Privacy Policy
This notice explains what personal data Soysal International processes through this website, for what purposes and on what legal basis; who we share it with; and what rights you have. It is prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR).
Effective date:
1. Data controller
Soysal International’s incorporation is in progress. The registered company name, MERSİS and tax details will be added to this page as soon as registration is complete. Until then, the data controller can be reached through the contact channels below.
| Detail | Value |
|---|---|
| Registered company name | To be added once incorporation is complete |
| MERSİS number | To be added once incorporation is complete |
| Tax office and number | To be added once incorporation is complete |
| Registered electronic mail (KEP) address | To be added once incorporation is complete |
| VERBİS registration | Registration obligation to be assessed after incorporation |
| Address | Başakşehir Mah. Sabahattin Zaim Cad. No: 6F, Başakşehir, İstanbul, Türkiye |
| info@soysalinternational.com | |
| Telephone | +90 551 554 69 40 |
2. Personal data we process
This site has no accounts, no sign-up and no payments. Personal data is processed only when you complete the quote request form, and to the extent technically necessary to serve the site.
| Category | Data | Source |
|---|---|---|
| Identity | Full name | Quote form (required field) |
| Contact | Company name, email address, telephone number, preference to be contacted on WhatsApp | Quote form |
| Request details | Destination country, preferred Incoterm, lead time, requested certificates, the product list you type into the free-text field | Quote form |
| Uploaded file | The list or photo you optionally upload (xlsx, xls, csv, pdf, png, jpg, webp, heic; up to 4 MB). If the file itself contains other personal data, we process that too — so please send only what your request requires. | Quote form (optional) |
| Technical / security | IP address, request headers sent by your browser, submission time and bot-verification result; server log records | A technical consequence of visiting the site |
We do not request and do not wish to process special category data (health, biometric data, membership information and similar). Please do not include such information in the form or in the file you upload.
3. Why we process it
- Assessing your request, sourcing a suitable manufacturer or supplier for each item, and preparing a consolidated quote for you
- Contacting you about the quote and following up by email, telephone or — if you chose it — WhatsApp to complete missing information
- If the request becomes an order, carrying out the purchase, shipment, customs formalities and invoicing
- Keeping the site and the form secure: blocking automated (bot) submissions and detecting abuse
- Meeting our statutory bookkeeping, document retention and tax obligations
We do not use your data to send advertising, newsletters or bulk marketing email. We contact you only about the request you submitted. If we ever wish to send marketing messages, we will ask for your separate, explicit consent first.
We do not use your personal data for automated decision-making or profiling. A human prepares the quote.
4. Legal basis
| Processing | KVKK | GDPR |
|---|---|---|
| Receiving and answering a quote request | Art. 5(2)(c) — directly related to the conclusion or performance of a contract | Art. 6(1)(b) — steps taken at your request prior to entering into a contract |
| Site and form security, bot protection | Art. 5(2)(f) — legitimate interests | Art. 6(1)(f) — legitimate interests (protecting our infrastructure from abuse) |
| Bookkeeping, document and invoice retention | Art. 5(2)(ç) — compliance with a legal obligation | Art. 6(1)(c) — compliance with a legal obligation |
| Remembering your language preference | Strictly functional, as you make the choice yourself; also Art. 5(2)(f) | Art. 6(1)(f) — legitimate interests |
5. Who we share it with
We do not sell or rent your personal data and we do not share it with advertising networks. Sharing is limited to the parties below and to the purposes stated above.
| Recipient | Purpose | Where |
|---|---|---|
| Cloudflare, Inc. — hosting | Hosting the site and running the server code that processes the quote form (Cloudflare Workers); server logs | Global edge network |
| Resend, Inc. | Delivering the form content and its attachment to us by email | USA / EU |
| Cloudflare, Inc. — Web Analytics | Cookieless visitor statistics: how often each page is viewed, which country the visit came from, which site referred you, and browser type. No identifier is created that would recognise you across sessions. | Global edge network |
| Cloudflare, Inc. — Turnstile | Turnstile bot verification. Signals passed: your IP address, TLS fingerprint, User-Agent header, and the site key with its associated origin. See section 11 for details. | USA |
| Google Ireland Ltd. / Google LLC | Serving font files; and, only if you click to load it on the About page, the map service | EU / USA |
| Manufacturers, suppliers, freight forwarders, customs brokers, insurers and banks | Preparing the quote and, if your request becomes an order, carrying out shipment, customs clearance and payment. Each party receives only what it needs, not the whole request. | Türkiye and third countries depending on the party |
| Competent public authorities | Only where legally required, and limited to the scope requested | Türkiye |
6. International transfers
As the table above shows, we obtain hosting, email and bot-protection services from providers established outside Türkiye. This means personal data is transferred abroad. Such transfers are carried out under Article 9 of the KVKK, on the basis of contracts with those providers and the appropriate safeguards the law requires.
If you are located in the European Union: your data is transferred to Türkiye so that we can act on your request. The European Commission has not issued an adequacy decision for Türkiye. This transfer is necessary for pre-contractual steps taken at your request under Article 49(1)(b) GDPR; in addition, standard contractual clauses apply with our service providers.
The legal bases in this section will be updated in line with the data processing agreements concluded after incorporation and, where required, notifications to the Turkish Data Protection Authority.
7. How long we keep it
| Data | Period | Reason |
|---|---|---|
| Quote requests that do not become orders (form content and attachment) | 2 years | So that a returning customer’s request can be assessed together with its history, and so that correspondence can be evidenced in a possible dispute |
| Requests that become orders, together with invoices and shipping documents | 10 years | Statutory bookkeeping and document retention obligations under Turkish commercial and tax law |
| Server logs | The provider’s short retention window | Debugging and security |
When a period expires, the data is deleted or anonymised. You may ask us to delete it sooner; unless a legal obligation prevents it, we will comply.
8. Security measures
- The entire site is served over HTTPS, with an HSTS header instructing browsers to use a secure connection only.
- A Content Security Policy restricts which sources the browser may load scripts, fonts and frames from, and permits form submission only to our own server.
- The quote form is protected in four layers: origin verification, invisible bot verification, field validation, and checking both the extension and the declared type of any uploaded file.
- Executable files and formats that can carry scripts (such as SVG) are rejected, and file names are sanitised on the server.
- Your request is delivered by email to an authorised company mailbox only, and access is limited to those who need it for their work.
No technical measure provides absolute security. We cannot entirely eliminate the risks that arise while information travels over the internet, so we recommend not sending sensitive information that your request does not require.
9. Your rights
Under Article 11 of the KVKK you may apply to the data controller and request the following:
- To learn whether your personal data is being processed and, if so, to request information about it
- To learn the purpose of processing and whether the data is used in line with that purpose
- To know the third parties, in Türkiye or abroad, to whom the data has been transferred
- To request rectification of incomplete or inaccurate data, and notification of that to the parties it was transferred to
- To request erasure or destruction within the conditions set by the law
- To object to a result to your detriment produced solely by automated analysis
- To claim compensation if you suffer damage due to unlawful processing
If you are located in the European Union, you additionally have the GDPR rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may also lodge a complaint with the data protection authority in your country.
10. How to make a request
You can send your request by email to info@soysalinternational.com, or in writing to the postal address above. Please state your name, contact details and your request clearly; we cannot act on a request if we are unable to verify your identity.
We will respond within 30 days at the latest. No fee is charged unless responding entails an additional cost.
A KEP address and an email address dedicated solely to data protection requests will be added to this section once incorporation is complete.
11. Bot protection (Cloudflare Turnstile)
The quote request form uses Cloudflare Turnstile to block automated submissions. It runs invisibly: you do not have to tick a box or select images — filling in the form is enough. Without this protection the form would quickly fill with automated submissions and genuine requests would be lost.
During verification the following signals are passed from your browser to Cloudflare: your IP address, TLS fingerprint, User-Agent header, and our site’s Turnstile key together with its associated origin. Cloudflare states that it cannot directly identify an individual from these signals. Turnstile sets no cookies and is not used for advertising; it loads only on the page containing the form.
Cloudflare acts in two distinct roles here: as a data processor acting on our instructions when protecting our site, and as an independent data controller when improving Turnstile’s bot-detection algorithm. The terms applying to that second role are set out in Cloudflare’s Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/
Legal basis: Article 5(2)(f) KVKK and Article 6(1)(f) GDPR — legitimate interests. The legitimate interest is protecting the quote form from abuse and being able to distinguish genuine requests so that we can respond to them.
13. Changes to this notice
We may update this notice as our services or the law change. The current version is always published on this page, with its effective date shown at the top.