Privacy Notice

Data controller

Your personal data is processed by Butik Ev Ahşap, as data controller under Law No. 6698 on the Protection of Personal Data (“KVKK”), within the scope described in this notice.

Personal data we process

• Identity and contact details: your full name, email address and telephone number, and the company name and country you give in the quotation form.
• Request details: the product you are interested in, the estimated order quantity, your message and the content of your correspondence or calls with us.
• Security data: server logs such as your IP address, browser and device information, the page visited, and the date and time of the visit.
• Preferences: your language and appearance (light/dark theme) settings; see our Cookie Policy for details.

We do not ask for special categories of personal data (such as health, religion or ethnic origin) in the quotation form or through our contact channels; please do not include such information in your messages.

Why we process your data

• To receive, assess and answer your quotation, information and cooperation requests;
• To prepare a suitable quotation, hold pre-order discussions and take steps towards a possible contract;
• To contact you by telephone, email or WhatsApp;
• To keep the website secure, prevent abuse and excessive requests, and detect and fix technical problems;
• To comply with our legal obligations, respond to requests from competent authorities and protect our rights in case of a dispute.

How we collect it and legal bases

We collect your personal data electronically, partly by automated means, through the quotation form on the website, our contact channels such as WhatsApp, telephone and email, server logs and browser storage technologies. We process it on the following legal bases under Article 5(2) of the KVKK and, where the GDPR applies, Article 6(1) GDPR:

• It is directly related to entering into or performing a contract, including steps taken at your request before a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b));
• It is necessary to comply with a legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c));
• It is necessary to establish, exercise or protect a right (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f));
• It is necessary for our legitimate interests, such as website security and improving our service, provided that your fundamental rights and freedoms are not harmed (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Google Maps is embedded in the contact section of the homepage and on the Contact page to show our location. When the map loads, your IP address and browser data are sent directly to Google LLC, and Google may use its own cookies; Google processes this data under its own privacy policy. See our Cookie Policy for details.

Who we share it with

Your personal data may be shared, only as far as necessary for the purposes above, with:

• Service providers we use for website hosting, email and communication infrastructure, only to the extent the service requires;
• Public authorities and legally authorised private parties, where required by law;
• Professional advisers such as legal and financial consultants, where needed to protect a right or meet a legal obligation.

International transfers: if you choose to message us on WhatsApp, your messages are carried over the WhatsApp (Meta Platforms) infrastructure. The map in our contact sections is provided by Google LLC; when it loads, your IP address and browser data are sent to Google. The servers of these services may be located outside Türkiye.

How long we keep it

We keep your personal data for as long as the purpose of processing requires and for the retention periods set by applicable law; after that it is deleted, destroyed or anonymised. Quotation requests that do not lead to a business relationship are deleted after a reasonable period.

Your rights

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed;
• request information about the processing, if it has taken place;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data has been transferred;
• request the correction of incomplete or inaccurate data;
• request the deletion or destruction of your data under the conditions of Article 7 of the KVKK;
• request that third parties to whom your data was transferred be notified of such correction, deletion or destruction;
• object to a result against you that arises from analysis of your data exclusively by automated systems;
• claim compensation if you suffer damage because of unlawful processing.

Where the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw your consent at any time, and the right to lodge a complaint with a supervisory authority.

How to make a request

Please send your request in writing to our address above, together with information that allows us to identify you, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

We will respond free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; if the action involves an additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board. If your request is refused, you find our response insufficient or we do not respond in time, you may lodge a complaint with the Personal Data Protection Board.

Changes to this notice

We may update this notice when our processing activities or the law change. The current version is always published on this page.