Our personal data protection policy.

1. Purpose and Scope

This policy has been prepared to ensure that personal data processing activities carried out by Atakaş Demir Çelik Limited Şirketi (the "Company") comply with Law No. 6698 on the Protection of Personal Data (the "Law") and related secondary legislation.

The policy covers personal data of our customers, potential customers, employees of our suppliers and business partners, and all natural persons visiting our website. Processing activities relating to Company employees are governed by separate policies.

2. Definitions

3. Core Principles of Processing

The Company processes personal data in accordance with the principles set out in Article 4 of the Law:

• Lawfulness and fairness.
• Being accurate and, where necessary, up to date.
• Being processed for specified, explicit and legitimate purposes.
• Being relevant, limited and proportionate to the purposes of processing.
• Being retained only for the period stipulated by legislation or required for the purpose of processing.

4. Conditions for Processing

Personal data is not processed without the explicit consent of the data subject. However, explicit consent is not required in the cases listed in the second paragraph of Article 5 of the Law. Activities carried out through our website mainly rely on the conclusion or performance of a contract, compliance with a legal obligation and legitimate interest.

Special categories of personal data are not processed unless the conditions of Article 6 of the Law are met. The forms on our website are not designed for such data.

5. Categories of Data Processed

• Identity and contact data (name, e-mail, phone, company, city).
• Customer transaction data (request subject, message content).
• Transaction security data (IP address, browser information, server logs).
• Marketing data (cookie-based usage data, only with explicit consent).

The purposes, legal grounds and retention periods for these categories are explained in detail in our Privacy Notice.

6. Transfers

Subject to the conditions in Articles 8 and 9 of the Law, personal data may be transferred to hosting and e-mail infrastructure providers, logistics partners, accounting service providers and public authorities legally entitled to request it. Transfers are always limited and proportionate to the purpose.

7. Data Security Measures

In accordance with Article 12 of the Law, the Company takes technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure its safekeeping:

• Technical measures: blocking direct web access to the database, authorisation and strong password policy, two-factor authentication, session security, login attempt limits, form security (CSRF and bot protection), security headers, regular backups and encrypted storage.
• Administrative measures: limiting access rights according to job descriptions, keeping activity logs, confidentiality undertakings, staff awareness activities, adding data protection clauses to supplier contracts.

If it is determined that processed personal data has been obtained by others through unlawful means, the data subject and the Board are notified as soon as possible.

8. Retention and Destruction

Personal data is retained for the period stipulated by relevant legislation or required for the purpose of processing. Data whose period has expired is deleted, destroyed or anonymised during periodic destruction cycles. The periodic destruction cycle is six months.

9. Rights of Data Subjects and Applications

Data subjects may apply to our Company to exercise the rights listed in Article 11 of the Law. The scope of these rights and the application procedure are explained in the Privacy Notice. Applications are concluded within thirty days at the latest.

10. Entry into Force

This policy enters into force on the date of publication. It may be revised in line with legislative changes or updates to business processes; the current version is published on this page.