Privacy Notice

1. Data Controller

Eko Halı acts as the data controller as defined in Article 3 of the KVKK. Our contact details are set out below.

• Data Controller — Eko Halı
• Address — Yukarı Dudullu Mah. Necip Fazıl Bulvarı, Keyap Ticaret Merkezi, J/2 Blok, No:160 Ümraniye 34775, Istanbul, Türkiye
• Phone — +90 (216) 590 02 00
• E-mail — info@ekohali.com

2. Personal Data We Process

The data we process depends on which channel you use on our website. We only process what you yourself submit in the relevant form.

• Contact Form — Full name, e-mail address, phone number, subject and message content.
• Information Request Form — Full name, e-mail address, phone number, occupation, and country, province, district and neighbourhood details.
• Dealer Application Form — Company name, contact person, year of establishment, number of partners, e-mail, phone, fax, full address, years in the sector, store and allocated floor area, product groups of interest, existing dealerships and references.
• Job Application Form — First name, last name, e-mail address, phone number, and the information contained in the CV you upload.
• Work With Us Form — Company name, contact person, company status, country, city, website, e-mail and mobile phone.
• Digital Newsletter — E-mail address.
• Customer Service — Full name, e-mail address and the message content you share during the conversation.
• Transaction Security — IP address, browser and device information, and technical error logs generated when you access the site.

When submitting a job application, please do not include special categories of personal data that we have not requested (such as health information, religion, association or union membership, or criminal convictions). Any such data submitted will not be processed and will be deleted.

3. Purposes of Processing

Your personal data is processed solely for, and limited to, the following purposes:

• Receiving and responding to your requests, questions and complaints,
• Responding to enquiries about our products and services,
• Evaluating dealer applications and managing business partnership processes,
• Evaluating job applications and managing recruitment processes,
• Sending newsletters and promotional content where you have given explicit consent,
• Operating customer service and support processes,
• Ensuring the security, continuity and technical operation of the website,
• Fulfilling our legal obligations and providing evidence in any potential dispute.

4. Method of Collection and Legal Grounds

Your personal data is collected by wholly or partly automated means when you complete a form on our website, contact us by e-mail or telephone, or visit the site.

Processing is based on the following legal grounds set out in Article 5 of the KVKK:

• Performance of a contract (Art. 5/2-c) — Evaluation of dealer and business partnership applications.
• Compliance with a legal obligation (Art. 5/2-ç) — Retention and disclosure obligations under commercial and tax legislation.
• Legitimate interests (Art. 5/2-f) — Request management, recruitment processes and website security, provided your fundamental rights and freedoms are not harmed.
• Explicit consent (Art. 5/1) — Sending newsletters and marketing communications.

5. Transfer of Personal Data

Your personal data may be transferred to the following parties in accordance with Articles 8 and 9 of the KVKK, and only to the extent necessary to achieve the purposes above. We do not sell or rent your data to third parties for marketing purposes.

• Hosting and cloud service providers that operate our website and e-mail infrastructure,
• Our error-monitoring service provider, used to detect technical faults,
• Where relevant to your request, our authorised representatives or points of sale in the relevant country,
• Competent public authorities, where required to fulfil a legal obligation.

6. Retention Periods

Your personal data is retained for as long as necessary for the purpose for which it was processed, taking into account the limitation and retention periods prescribed by applicable legislation. At the end of that period it is deleted, destroyed or anonymised.

• Contact and information request records — 2 years from resolution of the request.
• Job applications and CVs — 1 year from the date of application.
• Dealer and business partnership applications — 10 years from the end of the relationship.
• Newsletter subscription — Until you unsubscribe.

7. Your Rights Under Article 11 of the KVKK

As a data subject, you have the following rights under Article 11 of the KVKK:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether the data is used in accordance with that purpose,
• To know the third parties to whom your data is transferred, in Türkiye or abroad,
• To request correction of your personal data if it is incomplete or inaccurate,
• To request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• To request that correction, erasure or destruction be notified to third parties to whom your data was transferred,
• To object to an adverse outcome arising from analysis of your data solely by automated systems,
• To claim compensation for damage suffered as a result of unlawful processing of your personal data.

8. How to Submit a Request

You may submit requests relating to the rights above in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application should include your full name, signature, Turkish ID number (nationality and passport number for foreign nationals), address for notification, e-mail address and phone number if applicable, and the subject of your request.

• In writing — By signed letter sent to Yukarı Dudullu Mah. Necip Fazıl Bulvarı, Keyap Ticaret Merkezi, J/2 Blok, No:160 Ümraniye 34775, Istanbul, Türkiye.
• By e-mail — From the e-mail address registered in our systems, to info@ekohali.com.

Your request will be concluded free of charge as soon as possible and within thirty (30) days at the latest. Where the process incurs an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.