This privacy notice has been prepared under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (the “Law”, also known as KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, to explain how the personal data of people who contact us or request a quote through our website are processed.
1. Data controller
Your personal data are processed by Pelin Strafor & Süs Atölyesi (the “Company”) as data controller. Our contact details:
- Head office: Karasu Cad. No:34, Adapazarı / Sakarya, Türkiye
- Branch: Ataşehir / İstanbul, Türkiye
- Email: info@pelinstrafor.com
- Phone: +90 505 556 36 68
2. Personal data processed
- Identity and contact: full name, company name, phone number, email address.
- Request details: the subject and message you send through the contact form; the product group and product, size / dimensions, quantity, colour preference and notes you send through the quote form, and the page from which the form was sent.
- Files you upload: images, drawings, logos or design files attached to the quote form (JPG, PNG, PDF).
- Phone and WhatsApp messages: your phone number and the content of your messages when you call us or write to us on WhatsApp.
- Transaction security: to prevent misuse of the forms, a one-way hash generated from your IP address is kept for 15 minutes; the IP address itself is not stored. The server hosting the website may keep standard access logs (IP address, date and time, page requested) for security purposes.
- Preferences: your cookie preference is stored only in your own browser (see the Cookie Policy).
The forms do not ask for special categories of personal data (such as health information); please do not include such information in the notes or in uploaded files. If photos you send for custom printed products show other people, please make sure you are entitled to share them; these images are used only to design and produce your order.
3. Purposes of processing
- To receive and assess your quote and custom production request and prepare a price quote,
- To plan and carry out the design, production, delivery and shipping of your order,
- To answer the questions and messages you send through the contact form, phone or WhatsApp,
- To keep the website and forms secure and prevent misuse and duplicate submissions,
- To fulfil legal obligations such as invoicing and to protect our rights in case of a dispute.
4. Method of collection and legal grounds
Your personal data are collected electronically, partly by automated means, through the contact and quote forms on our website, and directly from you by phone and WhatsApp. They are processed on the following legal grounds under Article 5(2) of the Law:
- (c) Establishment or performance of a contract: receiving the quote request, preparing the quote, and producing and delivering the order,
- (f) Legitimate interest: answering general questions and keeping the website and forms secure,
- (ç) Legal obligation and (e) establishment, exercise or protection of a right: statutory retention obligations under tax and commercial law, and possible disputes.
Your explicit consent is not sought for these activities. If processing that requires explicit consent is carried out in the future, your consent will be obtained separately from this notice.
5. Transfer of personal data
Your personal data may be transferred, limited to and in proportion with the purposes above, to the following groups of recipients:
- Courier and logistics companies, to the extent needed to deliver your order,
- Financial advisors and accounting service providers, for invoicing and accounting,
- Service providers hosting the website and email (as data processors),
- Authorised public bodies and courts, upon request.
Where the servers of one of our service providers are located abroad, or where a transfer to a recipient or carrier abroad is necessary for an export order, the transfer is made in accordance with the conditions in Article 9 of the Law (adequacy decision, appropriate safeguards such as standard contracts, or occasional transfer exceptions).
If you choose to write to us on WhatsApp, your messages are transmitted over WhatsApp’s (Meta’s) infrastructure and are also subject to that service’s own privacy terms.
6. Retention period
Your personal data are kept for as long as the purpose of processing requires and for the periods set out in the relevant legislation; at the end of that period they are deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Requests that do not turn into orders, and their attached files, are deleted from the admin panel when no longer needed. The hash generated for form security is deleted automatically after 15 minutes.
7. Your rights under Article 11 of the Law
By applying to our Company, you have the right to:
- (a) learn whether your personal data are processed,
- (b) request information if they have been processed,
- (c) learn the purpose of processing and whether they are used in line with that purpose,
- (ç) know the third parties in Türkiye or abroad to whom your personal data are transferred,
- (d) request correction if they have been processed incompletely or inaccurately,
- (e) request deletion or destruction under the conditions in Article 7 of the Law,
- (f) request that the actions taken under (d) and (e) be notified to third parties to whom your personal data have been transferred,
- (g) object to an outcome against you arising from the analysis of the processed data exclusively by automated systems,
- (ğ) claim compensation if you suffer damage because your personal data are processed unlawfully.
8. How to apply
You can send your requests, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to our head office address, or by secure electronic signature, mobile signature or from the email address you have previously given us and that is registered in our system, to info@pelinstrafor.com.
Your application should include your full name, your signature for written applications, your Turkish ID number (for foreign nationals, nationality and passport number), your residential or business address for notifications, your email address for notifications if any, your phone or fax number and the subject of your request.
Your application will be concluded free of charge within 30 days at the latest, depending on the nature of the request; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Board under Article 14 of the Law.
