KVKK Privacy Notice

The data controller is NURDOĞAN İNŞAAT ve D.T.M. SAN. ve TİC. LTD.ŞTİ. Address: Kaynarca Cad. Kızkulesi Sk. No:13 Ramazanoğlu, 34906 Pendik / Istanbul, Türkiye. Email: [email protected].

• Identity and contact data: name, company name, email address, country and, optionally, phone number.
• Request data: the product you are interested in, estimated volume, the content of your message and files you may upload through the form in future (such as dimension drawings or print artwork).
• Dealer account data (once the dealer portal is live): email address, company details and an irreversible hash of your password. Your password is never stored in plain text.
• Security data: IP address, browser and device information, date and time of access (server logs).
• Cookie data: strictly necessary cookies and, only if you consent, analytics cookies. See the Cookie Policy for details.
• Correspondence: information you send us by email, phone or WhatsApp.

We collect personal data partly by automated and partly by non-automated means: through the quote and contact form on this website, the dealer portal, email, phone and WhatsApp correspondence, server logs and cookies.

The WhatsApp button on the site takes you to the WhatsApp application. Information you share on WhatsApp is also subject to WhatsApp's (Meta's) own privacy terms; Nurdoğan does not control how that service operates. The content of the conversation visible to us is processed for the purposes set out in this notice.

• Responding to quote and information requests, preparing prices and lead times.
• Carrying out order, production, shipping and invoicing processes.
• Creating dealer accounts, verifying your identity and giving access to dealer prices and tools.
• Keeping the website and servers secure, preventing abuse and spam.
• Meeting obligations under commercial, tax and other legislation and responding to requests from competent authorities.
• Only with your consent, producing statistics on how the site is used.

We process personal data on the following legal bases set out in Article 5 KVKK:

• Necessity for the conclusion or performance of a contract (Art. 5/2-c): quote requests, orders, dealer accounts.
• Compliance with a legal obligation of the controller (Art. 5/2-ç): commercial records, invoices and official filings.
• Establishment, exercise or protection of a right (Art. 5/2-e): retention as evidence in possible disputes.
• Legitimate interest, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f): security logs, spam prevention, follow-up of correspondence about your request.
• Explicit consent (Art. 5/1): analytics cookies and the occasional cross-border transfers described in section 6.

Personal data may be transferred to the following recipients only to the extent necessary for the purposes above:

• Hosting provider: the servers for the website, form infrastructure and dealer portal are located in Germany.
• Email delivery provider: to deliver form messages to us.
• Accounting, financial advisory and legal advisers; courier and logistics companies: only the information needed for the order process and legal obligations.
• Competent public authorities and courts: where and to the extent required by law.

Because our servers are in Germany, your personal data is transferred abroad. This transfer is made under Article 9 KVKK: unless the Turkish Personal Data Protection Board issues an adequacy decision for Germany, the transfer relies on one of the appropriate safeguards provided in Article 9, such as the standard contract published by the Board, signed with the service provider and notified to the Authority.

Where an appropriate safeguard cannot be put in place and the transfer is occasional, it may rely on one of the exceptions in Article 9/6, in particular your explicit consent given after being informed of the possible risks. If you do not give such consent, you can still contact us by means that do not require a regular transfer (phone, email).

• Quote requests and correspondence that do not lead to a contract: 2 years from the last correspondence.
• Order, contract and invoice records: 10 years under Article 82 of the Turkish Commercial Code and tax legislation.
• Dealer account data: while the account remains open, and 1 year after it is closed.
• Server security logs: up to 12 months.

At the end of the retention period, personal data is deleted, destroyed or anonymised.

By applying to the data controller, you may:

• Learn whether your personal data is processed.
• Request information about the processing if it has been processed.
• Learn the purpose of processing and whether data is used in line with that purpose.
• Know the third parties in Türkiye or abroad to whom data is transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction of data under the conditions of Article 7 KVKK.
• Request that corrections, deletions and destructions be notified to third parties to whom the data was transferred.
• Object to a result against you arising from analysis of your data exclusively by automated systems.
• Claim compensation for damage suffered due to unlawful processing.

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request together with information that identifies you: in writing to the address above, by registered electronic mail (KEP) or secure electronic signature, or from an email address you have previously given us and that is registered in our systems, to [email protected].

We will respond free of charge within 30 days at the latest. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, you find the answer insufficient, or we do not reply in time, you may file a complaint with the Board.