Privacy Notice on the Protection of Personal Data

1. Identity of the data controller

This notice is issued by Habib Makina Sanayi ve Ticaret Anonim Şirketi (“the Company”, “we”) acting as data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).

When you visit the Company's website at habibmakina.com.tr, send us a request through it or open a user account, your personal data is processed as set out below.

The Company's registry and application details are listed below. Its postal address, telephone number and general e-mail address appear in the “Contact us” block at the foot of this page.

• Registered name: Habib Makina Sanayi ve Ticaret Anonim Şirketi
• MERSIS (central registry) number: 0454001184200010
• Tax office and tax number: Şişli Tax Office — 4540011842
• KEP (registered electronic mail) address: habibmakinasan@hs01.kep.tr
• E-mail address for data protection applications: info@habibmakina.com.tr

2. Personal data we process

If you open an account, complete a request form or browse the catalogue, the following categories of data are processed. The category names follow the data-category list published by the Turkish Personal Data Protection Authority.

• Identity: first and last name; the contact person's name in a reseller application; and your national identity number where you choose to enter it instead of a tax number, either on your account's “My details” page or in a reseller application.
• Contact: e-mail address, mobile and work telephone, province and district, and — for a service request — the site address where the machine stands together with the name and telephone of the person responsible there.
• Customer transaction — company and commercial data: company title, tax office, tax number — including the tax number you optionally enter on your account's “My details” page as well as the one given in a reseller application; and, for approved reseller accounts, the discount rates defined for that account.
• Customer transaction — request content: the type of request (quotation, order, service, installation, maintenance, spare parts, warranty, exhibition stand), its subject, your description and notes, the products requested with their stock codes and quantities, the machine's brand, model and serial number, whether production is stopped, and how you heard of us.
• Customer transaction — files you upload: machine photographs and spare-part lists attached to a request, together with each file's name, type and size.
• Customer transaction — account and preference data: your language, your consent to commercial electronic messages, the date on which you accepted the privacy notice and the version you accepted.
• Marketing: your favourites, the lists you create and their lines, the interests you tick (brands and product groups), a record of the product families you view, and the feedback you leave in the technical solution centre.
• Transaction security: the authentication cookies that keep your session open, and the browser information and hashed IP address kept in the open-event log of links you share.
• Newsletter subscription: the email address you give when subscribing to the newsletter and, optionally, your name, company name and how you heard about us. This is recorded only when you explicitly choose to subscribe; for a visitor without an account it is not combined with any other data.
• Marketing — where your visit came from: if you give explicit consent to measurement cookies, the domain name of the site that referred you on your first arrival (a search engine or the site where you saw the link; the domain name only, not the full address) together with the address of the first page you opened. These two pieces of information are used solely to measure which channel and which page produce requests; if you do not consent, neither is stored at all.

3. Special categories of personal data

The site neither asks for nor collects the special categories of personal data listed in Article 6 of the KVKK (health, biometric data, criminal convictions, religion, trade-union membership and the like). None of our forms contains a field of that kind.

Please do not put such information into free-text fields or into the files you upload. If it nevertheless reaches us, it is processed only so far as handling your request requires and is destroyed once it is no longer needed.

4. Purposes of processing

The data above is processed for the following purposes and no others:

• Where you subscribe to the newsletter, sending campaign, new product and sector content announcements by email, and improving that content through open and click statistics for the newsletter.
• Receiving, recording, routing to the relevant sales or service representative and concluding your quotation, order, service, installation, maintenance, spare-part and warranty requests.
• Contacting you about your request by e-mail, telephone or WhatsApp, and letting you follow it by its reference number.
• Creating your user account, verifying your identity, keeping the account secure and providing account features such as favourites and lists.
• Assessing your reseller application and, if approved, setting up your dealer status and discounts.
• Issuing your invoices and quotations under the correct legal name and tax number, and matching your account to your ledger account in our accounting records; where you have given explicit consent to advertising measurement, that match is also used to measure which advertisement led to which business.
• Bringing forward the products that suit you, based on the items you view and the interests you tick.
• Sending campaign and new-product announcements by e-mail where you have given explicit consent.
• Running customer satisfaction processes and assessing complaints and suggestions.
• Keeping request and quotation records for the limitation period so that they may serve as evidence in any future dispute.
• Maintaining information security, preventing misuse and meeting our legal obligations.
• Assessing and concluding applications made under Article 11 of the KVKK.

5. The legal ground behind each purpose

Every purpose rests on one of the grounds set out in Article 5 of the KVKK. The mapping between purpose, ground and data category is as follows:

• Directly related to the conclusion or performance of a contract (Art. 5/2-c) — handling your request, preparing a quotation, operating your account and assessing your reseller application. Data categories: identity, contact, customer transaction, transaction security.
• Necessary for the establishment, exercise or protection of a right (Art. 5/2-e) — keeping request and quotation records for the limitation period so that they may serve as evidence in a dispute. Data categories: identity, contact, customer transaction.
• Compliance with a legal obligation (Art. 5/2-ç) — retention and disclosure duties arising from tax, commercial and consumer legislation, responding to requests from competent public authorities founded in legislation, and answering data protection applications. Data categories: identity, contact, customer transaction, transaction security.
• Legitimate interest (Art. 5/2-f) — keeping our systems and information secure, preventing misuse, running customer satisfaction processes and bringing forward the products that suit you. Data categories: customer transaction, marketing, transaction security.
• Explicit consent (Art. 5/1) — taken only for commercial electronic messages, and withdrawable at any time. Consent may be given when opening an account or through the newsletter form on the site; newsletter subscription and the sending of the newsletter also rest on this ground. Withdrawing it does not affect the handling of your request. Data categories: identity, contact, marketing.
• Because no special category of personal data is processed, none of the conditions in Article 6 of the KVKK is relied on.

6. How we collect your data

Your personal data is collected electronically and by partly automated means when you complete the sign-up and request forms on the site, choose to sign in with your Google account, upload files, and use the site.

If you sign in with Google, only your name and e-mail address are passed to us; your password never reaches us.

7. Who we share your data with

Your data is transferred within the conditions of Article 8 of the KVKK, only to the extent the purposes above require, and only to the parties below. The purpose and legal ground of each transfer are given alongside it. We do not sell or hand over your data to third parties for marketing purposes, and we do not pass it to our dealers or business partners.

• Zoho Corporation (Zoho Desk) — every request you send through the site is created as a support ticket in Zoho Desk. Your name, e-mail address, telephone, company title, the content of your request and the files you attach appear in that ticket, and the sales or service representative handling it reads it there. Purpose: handling and tracking the request. Ground: Art. 5/2-c.
• Supabase Inc. — user accounts, request records and the files you upload are held in Supabase's database and file storage infrastructure. Purpose: providing the service and storing the data. Ground: Art. 5/2-c and Art. 5/2-f.
• Vercel Inc. — the website is hosted on Vercel's infrastructure. Purpose: publishing the site and maintaining information security. Ground: Art. 5/2-f.
• Anthropic PBC — the messages you write to the chat assistant on the site, and the assistant's replies, are sent to Anthropic's artificial intelligence service in the United States so that the reply can be produced. If you typed them into the chat yourself, your name, e-mail address and telephone number are inside those messages as well. The servers are abroad, so this is also a transfer abroad within the meaning of Art. 9 of the KVKK. Purpose: answering your question. Ground: Art. 5/2-f. You are not obliged to use the assistant; nothing you do not write is transferred.
• Google LLC — in three separate cases: (i) if you choose to sign in with Google, for authentication, ground Art. 5/2-c; (ii) if you consent to measurement cookies, for site usage statistics (Google Analytics), ground explicit consent; (iii) if you consent to advertising measurement, to upload the advertising click identifier attached to your request as an offline conversion, ground explicit consent. Without your consent, (ii) and (iii) never happen.
• PostHog Inc. — if you consent to measurement cookies, to understand how the site is used: heatmaps, usage funnels and session recording. The data is held on PostHog’s European Union infrastructure (EU Cloud); because Türkiye is not a member of the European Union, this too is a transfer abroad within the meaning of KVKK Art. 9. Ground: explicit consent. Without your consent PostHog is never loaded and not a single request is sent.
• MailerLite (UAB MailerLite) — only if you subscribe to the newsletter, your email address and, where given, your name are transferred so that the mailing list can be held and the emails sent. Newsletter tools measure whether a message was opened and whether links in it were clicked; that measurement is part of this transfer. Ground: explicit consent. Your record is deleted when you unsubscribe.
• Competent public authorities — where there is a request founded in legislation, and within its limits. Ground: Art. 5/2-ç.
• No other transfer takes place within Türkiye.

8. Transfer abroad

If you subscribe to the newsletter, your email address and, where given, your name are transferred to the servers of MailerLite, the provider that sends the newsletter. MailerLite is a European Union company; since Türkiye is not an EU member, this too is a transfer abroad within the meaning of art. 9 of the Law. The legal ground is your explicit consent, and your record is deleted when you withdraw it.

Because the servers of the service providers listed above are located outside Türkiye, your personal data is transferred abroad within the meaning of Article 9 of the KVKK.

The Law allows three routes for such a transfer: to a country covered by an adequacy decision of the Board (Art. 9/1); failing that, on one of the appropriate safeguards — a standard contract, binding corporate rules or an undertaking (Art. 9/2); and failing those, the incidental cases listed in Article 9/6.

The route relied on here: [TBD: which safeguard is relied on — the standard contract published by the Board, or an undertaking; and, where a standard contract has been signed, the date it was notified to the Board]. Where a standard contract is used, the Law requires it to be notified to the Board within five business days of signature.

You may ask us which route applies and what data has been transferred, using any of the application channels below.

Sending a notification technically passes through the push service your device is attached to: Google (USA) for Android and Chrome, Apple (USA) for iPhone and Safari. The title and body of the notification and your device’s notification address are passed to those services; your name, e-mail address and telephone number are not. The legal basis for this transfer is your explicit consent.

9. Retention and destruction periods

Your personal data is kept for as long as the purpose it was collected for requires, and for the limitation and retention periods prescribed by the applicable legislation; at the end of those periods it is deleted, destroyed or anonymised.

The periods below are fixed in the Company's retention and destruction policy. Until that policy is settled the period fields are left open: no figure appears in this text that we cannot source.

• Account data: for as long as your account remains open; when you ask us to close it, the data is deleted within [TBD: retention period after an account is closed].
• Request records and uploaded files: from the conclusion of the request, for [TBD: retention period to be set against commercial and tax legislation].
• Quotation and order correspondence: [TBD: retention period to be set against the applicable limitation period].
• Your commercial-message consent and its history: from the withdrawal of consent, for [TBD: retention period to be set against Law No. 6563 and its secondary legislation].
• Browsing, favourite and interest records: [TBD: how long recommendation records are kept].
• Browser information and hashed IP address in link open-event logs: [TBD: how long security logs are kept].
• Data protection application records: from the conclusion of the application, [TBD: how long application records are kept].
• Periodic destruction interval: [TBD: the Regulation on the Deletion, Destruction or Anonymisation of Personal Data requires this interval not to exceed six months].

10. Cookies and data stored in your browser

The site uses three groups of cookie: strictly necessary cookies, measurement cookies and advertising measurement cookies. Strictly necessary cookies are required for the site to work and are always used; no explicit consent is sought for them. The other two groups are asked about separately in the cookie banner on the site, and only the groups you consent to are ever switched on. Without your consent those cookies are never loaded and nothing is sent to Google or PostHog.

You may withdraw a consent you have given at any time and without giving a reason: the "Cookie preferences" link at the foot of every page reopens the cookie window and lets you set your choices again. Withdrawal takes effect going forward — from that moment those cookies are no longer loaded and no further transfer is made to Google or PostHog.

• Strictly necessary (technical) cookies: the authentication cookies that keep your session open once you sign in. Account features do not work without them. Under the Board's guidance on cookie practices, strictly necessary cookies do not require explicit consent; the grounds are Art. 5/2-c and Art. 5/2-f.
• Measurement cookies (Google Analytics and PostHog): switched on with your explicit consent. They exist to show which pages are useful, where visitors give up and how the site is used. Your name, e-mail address and telephone number are never sent to Google Analytics; measurement runs on a pseudonymous identifier tied to the browser, not to a person.
• Session recording (PostHog): if you consent to measurement cookies, your movement on the page — clicks, scrolling and mouse movement — is recorded so that we can see where the site makes things hard. Page text and link addresses are masked at source in the recording: what you type into forms, the name, e-mail address and telephone number shown on screen, and addresses carrying a quotation or request number are stripped at source so that they do not enter the recording. Session recording is switched off entirely on your account pages; in the administration and dealer areas no measurement runs at all.
• Advertising click identifier (Google click ID): if you arrived by clicking a Google ad, the click identifier carried in the address is stored in a first-party cookie on our own domain only. On its own it is never sent anywhere and is not used for profiling; it is attached to a quotation or service request only when you submit one. This storage serves the measurement of our own advertising spend and rests on legitimate interest (Art. 5/2-f).
• Visit-source cookies (referring domain and landing page): switched on with your explicit consent to measurement cookies. The domain name of the site that referred you on your first arrival and the address of the first page you opened are stored in first-party cookies on our own domain only. Only your first arrival is recorded, not your subsequent browsing; the query part of the address is never stored, and the addresses of "My account" pages are never written. This information is not sent to Google or PostHog; it is attached to a quotation or service request only when you submit one, and is used to measure which channel and which page produce requests. When you withdraw your consent these cookies are deleted.
• Advertising measurement cookies and offline conversion upload to Google: switched on with your explicit consent. Once you consent, Google's advertising cookies (ad_storage, ad_user_data, ad_personalization) are loaded, and the advertising click identifier attached to your request is uploaded to Google as an offline conversion so that we can measure which ad actually produced a request. That upload is an international transfer (KVKK Art. 9) and is made only with your explicit consent. Without it the click identifier stays with us and nothing is sent to Google.
• Your language preference: carried in the address itself (/en, /ru) rather than in a cookie, and held on your account record if you have one.
• Your comparison list: kept only in your browser's local storage, never sent to our servers, and removed when you clear your browsing data.
• Your cookie choice is also kept in your browser's local storage, together with the version of the notice you agreed to and the date you agreed. When this notice changes materially, an earlier agreement no longer covers it and the cookie window reappears by itself.
• You can also delete or block cookies in your browser settings. If you block the strictly necessary cookies, your session will not stay open and account features will not work.
• Notification subscription: so that we can send notifications to your phone or browser, the moment you grant permission your browser generates an address unique to your device and shares it with us. That address is used only to send you notifications; it is not used for advertising measurement, identity matching or any other purpose, and it is not sold to third parties. The legal basis is your explicit consent (art. 5/1).
• You can withdraw notification permission at any time: turning the site’s permission off in your phone’s or browser’s notification settings is enough, and you can also turn it off from your account settings page. When you withdraw it, your subscription record is deleted and no further notifications are sent. If the address is no longer valid (you removed the app or turned the permission off) we learn this while sending and delete the record at that moment.

11. Your rights under Article 11 of the KVKK

As a data subject you may apply to the Company and:

• Learn whether your personal data is being processed.
• Request information about it if it has been processed.
• Learn the purpose of the processing and whether the data is used in accordance with that purpose.
• Know the third parties in Türkiye or abroad to whom your data has been transferred.
• Request that incomplete or inaccurate data be corrected.
• Request deletion or destruction of the data within the conditions of Article 7 of the KVKK.
• Request that any correction, deletion or destruction be notified to the third parties to whom the data was transferred.
• Object to a result reached against you through analysis carried out solely by automated systems.
• Claim compensation for damage suffered as a result of unlawful processing.

12. How to apply

You may submit your request through any of the channels below, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications must be made in Turkish.

• In writing: bring your signed letter in person to the address at the foot of this page, or send it through a notary or by registered post with return receipt.
• To our KEP address: from your own registered electronic mail address to habibmakinasan@hs01.kep.tr.
• With a secure electronic signature: send your signed application to info@habibmakina.com.tr.
• With a mobile signature: send your signed application to the same address.
• From the e-mail address registered in our system: write from the address held on your account to info@habibmakina.com.tr.
• Your application must state: your first and last name; your signature, for a written application; your Turkish identity number, or — if you are a foreign national — your nationality and passport or identity number; your address of residence or place of business for service; your e-mail address, telephone and fax number if you have given any for notification; the subject of your request; and any information and documents supporting it.

13. How your application is concluded

Depending on its nature, your application is concluded as soon as possible and within thirty days at the latest, free of charge. Where the process entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your application is refused, if you find our answer insufficient, or if no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of the date of your application (KVKK Art. 14). You must have applied to us first before taking a complaint to the Board (KVKK Art. 13).

The personal data in your application is processed only to verify your identity and conclude the application, and is kept for the period prescribed by legislation.

14. The Data Controllers' Registry (VERBİS)

Whether a controller must register with the Data Controllers' Registry is decided on criteria such as its annual number of employees, its annual balance-sheet total and its main field of activity; the Board may exempt controllers that fall below those thresholds.

The Company's position against those criteria: [TBD: whether the Company is required to register with VERBİS; if so, its registry number and date of registration; if not, the exemption relied on]. This section will be updated once that is settled.

15. Data security

Appropriate technical and organisational measures are taken under Article 12 of the KVKK to prevent the unlawful processing of your personal data and unlawful access to it, and to keep it safe. Site and account traffic travels over an encrypted connection, database access is restricted by row-level authorisation, and integration keys are held outside the application code.

If it is established that your personal data has been obtained by others through unlawful means, you and the Personal Data Protection Board will be notified as soon as possible.

16. Changes to this notice

This notice may be updated to reflect changes in legislation or in our processes. Each update is published with the version number and effective date shown above, and the version you accepted is recorded on your account.