Privacy Policy

1. Introduction

TurkMerchants ("we", "us", "our") is committed to protecting your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK), the European Union General Data Protection Regulation (GDPR), and all applicable data protection legislation. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Platform. As the data controller, TurkMerchants processes your personal data in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

2. Data We Collect

We collect the following categories of personal data: (a) Identity Data: full name, company name, job title, user type (buyer/supplier); (b) Contact Data: email address, phone number, business address, city, country; (c) Account Data: username, password (encrypted), account preferences, membership tier; (d) Business Data: company profile information, product listings, certifications, factory photos and videos, trade show participation; (e) Communication Data: messages sent through the Platform, inquiry details, quotation requests and responses; (f) Technical Data: IP address, browser type and version, device information, operating system, access times, pages visited, referring URLs; (g) Usage Data: Platform interaction patterns, search queries, feature usage, click behavior. We collect this data directly from you when you register, create listings, or communicate through the Platform, and automatically through cookies and similar technologies when you browse the Platform.

3. How We Use Your Data

We process your personal data for the following purposes: (a) to provide and maintain the Platform services; (b) to create and manage your account; (c) to facilitate connections between Buyers and Suppliers; (d) to process and respond to your inquiries and quotation requests; (e) to send transactional emails including account verification, password resets, and inquiry notifications; (f) to improve the Platform through usage analytics and user feedback; (g) to ensure Platform security and prevent fraud; (h) to comply with legal obligations under Turkish and applicable international law; (i) to enforce our Terms of Service; (j) to provide customer support. We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal effects.

4. Legal Basis for Processing (KVKK Article 5 & GDPR Article 6)

We process your personal data based on the following legal grounds under KVKK and GDPR: (a) Your explicit consent, which you provide when registering on the Platform; (b) Performance of a contract to which you are a party (providing Platform services); (c) Compliance with legal obligations (tax regulations, commercial law requirements); (d) Our legitimate interests in operating and improving the Platform, provided these do not override your fundamental rights and freedoms; (e) Establishment, exercise, or defense of legal claims. Under KVKK Article 5, we also process data where it is necessary for our legitimate interests, provided that your fundamental rights are not harmed. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing and Transfers

We may share your personal data with: (a) Other Platform Users: your business profile information, product listings, and communications are visible to other Users as part of the Platform's matchmaking functionality; (b) Service Providers: we use trusted third-party services for email delivery (Resend), database hosting (Neon/PostgreSQL), and server hosting (DigitalOcean) — these providers process data on our behalf under data processing agreements; (c) Legal Authorities: when required by Turkish law, court orders, or regulatory requests. For international data transfers outside of Turkey, we ensure appropriate safeguards are in place as required by KVKK Article 9 and GDPR Chapter V, including standard contractual clauses where applicable. We do not transfer your data to countries without adequate data protection levels unless appropriate safeguards are implemented.

6. Data Storage and Security

Your personal data is stored on secure servers. We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include: encrypted password storage using bcrypt hashing, SSL/TLS encryption for data in transit, session management with secure cookies, CSRF protection on all forms, regular security audits, and access controls limiting data access to authorized personnel only. We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Account data is retained for the duration of your account and for up to 3 years after account closure for legal compliance purposes.

7. Your Rights

Under KVKK Article 11 and GDPR Articles 15-22, you have the following rights regarding your personal data: (a) Right of Access: request information about whether your personal data is being processed and obtain a copy; (b) Right to Rectification: request correction of inaccurate or incomplete data; (c) Right to Erasure: request deletion of your personal data under certain conditions; (d) Right to Restriction: request limitation of processing under certain conditions; (e) Right to Data Portability: receive your data in a structured, commonly used format (GDPR); (f) Right to Object: object to processing based on legitimate interests; (g) Right to Withdraw Consent: withdraw your consent at any time; (h) Right to Complain: lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurulu) or a relevant EU supervisory authority. To exercise these rights, contact us through the Platform help center. We will respond to your request within 30 days as required by KVKK.

8. Cookies

We use cookies and similar technologies to operate the Platform, maintain your session, remember your preferences (such as language selection), and analyze Platform usage. For detailed information about the types of cookies we use and how to manage them, please refer to our Cookie Policy.

9. Children's Privacy

The Platform is designed for business-to-business use and is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe that a minor has provided us with personal data, please contact us immediately.

10. International Data Transfers

Our Platform may be accessed from various countries. When your data is transferred outside of Turkey or the European Economic Area, we ensure compliance with KVKK Article 9 and GDPR Chapter V requirements. We use service providers located in the United States and Europe, and we have implemented appropriate safeguards including standard contractual clauses and data processing agreements to protect your data during international transfers. The Turkish Personal Data Protection Board's adequacy decisions and the European Commission's adequacy decisions are considered when determining transfer mechanisms.

11. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by posting a notice on the Platform or sending you an email. The updated policy will be effective from the date stated at the top of the policy. We encourage you to review this policy periodically.

12. Contact & Data Protection Officer

For any questions about this Privacy Policy, to exercise your data protection rights, or to file a complaint regarding the processing of your personal data, please contact us through the Platform help center. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu - KVKK) at www.kvkk.gov.tr, or with a relevant EU Data Protection Authority if you are located in the European Economic Area.