KVKK Privacy Notice

This privacy notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform persons who visit our website, use the forms on our website and contact us by telephone.

1. Data controller

Bartın Chamber of Commerce and Industry
Address: Kırtepe, Yukarı Çarşı Cd. No:20, 74100 Merkez / Bartın
Telephone: (0378) 227 10 46
E-mail: info@bartintso.org.tr

2. Personal data processed

The following data that you send to us through the contact form on our website are processed:

• Identity information: first name and surname,
• Contact information: telephone number and (if you choose to share it) e-mail address,
• Request information: the type of message (information request or message to the President), the content of your message, your confirmation (with its date) that you have read the privacy notice, and the date and page address from which the form was submitted.

The following data that you send us through the appointment request form on our website is processed:

• Request information: the subject of the appointment, your preferred day, your preferred time, (if you choose to share it) the company name, (if you choose to share it) your note about the matter you wish to discuss, your confirmation (with its date) that you have read the privacy notice, and the date and page address from which the request was submitted,
• Identity information: first name and surname,
• Contact information: telephone number and (if you choose to share it) e-mail address.

The following data that you send us through the information request form on our website is processed:

• Request information: whether you are applying on your own behalf or on behalf of a legal entity, the title of the legal entity (if you share it) when applying on its behalf, the way in which you wish the reply to be delivered (e-mail or in writing), your declaration mark stating that you are applying pursuant to Law No. 4982, the information or documents you request, your mark indicating that you have read the privacy notice (with its date), and the date and page address from which the application was sent,
• Identity information: (if you choose to provide it) the authorisation document (specimen signature circular, etc.) you upload when applying on behalf of a legal entity, together with the identity information and full name contained in it,
• Identity number: Turkish Republic national identity number,
• Contact information: e-mail address, telephone number and your residential or business address.

The following data that you send us through the member information update form on our website is processed:

• Request information: the type of number (registry number or tax number), your mark indicating that you have read the privacy notice (with its date), and the date and page address from which the request was sent,
• Identity number: the company's registry or tax number (for sole proprietorships, the tax number may be your Turkish Republic national identity number),
• Contact information: the company details you wish to have updated and their new versions (title, address, telephone, fax, e-mail, website; the name, telephone and e-mail of the company representative, partners and accounting officer), the telephone number of the person completing the form and (if you share it) the e-mail address of the person completing the form,
• Identity information: the first name and surname of the person completing the form.

The following data that you send us through the member login form on our website is processed:

• Contact information: your mobile phone number (to match it with your membership record and to send you a login code),
• Transaction security information: a record that a login code was sent to you (the code itself is not stored; the code expires after 10 minutes).

The following data that you send us through the member login verification form on our website is processed:

• Transaction security information: the one-time login code sent to your phone and the date of your last login to the member area.

The following data that you send us through the member notification preferences form on our website is processed:

• Request information: (if you choose to share it) whether you wish to receive the Chamber's announcements,
• Contact information: (if you share it) whether you wish to receive notifications via a messaging application or by SMS,
• Marketing consent: (if you share it) whether or not you wish to receive announcements of fairs, training, campaigns and discounts from our chamber and the institutions it cooperates with, by SMS or via a messaging application (commercial electronic message consent; optional, and you may withdraw it at any time from the member area), and, if you have given commercial electronic message consent, the date on which you gave it and where you gave it (the member area or written consent you submitted to our chamber; in this case, a short note on how the consent was obtained); when you withdraw consent, this information is deleted, and the dates on which consent was given and withdrawn are kept in the transaction log for 180 days.

The following data that you send to us through the member survey form on our website is processed:

• Request information: the option you select in the survey, the brief opinion you optionally write along with the option (if you choose to share it), the opinions, problems and suggestions you write in a survey requiring a written response, and the date on which you gave and last changed your answer,
• Identity information: your member details with which your answer is recorded (your company name, authorized person's name and professional group),
• Transaction security information: the dates on which your personal survey link was sent to you, last opened and answered (the link itself is stored encrypted).

We kindly ask that you do not write special categories of personal data, such as health information, religion or ethnic origin, or your Turkish Republic identity number in the message field.

To prevent misuse of the forms, your IP address is used only for short-term request limiting, in the form of a hash value generated with a secret key; your IP address is not stored together with your form data.

In addition, while you use our website, the following data is processed as described in the “Cookies and external services” section below:

• Visit information: which pages are viewed, and a daily-changing summary value generated from your IP address and browser information (visit counter); pages viewed, visit duration, device and browser type, approximate location (Google Analytics, only with your consent); your IP address and technical information about your device and browser (Google Maps, only if you choose to display the map),
• Transaction security information: when you use the form, technical information about your device and browser and your IP address (Google reCAPTCHA).

3. Purposes of processing

• Replying to your question, information request and the message you send to the Presidency,
• Carrying out communication activities and protecting rights in the event of possible disputes,
• Ensuring the security of the website and the forms,
• Scheduling an appointment for your in-person transaction at the Chamber and confirming the appointment with you,
• Receiving, evaluating and replying to your application under the Right to Information Law No. 4982,
• Updating company contact information in member records at your request and, where necessary, confirming the request with you,
• Sending a one-time code for secure login to the member area,
• Ensuring the security of the website and the member area,
• Enabling secure login to the member area,
• Sending Chamber notifications through your preferred channel,
• If you give consent, sending you announcements of fairs, training, campaigns and discounts from our chamber and the institutions it cooperates with, by SMS or via a messaging application,
• For the Chamber to receive the opinions and suggestions of its members; to evaluate the responses by professional group,
• Counting how many times our pages are visited without using cookies,
• Notifying our organisation of your request by e-mail,
• Protecting forms against automated programs (spam),
• Measuring visit statistics and improving our website (only with your consent),
• Showing our location on the map at your request,
• Replying to messages you send via WhatsApp.

4. Method of collection and legal grounds

Your personal data is collected electronically through the contact form, appointment request form, information request application form, member information update form, member login form, member login verification form, member notification preferences form and member survey form on our website, or by you calling us by telephone. Visit and device information is obtained automatically by the means described in the “Cookies and external services” section below.

This data is processed on the basis of the following legal grounds set out in paragraph 2 of Article 5 of the KVKK (Personal Data Protection Law):

• pursuant to subparagraph (ç), processing is necessary for the data controller to fulfil its legal obligation (so that we can evaluate and reply to your information request under the Right to Information Law No. 4982),
• pursuant to subparagraph (f), processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (so that we can respond to your request and ensure the security of the forms; so that we can schedule your appointment request and get back to you; so that we can keep contact details in member records up to date at your request; so that only the member themselves can access the member area; so that we can deliver notifications through your preferred channel; so that we can learn about our members' problems, opinions and suggestions and take them into account in the Chamber's work; counting the number of visits to our pages without using cookies; protecting the forms against automated programs with Google reCAPTCHA)

legal grounds.

Sending you announcements of fairs, training, campaigns and discounts by SMS or via a messaging application if you give consent in the member area or in writing to our chamber, measuring visit statistics with Google Analytics, and loading the map from Google Maps when you press the “Show map” button are based on your explicit consent under Article 5, paragraph 1 of the KVKK; you may withdraw your consent at any time.

5. Retention period

Your personal data that you send through the contact form is retained for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymised.

Your personal data that you send through the appointment request form is retained for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymised.

Personal data you submit through the freedom of information request form is retained for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date on which you submitted the form; at the end of this period, it is deleted, destroyed or anonymised.

Personal data you submit through the member information update form is retained for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date on which you submitted the form; at the end of this period, it is deleted, destroyed or anonymised.

Your personal data that you send through the member login form is retained for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymised.

Your personal data that you send through the member login verification form is retained for the period necessary to fulfil your request and for a maximum of 10 (ten) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymised.

Your personal data that you send through the member notification preferences form is retained for the period necessary to fulfil your request and for a maximum of 10 (ten) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymised.

Your personal data submitted through the member survey form is stored for the period necessary to fulfil your request and for a maximum of 2 (two) years from the date you submitted the form; at the end of this period it is deleted, destroyed or anonymized.

If an error occurs in the form, or while the result is being displayed after the form is submitted, the information you entered is kept in your session record for a short time (at most 2 hours from your last action) solely so that you can fill in the form again and so that we can display the result.

Records in the visit counter are deleted after 90 days.

Your cookie preference is stored in your browser for 6 months. The retention periods of the cookies are set out in the Cookie Policy.

Where the law provides for a longer retention period, that period shall apply.

6. Transfer of personal data

The information you submit via the contact form is stored on the server hosting our website and is communicated to our organisation through an e-mail infrastructure (e-mail service provider) so that your request reaches us; if you choose to switch to WhatsApp, it is written into the WhatsApp link (wa.me) and transmitted to WhatsApp (Meta).

The information you submit via the appointment request form is stored on the server hosting our website and is communicated to our organisation through an e-mail infrastructure (e-mail service provider) so that your request reaches us; if you choose to switch to WhatsApp, it is written into the WhatsApp link (wa.me) and transmitted to WhatsApp (Meta).

The information you submit through the freedom of information request form is stored on the server hosting our website, and the files you upload are kept on the server hosting our website; your request is also notified to our company through an e-mail infrastructure (e-mail service provider) so that it reaches us.

The information you submit via the member information update form is stored on the server hosting our website and is communicated to our organisation through an e-mail infrastructure (e-mail service provider) so that your request reaches us.

The information you submit through the member login form is stored on the server on which our website is hosted.

The information you submit through the member login verification form is stored on the server on which our website is hosted.

The information you submit through the member notification preferences form is stored on the server on which our website is hosted.

The information you submit through the member survey form is recorded on the server where our website is hosted.

In this context, your data is shared only with the suppliers from which we receive hosting and e-mail services, and solely for the purposes stated above.

The providers or servers of the following services used on our website are located abroad; when these services are used, the relevant data reaches servers abroad: Google reCAPTCHA (Google), Google Analytics (Google), Google Maps (Google) and WhatsApp (Meta). Details are in the section “Cookies and external services”. Where the servers of the service provider used are located abroad, this transfer is carried out in accordance with the conditions set out in Article 9 of the KVKK.

The information you submit through the forms is not shared with third parties for marketing purposes.

Apart from the above, your personal data may be transferred only to public institutions and organisations authorised by law, in cases provided for by legislation and upon request.

7. Cookies and external services

The session and security cookies necessary for our website to function do not depend on your consent; for the list of cookies, you may review our Cookie Policy page.

Our website uses a visit counter running on its own server to count how many times its pages are visited. The counter does not use cookies and does not record your IP address or browser information itself: a summary value that changes every day is generated from them with a secret key, and it is retained for 90 days together with the address of the page viewed. If the "Do Not Track" or "Global Privacy Control" setting is enabled in your browser, your visit is not counted.

The Google reCAPTCHA service is used to prevent our forms from being abused by automated programs (spam). reCAPTCHA is loaded when you start using the form and transmits technical information about your device and browser to Google; when you submit the form, our server also transmits your IP address to Google for verification. This processing is based on our legitimate interest in ensuring the security of the forms (KVKK Art. 5/2-f); the transfer abroad is carried out in accordance with the conditions set out in Article 9 of the KVKK, and Google’s Privacy Policy and Terms of Service apply.

In order to improve our website, we measure visit statistics (such as pages viewed, duration of visit, device and browser type, and approximate location) through cookies with Google Analytics, only if you select the "Accept" option in the cookie bar at the bottom of the page. Your IP address is anonymised in this measurement. This processing and the transfer of the data to the servers of the service provider Google abroad are based on your explicit consent, pursuant to Article 5, paragraph 1 and Article 9 of the KVKK. If you select "Reject", the measurement cookie is not used. Your preference is stored in your browser for 6 months; you can change or withdraw it at any time via the "Cookie preferences" link at the bottom of the page. For details, you may review our Cookie Policy page.

The map on our contact page is displayed through the Google Maps service and is loaded only when you click the "Show map" button; as long as you do not click the button, no information is sent to Google. When the map is loaded, Google receives your IP address and technical information about your device and browser and may use its own cookies; this data is processed on Google's servers abroad and Google's Privacy Policy applies. If you do not wish to load the map, you may use our address or open the map directly on Google's site via the "Open in Google Maps" link.

The WhatsApp links and buttons on our website that redirect to WhatsApp (e.g. "Also send via WhatsApp", shown after submitting the form) open WhatsApp; whether or not to use them is your choice. When you switch from a form to WhatsApp, the information you wrote in the form (e.g. your name and message) is written into the WhatsApp link (wa.me) and transmitted to WhatsApp: even if you do not send the message on WhatsApp, this information reaches WhatsApp's servers when the link is opened. WhatsApp is a service belonging to the Meta group of companies; its servers are located abroad and WhatsApp's own terms of use and privacy policy apply. Our website does not itself send this information to WhatsApp. Messages you send us via WhatsApp are used to respond to your request.

The foreign-language versions of our website are prepared by translating the Turkish texts published on our website with the Claude translation service (an artificial intelligence service of Anthropic). Only texts that have been made publicly available on our website (such as page, news and announcement texts) are sent for translation; information you submit through forms, information in the member area and member lists are not sent to the translation service.

Preferences stored in your browser

Your accessibility settings (font size, contrast, light/dark appearance, etc.) and the information that you have closed the announcement window are stored not as cookies but in your browser's local storage; they are not sent to our server and are not used to identify you. You can remove them by deleting your browser's site data.

No advertising cookies are used on our website.

8. Your rights under Article 11 of the KVKK

As a data subject, by applying to the data controller, you have the right to:

• learn whether your personal data is being processed,
• request information if your personal data has been processed,
• learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• know the third parties to whom your personal data is transferred, domestically or abroad,
• request the correction of your personal data if it has been processed incompletely or inaccurately,
• request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• request that the correction, deletion and destruction operations be notified to the third parties to whom your personal data has been transferred,
• object to the occurrence of a result against you by means of the analysis of the processed data exclusively through automated systems,
• request compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

You are entitled to these rights.

9. Application procedure

You may submit your requests concerning the above rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information enabling us to identify you (name and surname, Turkish Republic ID number or, for foreigners, nationality and passport/ID number, address for notification, e-mail address and telephone number if any, and the subject of the request),

• in person or through a notary, by a petition bearing a wet signature, to the address Kırtepe, Yukarı Çarşı Cd. No:20, 74100 Merkez / Bartın,
• or via a secure electronic signature, a mobile signature, or your e-mail address that you have previously notified to us and that is registered in our system, to info@bartintso.org.tr.

Your application will be concluded as soon as possible depending on the nature of the request, and within 30 (thirty) days at the latest. If the procedure requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.