INFORMATION NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
1. Data Controller
Under Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by the company identified below, acting as the data controller:
This Information Notice has been prepared to inform natural persons who visit our website, create an account, purchase products or services, request a quotation or information, or contact us through our communication channels about the processing of their personal data.
2. Personal Data Processed
Depending on the products and services provided by our company and the transactions carried out by the data subject, the following personal data may be processed:
Identity Information
- First and last name,
- Turkish identity number,
- Tax identification number,
- Authorised person details,
- Signature information,
- Individual or corporate customer information.
A Turkish identity number is processed only where required by legislation or invoicing procedures.
Contact Information
- Telephone number,
- Email address,
- Billing address,
- Delivery address,
- Communication and correspondence information.
Customer Transaction Information
- Membership and account information,
- Order number and order history,
- Details of products and services purchased,
- Quotation and enquiry information,
- Cart and favourites information,
- Return, cancellation and exchange requests,
- Invoice and delivery information,
- Warranty, maintenance and technical service records,
- Product model and serial number,
- Customer complaints and enquiries,
- Customer service correspondence.
Financial Information
- Invoice information,
- Payment method,
- Collection and refund information,
- Transaction amount,
- Bank account and IBAN information,
- Limited transaction records relating to payment processing.
Your credit or debit card details may be processed directly by PayTR and the relevant bank or payment institution. Our company does not store your full card number or security code in its own systems.
Transaction Security and Digital Records
- IP address,
- Session and login/logout records,
- Transaction date and time,
- User and device information,
- Browser information,
- Security and error logs,
- Website usage records,
- Information obtained through cookies and similar technologies.
Non-essential advertising, analytics and personalisation cookies are used according to your preferences and, where required, your separate consent.
Legal Transaction Information
- Correspondence with official authorities,
- Formal notice and court case information,
- Consumer arbitration committee and mediation records,
- Dispute and claim information,
- Requests from authorised institutions and organisations.
Marketing Information
Where you have given explicit consent or other valid conditions under applicable legislation are met, the following data may be processed:
- Campaign and promotional preferences,
- Permissions for commercial electronic messages,
- Shopping and interest information,
- Advertising and campaign interactions,
- Customer satisfaction surveys.
Permissions required to send commercial electronic messages are obtained separately from this Information Notice.
3. Purposes of Processing Personal Data
Your personal data may be processed for the following purposes:
- Operating the website and ensuring its security,
- Creating and managing membership accounts,
- Receiving, confirming and tracking orders,
- Completing purchases and payment transactions,
- Issuing invoices, e-invoices and e-archive invoices,
- Preparing, dispatching and delivering products,
- Providing installation, commissioning and training services,
- Conducting warranty, maintenance, repair and technical service processes,
- Tracking product serial numbers and warranty periods,
- Conducting return, cancellation, exchange and refund processes,
- Evaluating customer enquiries, suggestions and complaints,
- Providing pre-sales and after-sales support,
- Preparing quotations and conducting commercial communication processes,
- Managing customer relationships and customer satisfaction activities,
- Conducting accounting, finance, collection and current account processes,
- Entering into contracts and fulfilling contractual obligations,
- Preventing fraud and unauthorised transaction risks,
- Ensuring information and transaction security,
- Conducting retention and archiving activities,
- Conducting legal proceedings and protecting rights,
- Responding to requests from authorised public institutions and organisations,
- Fulfilling obligations under tax, consumer, electronic commerce and other applicable legislation,
- Conducting campaigns, advertising, promotion and marketing activities where explicit consent or other valid legal conditions exist.
4. Legal Grounds for Processing Personal Data
Your personal data is processed on the basis of the following personal data processing conditions specified in Article 5 of the KVKK:
Expressly Provided for by Law
Your personal data may be processed to fulfil obligations relating to tax, invoicing, accounting, consumer transactions, electronic commerce, payment, retention and official notifications.
Necessary for the Establishment or Performance of a Contract
Your personal data may be processed to receive an order, process payment, deliver a product, provide installation and technical services, manage a membership account and process returns.
Fulfilment of a Legal Obligation
Your personal data may be processed for invoicing, accounting, record retention, responding to requests from authorised authorities and fulfilling other statutory obligations.
Establishment, Exercise or Protection of a Right
Your personal data may be processed to evaluate enquiries and complaints, resolve possible disputes, and conduct court, mediation, arbitration committee and enforcement proceedings.
Legitimate Interests of the Data Controller
Provided that your fundamental rights and freedoms are not harmed;
- Ensuring the security of the website and information systems,
- Improving business processes,
- Improving customer services,
- Preventing errors and misuse,
- Keeping transaction and audit records
are purposes for which your personal data may be processed.
Explicit Consent
Non-essential cookies, personalised advertising, certain marketing activities or other processing requiring explicit consent under the KVKK are carried out only on the basis of your separately given explicit consent.
Not giving explicit consent does not prevent you from purchasing products or using basic services that do not depend on explicit consent.
5. Transfer of Personal Data
Your personal data may be transferred to the following recipient groups for the purposes explained above and to the extent necessary:
- PayTR and other authorised payment institutions,
- Banks and financial institutions,
- İKAS and website infrastructure service providers,
- Cargo, courier, transport and logistics companies,
- Installation, maintenance and authorised technical service providers,
- Manufacturers, suppliers and distributors,
- Accounting, financial advisory and e-invoicing service providers,
- Information technology, software, hosting and cybersecurity service providers,
- Call centre and customer communication service providers,
- Legal, audit and consultancy service providers,
- Insurance companies,
- Authorised public institutions and organisations,
- Courts, enforcement offices, arbitration committees and other authorised bodies,
- Other natural or legal persons legally entitled to receive information.
Transfers are limited to the personal data necessary to provide the relevant service and fulfil legal obligations.
Order value, contact information, billing information, IP address and transaction security data may be shared with PayTR to process payments securely.
First and last name or company name, telephone number, delivery address and necessary order information may be shared with the cargo or logistics company to complete delivery.
6. Transfer of Personal Data Abroad
Your personal data may be transferred abroad if the servers of email, cloud, server, software, security, analytics or communication services used by our company are located abroad.
Data transfers abroad are made where one of the conditions specified in Article 9 of the KVKK is met and the necessary administrative and technical measures are taken.
Depending on the nature of a transfer abroad;
- Adequacy decisions announced by the Personal Data Protection Board,
- Appropriate safeguards,
- Standard contracts,
- Binding corporate rules,
- Exceptional transfer conditions provided for by law
may be used.
For transfer activities that must rely on explicit consent, your explicit consent is obtained separately from this Information Notice.
7. Methods of Collecting Personal Data
Your personal data may be collected automatically, partly automatically or by non-automated means forming part of a data recording system through the following methods:
- www.sammicturkiye.com.tr Website,
- Membership, order, payment and contact forms,
- PayTR and payment institutions,
- Telephone, email and WhatsApp communications,
- Social media accounts,
- Quotation, contract, invoice and service forms,
- Cargo and logistics companies,
- Technical service and warranty records,
- Cookies and similar digital technologies,
- Authorised dealers, suppliers and business partners,
- Physical documents and face-to-face communication channels,
- Public institutions and other authorised bodies.
Your personal data is obtained directly from you wherever possible.
8. Retention of Personal Data
Your personal data is retained for;
- Retention periods stipulated by applicable legislation,
- Contract and commercial relationship periods,
- Warranty and after-sales service periods,
- Tax and accounting record retention periods,
- Limitation and statutory forfeiture periods,
- Periods necessary to resolve possible disputes
as applicable.
When the retention period expires and the legal ground requiring processing ceases to exist, your personal data is deleted, destroyed or anonymised in accordance with legislation.
9. Data Security
Our company takes appropriate technical and administrative measures to;
- Prevent unlawful processing of personal data,
- Prevent unlawful access,
- Ensure secure retention of personal data.
Measures may include access authorisations, secure payment infrastructure, recording and auditing mechanisms, software security, backups, and confidentiality obligations for employees and service providers.
10. Rights of the Data Subject
Under Article 11 of the KVKK, everyone has the right to apply to the data controller concerning their own personal data and;
- Learn whether personal data is being processed,
- Request information if their personal data has been processed,
- Learn the purpose of processing and whether their personal data is used in accordance with that purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request correction of incomplete or inaccurate personal data,
- Request deletion or destruction of personal data under the conditions provided for by law,
- Request that correction, deletion or destruction be notified to third parties to whom personal data has been transferred,
- Object to a result against themselves arising from the analysis of processed data exclusively through automated systems,
- Request compensation for damage suffered as a result of unlawful processing of personal data as set out above.
11. Applications to the Data Controller
You may submit your requests under the KVKK to our company using one of the following methods:
Written Application
Address: Mutlukent Mahallesi 1970. Cadde No: 1/1 Çankaya/Ankara
It is recommended that the application envelope be marked “Information Request under the Law on the Protection of Personal Data”.
Application by Email
Email: [email protected]
It is recommended that the subject line read “KVKK Data Subject Application”.
Registered Electronic Mail
KEP address: [email protected]
The application must contain the following information:
- First and last name,
- A signature if the application is written,
- Turkish identity number for citizens of the Republic of Türkiye,
- Nationality, passport number or identity number, if any, for foreign nationals,
- Residential or business address for service of notices,
- Email address, telephone and fax number for notifications, if any,
- Subject of the request,
- Information and documents supporting the request.
Our company concludes applications free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the procedure incurs an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.
12. Commercial Electronic Messages
Commercial electronic messages concerning campaigns, advertising, promotions, discounts and similar matters are sent only in accordance with applicable legislation and where the necessary permission exists.
Permission for commercial electronic messages;
- Does not constitute acceptance of this Information Notice,
- Is not a condition of purchasing products,
- May be refused or withdrawn at any time.
You may change your commercial communication preferences through the opt-out link in the message, the Message Management System or our company’s communication channels.
13. Cookies
Essential cookies may be used on the website to ensure security and operate membership sessions, cart and payment transactions.
Non-essential cookies for analytics, advertising, performance and personalisation operate according to the choices you make through the preference management panel, in accordance with applicable legislation.
Detailed information on cookie types, durations, providers and purposes is included in the “Cookie Policy”.
14. Changes to this Information Notice
This Information Notice may be updated in response to legislative changes, decisions of the Personal Data Protection Board, company activities, website infrastructure or changes in personal data processing procedures.
The current text www.sammicturkiye.com.tr is published on the website.