إشعار حماية البيانات الشخصية
1. Data controller
Under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is Smarttek Teknoloji İthalat İhracat Sanayi ve Ticaret Limited Şirketi. Our full identity and contact details are on the Legal information page.
2. What we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, e-mail, phone, message; technically IP address | Replying to your request | KVKK art. 5/2-c and 5/2-f | Message 2 years; IP 6 months |
| Orders and sales | Name, contact, delivery/billing address, ID/tax number (for invoicing), order content, payment result | Concluding and performing the contract, invoicing, delivery, returns | KVKK art. 5/2-c and 5/2-ç | 10 years (Turkish Commercial Code art. 82, Tax Procedure Law art. 253) |
| Distance contract acceptance record | Acceptance date, IP address, contract version and text hash | Proving that the contract was concluded | KVKK art. 5/2-ç and 5/2-e | 10 years |
| Customer account | Name, e-mail, phone, password hash (the password itself is not stored), address book | Opening and managing the account, order history | KVKK art. 5/2-c | Until the account is closed; order records 10 years |
| Newsletter (double opt-in) | E-mail address, language, subscription and confirmation dates with the IP address truncated (last part removed) at those moments, consent text and version, source form, delivery logs | Sending campaigns, new products and announcements; proving consent | Explicit consent (KVKK art. 5/1) and commercial message consent (Law 6563 art. 6) | Until you withdraw consent; withdrawal record 3 years; unconfirmed sign-ups 7 days |
| Security logs | IP address, browser data, login attempts, error logs | Information security, abuse prevention | KVKK art. 5/2-f (legitimate interest) | 90 days – 1 year (see table below) |
| Analytics cookies (Google Analytics, via Google Tag Manager) | Cookie ID, pages visited, device/browser data, truncated IP address | Measuring visits, improving the site | Explicit consent (KVKK art. 5/1) — "Analytics" category in the cookie banner | As listed in the cookie policy |
| Marketing cookies (Meta Pixel, Google Ads, Google Tag Manager) | Cookie IDs, pages visited, clicked links, add-to-cart / order events and value, IP address, browser data | Measuring ad effectiveness, showing relevant ads on advertising platforms | Explicit consent (KVKK art. 5/1) — "Marketing" category in the cookie banner | As listed in the cookie policy |
| Cookie consent record | Your choice (categories), consent text version, time, a random ID, truncated IP address — no name or contact data | Proving that consent was given or withdrawn | KVKK art. 5/2-ç and 5/2-e | See retention table below |
| Call-back ("Call me") and short enquiry forms | Name, phone, (optional) e-mail, preferred call time, message, page the form was sent from; technically IP address and browser data | Calling you back, giving product and price information, answering your pre-sales request | KVKK art. 5/2-c (pre-contractual steps at your request) and 5/2-f (legitimate interest) | Request 2 years; IP/browser 6 months |
| Project quotes and installation/service requests | Name, company, e-mail, phone, city, project details; technically IP address | Preparing quotes, scheduling site surveys and installation | KVKK art. 5/2-c (pre-contractual steps at your request) | Request 2 years; IP 6 months |
| Dealer application | Company name, tax office and tax number (may be a national ID number for sole traders), contact person, phone, e-mail, city/district, address, field of activity, message; technically IP address and browser data | Assessing the application, contacting you, establishing the dealership if approved | KVKK art. 5/2-c and 5/2-f | Rejected applications deleted 1 year after the decision; approved applications for the term of the dealership and 10 years after; IP/browser 6 months |
| Dealer account and dealer orders | Company and tax details, contact person, contact and address details, dealer group and discount, order and invoice data | Performing the dealership agreement, sales at dealer prices, invoicing and delivery | KVKK art. 5/2-c and 5/2-ç (Tax Procedure Law, Commercial Code) | For the term of the dealership; order and invoice records 10 years |
| Server-side measurement events (Meta Conversions API / Google Analytics Measurement Protocol) | Event type (enquiry, add to cart, checkout, purchase), value and product IDs, order number, ad/analytics cookie IDs (_fbp, _fbc, _ga), IP address, browser data; irreversible hash (SHA-256) of e-mail, phone, name and city | Measuring ad and sales conversions | Explicit consent (KVKK art. 5/1) — Marketing (Meta) / Analytics (Google) category in the cookie banner; nothing is sent without consent | Order-time context record 1 months; IP and browser data deleted right after sending |
| Requests sent from your account (order cancellation, return/withdrawal, account deletion) | Request type, reason, your note, order number, language, truncated IP address | Handling your request, processing withdrawals and returns, deleting the account and proving this | KVKK art. 5/2-c, 5/2-ç (Law 6502, Distance Contracts Regulation) and 5/2-e | With the related order record (10 years); account deletion requests for the same period as proof |
3. How we collect data
Your data is collected electronically from you through forms, order and account screens on the site, and automatically through server logs and (only with your consent) cookies.
4. Recipients
| Recipient | Country | Purpose |
|---|---|---|
| Güzel Hosting | Türkiye | Hosting |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Türkiye | Payment processing (card data is entered directly at the payment institution and not stored by us) |
| HepsiJET | Türkiye | Delivery |
| Google LLC / Google Ireland Ltd. | USA / Ireland | visit measurement (only with Analytics consent), ad measurement (only with Marketing consent) |
| Meta Platforms Ireland Ltd. | Ireland / USA | Ad measurement (only with Marketing consent) |
| Accountant, competent public authorities | Türkiye | Legal obligations |
The servers of the following service providers are located abroad, so your data is transferred abroad: Google LLC / Google Ireland Ltd. (ABD/İrlanda), Meta Platforms Ireland Ltd. (İrlanda/ABD). Transfers abroad are made under Article 9 of the KVKK: where there is no adequacy decision for the destination country, one of the appropriate safeguards in art. 9/4 (such as the standard contract announced by the Board, notified to the Authority within 5 business days of signature) is provided; failing these, a transfer may only take place in the incidental cases listed in art. 9/6. This notice will be updated once the safeguard process is completed. Transfers to analytics and advertising tools happen only with the explicit consent you give for the relevant category (Analytics / Marketing) in the cookie banner; without consent these tools are not loaded and no transfer takes place.
5. Retention periods
The periods below are enforced automatically by the site software.
| Record | Period |
|---|---|
| Login attempts | deleted after 3 months |
| Customer login attempts | deleted after 3 months |
| Administrator activity logs | deleted after 1 year |
| Not-found page logs | deleted after 6 months |
| IP/browser data in contact messages | cleared after 6 months |
| Contact messages, call-back and quote requests | deleted after 2 years |
| IP/browser data in dealer applications | cleared after 6 months |
| Rejected dealer applications | deleted after 1 year |
| IP/browser data in orders | cleared after 2 years |
| IP data in payment records | cleared after 2 years |
| Personal data in unpaid, uninvoiced (abandoned) orders | anonymised after 6 months |
| Order-time measurement records (cookie IDs, IP) | deleted after 1 months |
| Cookie consent records | deleted after 2 years |
| E-mail delivery logs | deleted after 1 year |
| Newsletter delivery records | deleted after 1 year |
| Distance contract acceptance records | deleted after 10 years |
| Raw visit statistics records | deleted after 3 months |
6. Special categories of personal data
Our site and forms do not ask for special categories of personal data such as health, biometric, religious or criminal-record data; please do not include such information in forms or messages. Fingerprint, face or palm data you enrol on a smart lock is stored on the lock itself or in the lock's mobile app; it is never sent to this site and is not processed through this site. If you use the lock's mobile app, the app provider's privacy notice also applies.
7. Your rights and how to apply
Under Article 11 of the KVKK you have the right to: (a) learn whether your personal data is processed; (b) request information if it has been processed; (c) learn the purpose of processing and whether it is used accordingly; (ç) know the third parties to whom it is transferred in Türkiye or abroad; (d) request correction of incomplete or inaccurate data; (e) request erasure or destruction under Article 7; (f) request that (d) and (e) be notified to third parties to whom the data was transferred; (g) object to a result against you arising exclusively from automated analysis; (ğ) claim compensation for damage due to unlawful processing.
You may apply in writing (wet-signed letter to the address on our Legal information page), via registered e-mail (KEP) (smarttekteknoloji@hs09.kep.tr), with a secure electronic or mobile signature, or from an e-mail address previously registered with us to info@smartkilitsistemleri.com. We reply free of charge within 30 days at the latest (KVKK art. 13). If your application is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK art. 14). Visitors from the EU also have the rights under GDPR art. 15–22.