate'sname, contact details, professional information, CV and other informationprovided as part of the referral.
We process this information for the purpose ofcontacting and considering referred candidates for the relevant role. The legalbasis for this processing is our legitimate interest under Article 6(1)(f) GDPRin identifying, contacting and recruiting suitable candidates for employmentopportunities.
Where a referred candidate chooses to be consideredfor future opportunities at Saga, we may retain and use their personal data forthis purpose for up to 6 months on the basis of their consent under Article6(1)(a) GDPR. Providing this consent is optional and does not affectconsideration for the role for which the candidate was originally referred.Consent may be withdrawn at any time by contacting us at privacy@sagalegal.io or through any withdrawal mechanismmade available to the candidate
We also receive requests from students, representatives of businesses, public authorities, or private individuals through various channels such as email or telephone. In handling these requests, we may process personal data including your name, telephone number, email address, the subject matter of your request, and any other information you provide in connection with it. Typically, the consequence of not providing such personal data is that we will be unable to process and respond to your request effectively. This processing is based on a balancing of interests, in accordance with Article 6(1)(f) GDPR, where our legitimate interest lies in being able to respond to and follow up on these inquiries. Should a request lead to the establishment of a client relationship or a recruitment process, the personal data will then be processed in accordance with the relevant sections of this policy as outlined above.
We distribute suggestions, event invitations, and other relevant information via email to contact persons registered in our client database and to others who have consented to receive such communications. Recipients of our optional communications can easily unsubscribe from these at any time by using the dedicated link provided within our emails. The legal basis for sending these emails to contact persons at our existing clients is our legitimate interest in maintaining and developing client relationships by providing legal news and relevant information about our services, as outlined in Article 6(1)(f) GDPR and consistent with domestic digital marketing laws. In other contexts, not involving existing client relationships, our marketing communications are based on the consent of the individual concerned, in accordance with Article 6(1)(a) GDPR and consistent with domestic laws.
We maintain pages on various social media platforms. If you "like", follow or otherwise engage with our page as a member of the social media platform, we will be jointly responsible with the social media platform provider. For this purpose we have entered into a contract with the platform provider. More information about this processing and your rights follows from the individual platform's privacy policy.
In connection with these pages, we process personal data such as your name, any comments you post, your likes, or any other information you choose to make available to us through these platforms. This processing is conducted based on a balance of interests, as per Article 6(1)(f) GDPR, where our legitimate interest is to effectively manage and utilize social media pages to readily connect with customers and other interested parties.
Our suppliers, particularly platform service providers, may process personal data if such data is stored with them or otherwise made accessible to them. These suppliers operate strictly under a data processing agreement and our direct instructions, ensuring they can only use personal data for the purposes we have defined and which are detailed within this privacy policy.
We do not disclose personal data in any other instances or through any other means beyond what is described in this privacy policy, unless the client explicitly encourages or consents to such disclosure, or if disclosure is legally mandated.
Your personal data, where we are the data controller, may also be subject to processing or storage outside the EU/EEA. In such circumstances, we ensure sufficient security safeguards in line with Chapter V GDPR, typically achieved through the EU's standard contractual clauses for data transfers or by transferring data to countries that have received an adequacy decision from the European Commission.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Upon expiry of the retention period, personal data shall be securely deleted or anonymized. This essentially means the following:
Under prevailing data protection regulations, youpossess a range of rights concerning your personal information. We haveoutlined these rights below for your understanding. Should you wish to exerciseany of these rights, please contact us.
If you have previously permitted us to send yousuggestions, invitations to events, or similar communications via email, youhave the option to revoke this consent at any time, usually by clicking theopt-out link contained within. Any other instances where you have given consentto process your personal data can also be revoked at any time with effect forthe future by contacting us directly. The revocation does not affect thelawfulness of the processing until revocation.
You are entitled to request access to the personaldata we hold about you, provided that this does not conflict with ourobligations of confidentiality or adversely affect the rights of others. Tosafeguard against unauthorized disclosure and ensure that personal data isprovided to the correct individual, it may be necessary for your identity to beverified prior to fulfilling the request.
For activities that occur based on your consent, wedelete your personal data after you withdraw your consent, unless there isanother legal basis requiring us to retain it longer.
You have the right to request that we rectify anyinaccurate personal data pertaining to you or that we erase your personal data.While we endeavor to fulfill all requests for data deletion whenever feasible,we may be unable to do so if compelling legitimate grounds exist for retainingthe data. An example of such a reason would be our legal obligation to storecertain personal data for documentary purposes. Please be aware that thedeletion of data related to the operation of our Platform Services mayconsequently impair our ability to provide those services to you.
In certain circumstances, you may request that wetemporarily suspend the processing of your personal data. This may happen ifyou claim that your personal data is inaccurate, in which case you can ask fora restriction on processing while we verify its accuracy Additionally, if theprocessing of your personal data is considered unlawful, you have the right torequest that its processing be limited instead of having the data deletedentirely. A restriction can also be requested if we no longer need your personaldata for its original purpose, or if you formally object to the processing ofyour personal data as described in the following section.
You retain the right to object to the processing ofyour personal data for direct marketing activities at any time. Additionally,you may object to the processing of your personal data that is based onlegitimate interest in accordance with Article 6 (1) (f) GDPR, especially whensuch objections are based on your specific situation. Unless we can demonstratecompelling legitimate reasons for the processing that outweigh your interests,fundamental rights, and freedoms, or if the processing is necessary for theestablishment, exercise, or defense of legal claims, we will stop processingthe personal data.
In certain situations, you may have a general right to request the transfer of your personal data to another legal entity or controller in a widely used, machine-readable format. When technically feasible, we can assist with the direct transmission of this personal data to the designated organization.
If you have any concerns or would like to file acomplaint regarding our handling of your personal data, please reach out.Alternatively, you can submit a formal complaint directly to the appropriatedata protection authority.
We have implemented a range of technical andorganizational security measures to ensure that all personal data is handled ina secure and protected manner. Our commitment involves conducting regularevaluations of the security protocols across all systems utilized for personaldata management. Furthermore, we have established contractual agreements withthe suppliers of these systems, obligating them to uphold an adequate and robust level of data security.
This privacy policy will undergo periodic revisions and updates. Where necessary, we will seek or refresh consents. The most current version of our privacy statement will always be readily accessible on our official website.
Please contact us if you have any questions or wish to exercise your rights. Our contact details are as follows:
Email: privacy@sagalegal.io
Saga International B.V.
CoC: 95742506
Prins Bernhardplein 200
1097 JB, Amsterdam
The Netherlands
Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), Saga International B.V.
("Saga", "we", "our", or "us"), acting as the data controller for the processing activities described in this
Information Notice, informs you about the processing of your personal data.
Data Controller
Saga International B.V.
Prins Bernhardplein 200
1097 JB, Amsterdam
The Netherlands
Email: privacy@sagalegal.io
Website: www.sagalegal.io
Your personal data may be processed for the following purposes:
• providing access to the Saga platform;
• user authentication and account administration;
• provision of customer support;
• maintaining the security and integrity of our systems;
• compliance with legal and regulatory obligations;
• management and performance of contractual obligations;
• improving the performance, functionality and security of our services.
Where Saga processes personal data solely on behalf of its customers, Saga acts as a data processor and
processes personal data only in accordance with the customer's documented instructions (subject to
appropriate data processing agreement).
Depending on your use of the Platform, Saga may process:
• identity information;
• contact details;
• professional information;
• organisation and account information;
• authentication data;
• uploaded documents and files;
• communications with Saga;
• system logs and security information.
Where customers upload special categories of personal data, Saga processes such information only on behalf of the customer and in accordance with applicable law.
Saga processes personal data on one or more of the legal grounds provided under Articles 5 and 6 of the KVKK, including where processing is:
• necessary for the performance or conclusion of a contract;
• required to comply with legal obligations;
• necessary for the legitimate interests of the data controller, provided that such interests do not
override the fundamental rights and freedoms of the data subject;
• based on another lawful ground recognised under the KVKK.
Saga hosts its platform using Microsoft Azure infrastructure located in the Netherlands.
Accordingly, personal data originating from Türkiye may be transferred outside Türkiye for the purposes
described in this Information Notice.
Where international transfers occur, Saga ensures that such transfers are carried out in accordance with Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and any applicable secondary legislation or decisions of the Turkish Personal Data Protection Board.
Saga uses approved service providers (sub-processors) solely for the provision, security and maintenance of its services. Information regarding these service providers is available upon request or in Saga's Data Processing Agreement.
Personal data may be transferred outside Türkiye to support the provision of Saga's services, including hosting on Microsoft Azure infrastructure located in the Netherlands. Where such transfers are subject to Article 9 KVKK, Saga ensures that the transfer is based on an applicable legal transfer mechanism recognised under Turkish law, including, where required, the execution of the applicable Turkish Standard Contract.
Your personal data may be shared, where necessary, with:
• Saga group companies;
• authorised sub-processors;
• cloud infrastructure providers (e.g. Microsoft Azure);
• identity and authentication providers (e.g. Microsoft Entra ID);
• IT service providers;
• professional advisers and auditors;
• competent public authorities where required by law.
Recipients only receive access to personal data where necessary for the purposes described above.
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, to
comply with applicable legal obligations, or as instructed by the customer where Saga acts as a processor.
Following expiry of the applicable retention period, personal data will be securely deleted, anonymised or
returned in accordance with applicable law and contractual obligations.
Individuals located in Türkiye may exercise the rights granted under Article 11 of the Turkish Personal Data
Protection Law No. 6698 ("KVKK").
Pursuant to Article 11 KVKK, you have the right to request:
• confirmation whether your personal data is being processed;
• information regarding such processing;
• the purposes of processing and whether processing is used in accordance with those purposes;
• information regarding third parties to whom personal data has been transferred;
• correction of inaccurate or incomplete personal data;
• deletion or destruction of personal data where the legal conditions are met;
• notification of corrections or deletion to third parties where applicable;
• objection to decisions based exclusively on automated processing producing legal consequences;
• compensation for damages suffered due to unlawful processing of personal data.
Requests relating to your personal data under the KVKK may be submitted to:
Privacy Team
Saga International B.V.
Email: privacy@sagalegal.io
Subject: KVKK Data Subject Request
Saga will process requests within the time periods prescribed by applicable law.
Where Saga acts solely as a data processor on behalf of a customer, Saga may forward your request to the
relevant customer (the data controller) for handling.
Saga may update this Information Notice from time to time to reflect changes in applicable legislation, its
services or its processing activities.
The latest version will always be available on Saga's website.
