Privacy Policy and Data Protection Notice

Last updated: November 1, 2026

This notice explains how personal data is processed when you visit this website, send us a message, or contact us by WhatsApp, phone or e-mail. It is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, to the extent it applies to you, under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"). A Turkish version of this notice is available on the Turkish page.

1. Controller

The controller of your personal data is:

Trade name: SAFKAN OTOMOTİV İTH. İHR. SAN. TİC. LTD. ŞTİ.
Address: Ferhatpaşa Mah. 27. Sok. No: 24/A-B, 34888 Ataşehir/İstanbul
Phone: 0216 471 47 94
E-mail: safkan@safkan.com.tr
Trade registry no: 103985-5

"We", "us" and "Safkan" refer to the controller above. This notice is for website visitors and people who contact us; our employees and job applicants receive a separate notice.

2. What personal data we process

Category	Data	When and how we obtain it
Identity	Name	When you fill in the contact/quote form, or write to us by WhatsApp or e-mail.
Contact	E-mail address, phone number (optional)	In the form; or when you contact us by WhatsApp, phone or e-mail.
Document (PDF) request	Your e-mail address, which product document you asked for, the date of the request	When you click a "PDF" link in a product table and enter your e-mail address. The document is e-mailed to that address and the request is kept like your other messages.
Request details	Company name, subject or product, machine brand and model, quantity, the content of your message, our replies	When you submit the form and during the correspondence.
Security data	Date and time of submission, the address of the page you submitted the form from, a keyed one-way hash of your IP address (pseudonymised data)	Automatically when you submit the form. Your IP address is not stored as such; only a one-way hash produced with a secret key is kept. The hash does not identify you on its own, but because it can be linked back with the key it is protected as personal data; it is used to tell repeated submissions from the same source apart.
Request source	The search engine, advertisement or website you came from (referrer domain), the first page you opened, any campaign tag (utm), your language	Kept in your browser's session storage only if you consent in the cookie banner, and added to your request only if you submit the contact form. If you decline, nothing is stored.
Visitor activity data	Page views, click events (phone, e-mail, WhatsApp, PDF download), device and browser information, approximate location, cookie identifiers	Only with your consent given in the cookie banner, through Google Analytics and Google Ads cookies. Nothing is collected if you decline.
Server access logs	IP address, date and time, requested address, browser information	May be kept on the hosting server by our hosting provider for security and to meet legal obligations (including Turkish Law No. 5651). Short-lived technical counters that prevent form abuse are held in memory.

Your name, e-mail address and message are necessary for us to answer your request; without them we cannot process it. Phone, company, machine and quantity are optional.

We do not ask for special-category data (health, biometric or similar data) through this website. Please do not include it in your message.

3. Purposes of processing

Assessing your request, preparing quotes and replying by e-mail, phone or WhatsApp;
Pre-contract discussions and sharing technical product information;
Sending you an automatic confirmation e-mail that your request was received;
Managing customer relationships and correspondence records;
Keeping the website secure and preventing spam and abuse;
With your consent, reporting in aggregate on which channels requests come from, and improving the site;
With your consent, measuring visitor statistics and advertising performance;
Meeting legal obligations and protecting our rights in possible disputes.

We do not send promotional e-mails or SMS messages unless you ask for them. If we ever want to do so, we will obtain the consents and registrations required by Turkish Law No. 6563 on Electronic Commerce and its regulation (including the İYS message management system) and, where the GDPR applies, by the ePrivacy rules.

4. Legal bases

Taking steps at your request before entering into a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): answering your quote and information requests, and e-mailing you the document you asked for.
Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): website security, spam prevention and keeping correspondence records. We balance these interests against your rights and freedoms.
Establishment, exercise or protection of a legal right (KVKK Art. 5/2-e; GDPR Art. 6(1)(f)): keeping request and correspondence records as evidence in possible disputes.
Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): retention and disclosure duties under law and requests from public authorities.
Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): Google Analytics and Google Ads cookies, keeping the request source for your contact form, and the resulting transfer of data abroad. Your consent depends only on your choice in the cookie banner, declining does not affect your use of the site, and you can withdraw it at any time.

The "I have read and understood the Privacy Notice" box on the contact form is not a consent; it only confirms that you have read this notice.

5. Recipients

We do not sell or rent your data. We use Google Ads cookies for advertising measurement only with your consent. We may share data, limited to what is necessary, with:

Our hosting provider Hostinger (HOSTINGER, UAB and other Hostinger group companies, Vilnius, Lithuania), which hosts the site and its database, and acts on our behalf and on our instructions as a data processor (service provider) under a data processing agreement (DPA). Our website servers are located in a data center in Europe (Germany, Frankfurt). Depending on the data center chosen, Hostinger's servers may be located in the European Union, the United Kingdom, the United States, Brazil, Singapore or Indonesia.
E-mail infrastructure providers, acting as service providers to deliver your messages and to send confirmation and reply e-mails.
Google Ireland Limited / Google LLC, only if you consent to cookies, for Google Analytics and Google Ads measurement.
WhatsApp (Meta Platforms Ireland Limited and WhatsApp LLC), only if you use the WhatsApp button and write to us. After that point WhatsApp's own privacy policy applies.
Cloudflare, Inc., for bot verification (Turnstile) when it is switched on: your browser connects to Cloudflare when the contact page loads, and when you submit the form our server sends Cloudflare the verification token and your IP address.
The OpenStreetMap Foundation: when the map on the contact page loads, your browser connects directly to the map server and your IP address is sent to it.
Competent public authorities, such as courts and regulators, where the law requires it.

International transfers

Google, WhatsApp, Cloudflare and map services, and our providers' servers, may be located outside Türkiye. Under Article 9 of the KVKK (as amended by Law No. 7499) and the Regulation on the Procedures and Principles of Transfers of Personal Data Abroad, such transfers rely on an adequacy decision, on appropriate safeguards (for example standard contractual clauses or binding corporate rules), or, only where neither exists and the transfer is incidental and not repetitive, on your explicit consent. Google Analytics and Google Ads data is transferred under the contractual safeguards Google offers; in addition, we ask for your explicit consent in the cookie banner after informing you of the transfer. You can ask us for a copy of the safeguards used. For EU data, Google may also rely on its own mechanisms such as the EU-U.S. Data Privacy Framework and standard contractual clauses; this is stated for information only and does not replace the basis we rely on under the KVKK. If you write to us from the EU/EEA, your data is sent by you directly to us in Türkiye.

6. Retention

Requests saved through the website: kept for 24 months from the date of the request, then automatically deleted from our system together with our replies.
Correspondence in our mailbox and on WhatsApp: deleted or destroyed by us at the end of the same period.
If a contract or business relationship follows: documents such as invoices, contracts and accounting records are kept for the periods required by law (for example under Turkish tax and commercial legislation).
Google Analytics / Ads data: user and event data retention in Google Analytics is set to 14 months, the longest period Google allows for standard accounts; Google Ads data is kept for Google's own periods. Cookie lifetimes are listed in our Cookie Policy.
Server access logs: for the period required by the hosting provider and applicable law.

When the retention period ends or the purpose no longer exists, data is deleted, destroyed or anonymized in line with the Turkish Regulation on the Deletion, Destruction or Anonymization of Personal Data. Copies in backups, if any, disappear as the backups are rotated.

7. Cookies and similar technologies

The site uses its own cookies and browser storage for functions such as remembering your language. Google cookies for statistics and advertising measurement are loaded only with your consent; if you decline, no Google script is run. The full list of cookies, their lifetimes and how to manage your choices is in the Cookie Policy.

8. Security

We apply reasonable technical and organizational measures to protect your data against unlawful access, loss and alteration. They include an encrypted connection (HTTPS), role-based access to the administration area for authorized staff only, irreversible storage of passwords, encrypted storage of mail-server passwords, bot checks and rate limiting on forms, security headers and regular updates. If a personal data breach occurs, under Article 12(5) of the KVKK we will notify the affected persons as soon as possible and the Turkish Personal Data Protection Board within 72 hours of becoming aware of the breach (Board decision 2019/10).

9. Your rights

Under Article 11 of the KVKK you may apply to us to:

learn whether your personal data is processed, and request information about it;
learn the purpose of processing and whether it is used accordingly;
know the third parties to whom your data is transferred in Türkiye or abroad;
request correction of incomplete or inaccurate data;
request deletion or destruction under the conditions of Article 7 of the KVKK;
request that corrections and deletions be notified to third parties to whom your data was transferred;
object to a result against you arising from analysis exclusively by automated systems (we take no such decisions);
claim compensation if you suffer damage because of unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21 GDPR), and the right to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. You may object at any time to processing based on legitimate interests. You may lodge a complaint with the supervisory authority in your country of residence, or with the Turkish Personal Data Protection Board. We take no decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you.

How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in writing (a signed petition delivered by hand or sent by post or notary to the address above), by registered e-mail (KEP), with a secure electronic or mobile signature, or from an e-mail address you previously gave us and which is recorded in our system. Please state your name and surname, your signature (for written applications), your Turkish ID number (or nationality and passport number for foreign nationals), your address, your e-mail, phone or fax details if any, and what you request. We may ask for further information to verify your identity.

We conclude applications free of charge as soon as possible and within 30 days at the latest; if the action requires a separate cost, a fee according to the tariff set by the Board may be charged. If your application is rejected, you find the reply insufficient, or no reply is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the reply and in any case within 60 days of your application (KVKK Art. 14).

To have your message and our replies deleted, you can apply to us in the ways described above; we may ask for further information to verify your identity. Unless a legal retention duty or a legitimate need to keep the data to protect our rights applies, your data will be deleted (KVKK Art. 7).

10. Third-party links

The site links to WhatsApp, LinkedIn, Instagram and map services (including a Google Maps link). We are not responsible for the privacy practices of those sites; their own policies apply once you follow a link.

11. Children

This website promotes products and services to businesses and is not directed to people under 18. We do not knowingly collect personal data from children and will delete it if we find that we have.

12. Visitors from around the world: EU/EEA (GDPR), the United Kingdom and other countries

Our website is open to visitors worldwide. If you contact us from the EU/EEA, the GDPR rights described above apply to you to the extent the GDPR is applicable.

If you contact us from the United Kingdom, you have the same rights under the UK GDPR and the Data Protection Act 2018, and you may complain to the Information Commissioner's Office (ICO). If the law of the country where you live gives you additional rights (for example Brazil's LGPD, California's CCPA/CPRA or Switzerland's FADP), we will respect them where they apply, and you can exercise them through the contact details above. These other countries' laws apply only where their conditions are met. We do not sell personal data.

13. Changes to this notice

We update this notice when our practices or the law change. The current version is always published on this page, and the "Last updated" date at the top shows which version applies. Where appropriate, we announce important changes on the site.

14. Contact us

For questions, requests and applications about this notice or the processing of your personal data, please use the address, phone and e-mail in the "Controller" section above.

Privacy Policy and Notice