Privacy Notice on the Protection of Personal Data

1. Identity of the data controller

This notice is issued by Habib Makina Sanayi ve Ticaret Anonim Şirketi (“the Company”, “we”) acting as data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).

When you visit the Company's website at habibmakina.com.tr, send us a request through it or open a user account, your personal data is processed as set out below.

The Company's registry and application details are listed below. Its postal address, telephone number and general e-mail address appear in the “Contact us” block at the foot of this page.

• Registered name: Habib Makina Sanayi ve Ticaret Anonim Şirketi
• MERSIS (central registry) number: 0454001184200010
• Tax office and tax number: Şişli Tax Office — 4540011842
• KEP (registered electronic mail) address: habibmakinasan@hs01.kep.tr
• E-mail address for data protection applications: info@habibmakina.com.tr

2. Personal data we process

If you open an account, complete a request form or browse the catalogue, the following categories of data are processed. The category names follow the data-category list published by the Turkish Personal Data Protection Authority.

• Identity: first and last name; the contact person's name in a reseller application; and your national identity number where you choose to enter it instead of a tax number, either on your account's “My details” page or in a reseller application.
• Contact: e-mail address, mobile and work telephone, province and district, and — for a service request — the site address where the machine stands together with the name and telephone of the person responsible there.
• Customer transaction — company and commercial data: company title, tax office, tax number — including the tax number you optionally enter on your account's “My details” page as well as the one given in a reseller application; and, for approved reseller accounts, the discount rates defined for that account.
• Customer transaction — request content: the type of request (quotation, order, service, installation, maintenance, spare parts, warranty, exhibition stand), its subject, your description and notes, the products requested with their stock codes and quantities, the machine's brand, model and serial number, whether production is stopped, and how you heard of us.
• Customer transaction — files you upload: machine photographs and spare-part lists attached to a request, together with each file's name, type and size.
• Customer transaction — account and preference data: your language, your consent to commercial electronic messages, the date on which you accepted the privacy notice and the version you accepted.
• Marketing: your favourites, the lists you create and their lines, the interests you tick (brands and product groups), a record of the product families you view, and the feedback you leave in the technical solution centre.
• Transaction security: the authentication cookies that keep your session open, and the browser information and hashed IP address kept in the open-event log of links you share.
• Newsletter subscription: the email address you give when subscribing to the newsletter and, optionally, your name, company name and how you heard about us. This is recorded only when you explicitly choose to subscribe; for a visitor without an account it is not combined with any other data.
• Marketing — where your visit came from: if you give explicit consent to measurement cookies, the domain name of the site that referred you on your first arrival (a search engine or the site where you saw the link; the domain name only, not the full address) together with the address of the first page you opened. These two pieces of information are used solely to measure which channel and which page produce requests; if you do not consent, neither is stored at all.

3. Special categories of personal data

The site neither asks for nor collects the special categories of personal data listed in Article 6 of the KVKK (health, biometric data, criminal convictions, religion, trade-union membership and the like). None of our forms contains a field of that kind.

Please do not put such information into free-text fields or into the files you upload. If it nevertheless reaches us, it is processed only so far as handling your request requires and is destroyed once it is no longer needed.

4. Purposes of processing

The data above is processed for the following purposes and no others:

• Where you subscribe to the newsletter, sending campaign, new product and sector content announcements by email, and improving that content through open and click statistics for the newsletter.
• Receiving, recording, routing to the relevant sales or service representative and concluding your quotation, order, service, installation, maintenance, spare-part and warranty requests.
• Contacting you about your request by e-mail, telephone or WhatsApp, and letting you follow it by its reference number.
• Creating your user account, verifying your identity, keeping the account secure and providing account features such as favourites and lists.
• Assessing your reseller application and, if approved, setting up your dealer status and discounts.
• Issuing your invoices and quotations under the correct legal name and tax number, and matching your account to your ledger account in our accounting records; where you have given explicit consent to advertising measurement, that match is also used to measure which advertisement led to which business.
• Bringing forward the products that suit you, based on the items you view and the interests you tick.
• Sending campaign and new-product announcements by e-mail where you have given explicit consent.
• Running customer satisfaction processes and assessing complaints and suggestions.
• Keeping request and quotation records for the limitation period so that they may serve as evidence in any future dispute.
• Maintaining information security, preventing misuse and meeting our legal obligations.
• Assessing and concluding applications made under Article 11 of the KVKK.

5. The legal ground behind each purpose

Every purpose rests on one of the grounds set out in Article 5 of the KVKK. The mapping between purpose, ground and data category is as follows:

• Directly related to the conclusion or performance of a contract (Art. 5/2-c) — handling your request, preparing a quotation, operating your account and assessing your reseller application. Data categories: identity, contact, customer transaction, transaction security.
• Necessary for the establishment, exercise or protection of a right (Art. 5/2-e) — keeping request and quotation records for the limitation period so that they may serve as evidence in a dispute. Data categories: identity, contact, customer transaction.
• Compliance with a legal obligation (Art. 5/2-ç) — retention and disclosure duties arising from tax, commercial and consumer legislation, responding to requests from competent public authorities founded in legislation, and answering data protection applications. Data categories: identity, contact, customer transaction, transaction security.
• Legitimate interest (Art. 5/2-f) — keeping our systems and information secure, preventing misuse, running customer satisfaction processes and bringing forward the products that suit you. Data categories: customer transaction, marketing, transaction security.
• Explicit consent (Art. 5/1) — taken only for commercial electronic messages, and withdrawable at any time. Consent may be given when opening an account or through the newsletter form on the site; newsletter subscription and the sending of the newsletter also rest on this ground. Withdrawing it does not affect the handling of your request. Data categories: identity, contact, marketing.
• Because no special category of personal data is processed, none of the conditions in Article 6 of the KVKK is relied on.

6. How we collect your data

Your personal data is collected electronically and by partly automated means when you complete the sign-up and request forms on the site, choose to sign in with your Google account, upload files, and use the site.

If you sign in with Google, only your name and e-mail address are passed to us; your password never reaches us.

7. Who we share your data with

Your data is transferred within the conditions of Article 8 of the KVKK, only to the extent the purposes above require, and only to the parties below. The purpose and legal ground of each transfer are given alongside it. We do not sell or hand over your data to third parties for marketing purposes, and we do not pass it to our dealers or business partners.

• Zoho Corporation (Zoho Desk) — every request you send through the site is created as a support ticket in Zoho Desk. Your name, e-mail address, telephone, company title, the content of your request and the files you attach appear in that ticket, and the sales or service representative handling it reads it there. Purpose: handling and tracking the request. Ground: Art. 5/2-c.
• Supabase Inc. — user accounts, request records and the files you upload are held in Supabase's database and file storage infrastructure. Purpose: providing the service and storing the data. Ground: Art. 5/2-c and Art. 5/2-f.
• Vercel Inc. — the website is hosted on Vercel's infrastructure. Purpose: publishing the site and maintaining information security. Ground: Art. 5/2-f.
• Anthropic PBC — the messages you write to the chat assistant on the site, and the assistant's replies, are sent to Anthropic's artificial intelligence service in the United States so that the reply can be produced. If you typed them into the chat yourself, your name, e-mail address and telephone number are inside those messages as well. The servers are abroad, so this is also a transfer abroad within the meaning of Art. 9 of the KVKK. Purpose: answering your question. Ground: Art. 5/2-f. You are not obliged to use the assistant; nothing you do not write is transferred.
• Google LLC — in three separate cases: (i) if you choose to sign in with Google, for authentication, ground Art. 5/2-c; (ii) if you consent to measurement cookies, for site usage statistics (Google Analytics), ground explicit consent; (iii) if you consent to advertising measurement, to upload the advertising click identifier attached to your request as an offline conversion, ground explicit consent. Without your consent, (ii) and (iii) never happen.
• PostHog Inc. — if you consent to measurement cookies, to understand how the site is used: heatmaps, usage funnels and session recording. The data is held on PostHog’s European Union infrastructure (EU Cloud); because Türkiye is not a member of the European Union, this too is a transfer abroad within the meaning of KVKK Art. 9. Ground: explicit consent. Without your consent PostHog is never loaded and not a single request is sent.
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform) — if you write to us on our WhatsApp lines 0531 and 0536 or receive a WhatsApp message from us, your phone number, WhatsApp profile name, messages and the files you send are transferred to Meta so that the messages can be delivered. Purpose: receiving, answering and following up your request. Ground: art. 5/2-c and art. 5/2-f; explicit consent for campaign and announcement messages.
• MailerLite (UAB MailerLite) — only if you subscribe to the newsletter, your email address and, where given, your name are transferred so that the mailing list can be held and the emails sent. Newsletter tools measure whether a message was opened and whether links in it were clicked; that measurement is part of this transfer. Ground: explicit consent. Your record is deleted when you unsubscribe.
• Competent public authorities — where there is a request founded in legislation, and within its limits. Ground: Art. 5/2-ç.
• No other transfer takes place within Türkiye.

8. Transfer abroad

If you write to us on WhatsApp or receive a WhatsApp message from us, your phone number, WhatsApp profile name, messages and the files you send pass through the servers of Meta Platforms Ireland Ltd. and its affiliates, which provide the WhatsApp Business Platform; this is a transfer abroad within the meaning of art. 9 of the Law. The purpose is to receive, answer and follow up your request; the legal grounds are art. 5/2-c (establishing or performing a contract) and art. 5/2-f (legitimate interest). Campaign and announcement messages are sent only with your explicit consent; you can opt out at any time by writing DUR (STOP).

If you subscribe to the newsletter, your email address and, where given, your name are transferred to the servers of MailerLite, the provider that sends the newsletter. MailerLite is a European Union company; since Türkiye is not an EU member, this too is a transfer abroad within the meaning of art. 9 of the Law. Sending the newsletter rests on your explicit consent (art. 5/1); the transfer abroad is carried out in accordance with article 9 of the Law, as described above. Your record is deleted when you withdraw your consent.

Because the servers of the service providers listed above are located outside Türkiye, your personal data is transferred abroad within the meaning of Article 9 of the KVKK.

The Law allows three routes for such a transfer: to a country covered by an adequacy decision of the Board (Art. 9/1); failing that, on one of the appropriate safeguards — a standard contract, binding corporate rules or an undertaking (Art. 9/2); and failing those, the incidental cases listed in Article 9/6.

Transfers abroad are carried out on one of the grounds provided in article 9 of the Law, depending on the service provider (an adequacy decision, appropriate safeguards, or the occasional cases listed in that article); the service providers' own data processing and transfer terms apply within this framework. Where the legal ground for a processing activity is your explicit consent (newsletter, measurement and advertising measurement cookies, basket reminder and promotional notifications), that does not make explicit consent the ground for the transfer abroad as well: the processing itself takes place only if you consent, while the transfer is carried out in accordance with article 9 of the Law.

You may ask us which route applies and what data has been transferred, using any of the application channels below.

Sending a notification technically passes through the push service your browser is attached to: Google (USA) for Android and Chrome, Apple (USA) for iPhone and Safari, Mozilla (USA) for Firefox, Microsoft (USA) for Edge. The title and body of the notification and your device’s notification address are passed to those services; your name, e-mail address and telephone number are not. The legal ground for the notification itself is set out in Section 10: basket reminders and notifications about new products and promotions rest on your explicit consent, quote status notifications on art. 5/2-c and art. 5/2-f. Like the other transfers abroad, the transfer to these services is carried out in accordance with article 9 of the Law and is limited to delivering the notification.

9. Retention and destruction periods

Your personal data is kept for as long as the purpose it was collected for requires, and for the limitation and retention periods prescribed by the applicable legislation; at the end of those periods it is deleted, destroyed or anonymised.

The periods below are fixed in the Company's retention and destruction policy. Until that policy is settled the period fields are left open: no figure appears in this text that we cannot source.

• Account data: for as long as your account remains open; when you ask us to close it, the data is deleted within 30 days of closure. Quotation and order records linked to your account are kept for the periods below.
• Request records and uploaded files: those that became a quotation or an order, 10 years (Turkish Commercial Code No. 6102 art. 82, Tax Procedure Law No. 213 art. 253); the rest, 3 years from the request date.
• Quotation and order correspondence: 10 years from completion of the transaction (Turkish Code of Obligations No. 6098 art. 146, general limitation period; Turkish Commercial Code art. 82).
• Your commercial-message consent and its history: 3 years from the end of consent (Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages).
• Browsing, favourite and interest records: 1 year from the last interaction; favourites saved to your account, for as long as the account remains open.
• Browser information and hashed IP address in link open-event logs: 2 years (in line with Law No. 5651 and its regulation).
• Data protection application records: 10 years from the conclusion of the application (general limitation period).
• Notification subscription and basket reminder record: for as long as the subscription is active. When you turn notifications off or the notification address stops being valid, the subscription is deactivated, and 6 months after deactivation it is deleted together with the basket reminder record linked to it. A basket reminder record (product identifiers and quantities) left without a quote request is deleted 6 months after its last change. These deletions are made by a destruction job that runs every month; consent and withdrawal records follow the commercial-message period above.
• Periodic destruction interval: 6 months (Regulation on the Deletion, Destruction or Anonymisation of Personal Data, art. 11).

10. Cookies and data stored in your browser

The site uses three groups of cookie: strictly necessary cookies, measurement cookies and advertising measurement cookies. Strictly necessary cookies are required for the site to work and are always used; no explicit consent is sought for them. The other two groups are asked about separately in the cookie banner on the site, and only the groups you consent to are ever switched on. Without your consent those cookies are never loaded and nothing is sent to Google or PostHog.

You may withdraw a consent you have given at any time and without giving a reason: the "Cookie preferences" link at the foot of every page reopens the cookie window and lets you set your choices again. Withdrawal takes effect going forward — from that moment those cookies are no longer loaded and no further transfer is made to Google or PostHog.

• Strictly necessary (technical) cookies: the authentication cookies that keep your session open once you sign in. Account features do not work without them. Under the Board's guidance on cookie practices, strictly necessary cookies do not require explicit consent; the grounds are Art. 5/2-c and Art. 5/2-f.
• Measurement cookies (Google Analytics and PostHog): switched on with your explicit consent. They exist to show which pages are useful, where visitors give up and how the site is used. Your name, e-mail address and telephone number are never sent to Google Analytics; measurement runs on a pseudonymous identifier tied to the browser, not to a person.
• Session recording (PostHog): if you consent to measurement cookies, your movement on the page — clicks, scrolling and mouse movement — is recorded so that we can see where the site makes things hard. Page text and link addresses are masked at source in the recording: what you type into forms, the name, e-mail address and telephone number shown on screen, and addresses carrying a quotation or request number are stripped at source so that they do not enter the recording. Session recording is switched off entirely on your account pages; in the administration and dealer areas no measurement runs at all.
• Advertising click identifier (Google click ID): if you arrived by clicking a Google ad, the click identifier carried in the address is stored in a first-party cookie on our own domain only. On its own it is never sent anywhere and is not used for profiling; it is attached to a quotation or service request only when you submit one. This storage serves the measurement of our own advertising spend and rests on legitimate interest (Art. 5/2-f).
• Visit-source cookies (referring domain and landing page): switched on with your explicit consent to measurement cookies. The domain name of the site that referred you on your first arrival and the address of the first page you opened are stored in first-party cookies on our own domain only. Only your first arrival is recorded, not your subsequent browsing; the query part of the address is never stored, and the addresses of "My account" pages are never written. This information is not sent to Google or PostHog; it is attached to a quotation or service request only when you submit one, and is used to measure which channel and which page produce requests. When you withdraw your consent these cookies are deleted.
• Advertising measurement cookies and offline conversion upload to Google: switched on with your explicit consent. Once you consent, Google's advertising cookies (ad_storage, ad_user_data, ad_personalization) are loaded, and the advertising click identifier attached to your request is uploaded to Google as an offline conversion so that we can measure which ad actually produced a request. That upload is made only if you have given explicit consent; as an international transfer (KVKK Art. 9) it is carried out in accordance with article 9 of the Law, as described in Section 8. Without it the click identifier stays with us and nothing is sent to Google.
• Your language preference: carried in the address itself (/en, /ru) rather than in a cookie, and held on your account record if you have one.
• Your comparison list: kept only in your browser's local storage, never sent to our servers, and removed when you clear your browsing data.
• Your cookie choice is also kept in your browser's local storage, together with the version of the notice you agreed to and the date you agreed. When this notice changes materially, an earlier agreement no longer covers it and the cookie window reappears by itself.
• You can also delete or block cookies in your browser settings. If you block the strictly necessary cookies, your session will not stay open and account features will not work.
• Notification subscription (browser push subscription): so that we can send notifications to your phone or browser, the moment you grant permission your browser generates an address and encryption keys unique to your device and shares them with us. Alongside them we record the subscription’s language, browser information and, if you are signed in, your account. The subscription is used only to send the notifications listed in this section; it is not used for advertising measurement and it is not sold to third parties.
• Basket reminders and quote status notifications: if you tick "I'd like to receive basket reminders and notifications about new products and promotions (commercial electronic messages)" in the quote basket and give your consent, your subscription is linked to the products in your basket and we send you a reminder if you leave the basket without requesting a quote. That link holds only product identifiers and quantities; product names, your name, e-mail address and telephone number are not written to it. If you have already given an e-mail address for the basket, the subscription is linked to that basket record. If you allow notifications on the screen shown after you send a quote request, or notification permission is already on for this device, the subscription is linked to that request’s number; this stops any pending basket reminder and lets us notify you when your quote is ready. The separate, optional "I'd also like to hear about new products and promotions" box on that screen is also consent to commercial electronic messages. If you are a known contact (you are signed in, or the e-mail address in your request belongs to exactly one person in our records), your consent and its withdrawal are also recorded on that contact record, together with the date and the text you agreed to.
• Legal basis for notifications: basket reminders and notifications about new products and promotions are commercial electronic messages and are sent only with your explicit consent (Art. 5/1; Law No. 6563). Notifications about the status of your quote request are not commercial electronic messages; they rest on the performance of the contract process your request starts (Art. 5/2-c) and on our legitimate interest in letting you follow your request (Art. 5/2-f), and need no separate consent.
• You can withdraw notification permission and your consent to commercial electronic messages at any time, without giving a reason: turn the site’s permission off in your phone’s or browser’s notification settings, or use the "Turn notifications off" button on the site (the "Follow us" panel and the Contact section); if you are a known contact, you can also withdraw through any of the application channels in Section 12. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out before it. When you use the button, your subscription is deactivated, your consent to commercial electronic messages ends and, if you are a known contact, the withdrawal is recorded on your contact record; no reminder or other notification is sent after that. If you turn notifications off in your browser settings or remove the app, the address stops being valid; we learn this at the first sending attempt and deactivate the subscription at that moment. Deactivated subscriptions are never used for notifications again and are deleted 6 months after deactivation by a destruction job that runs every month; the basket reminder record linked to a subscription is deleted with it, and if you gave an e-mail address for the basket, the link between that basket record and the subscription is removed; consent and withdrawal records are kept for the period stated in Section 9 for consent to commercial electronic messages.

11. Your rights under Article 11 of the KVKK

As a data subject you may apply to the Company and:

• Learn whether your personal data is being processed.
• Request information about it if it has been processed.
• Learn the purpose of the processing and whether the data is used in accordance with that purpose.
• Know the third parties in Türkiye or abroad to whom your data has been transferred.
• Request that incomplete or inaccurate data be corrected.
• Request deletion or destruction of the data within the conditions of Article 7 of the KVKK.
• Request that any correction, deletion or destruction be notified to the third parties to whom the data was transferred.
• Object to a result reached against you through analysis carried out solely by automated systems.
• Claim compensation for damage suffered as a result of unlawful processing.

12. How to apply

You may submit your request through any of the channels below, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications must be made in Turkish.

• In writing: bring your signed letter in person to the address at the foot of this page, or send it through a notary or by registered post with return receipt.
• To our KEP address: from your own registered electronic mail address to habibmakinasan@hs01.kep.tr.
• With a secure electronic signature: send your signed application to info@habibmakina.com.tr.
• With a mobile signature: send your signed application to the same address.
• From the e-mail address registered in our system: write from the address held on your account to info@habibmakina.com.tr.
• Your application must state: your first and last name; your signature, for a written application; your Turkish identity number, or — if you are a foreign national — your nationality and passport or identity number; your address of residence or place of business for service; your e-mail address, telephone and fax number if you have given any for notification; the subject of your request; and any information and documents supporting it.

13. How your application is concluded

Depending on its nature, your application is concluded as soon as possible and within thirty days at the latest, free of charge. Where the process entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your application is refused, if you find our answer insufficient, or if no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of the date of your application (KVKK Art. 14). You must have applied to us first before taking a complaint to the Board (KVKK Art. 13).

The personal data in your application is processed only to verify your identity and conclude the application, and is kept for the period prescribed by legislation.

14. Data security

Appropriate technical and organisational measures are taken under Article 12 of the KVKK to prevent the unlawful processing of your personal data and unlawful access to it, and to keep it safe. Site and account traffic travels over an encrypted connection, database access is restricted by row-level authorisation, and integration keys are held outside the application code.

If it is established that your personal data has been obtained by others through unlawful means, you and the Personal Data Protection Board will be notified as soon as possible.

15. Changes to this notice

This notice may be updated to reflect changes in legislation or in our processes. Each update is published with the version number and effective date shown above, and the version you accepted is recorded on your account.