Privacy Notice

1. Data controller

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by BSM Mekanik Mühendislik İnşaat Sanayi ve Ticaret Limited Şirketi (“BSM Mechanical”) as data controller, as described below.

• Address: Altıntepe Mah. İstasyon Yolu Sok. No:3/1, Maltepe / İstanbul
• Email: mert@bsmmechanical.com
• Phone: +90 (216) 706 14 01

2. Personal data we process

• Identity: first and last name
• Contact: email address, phone number
• Enquiry details: company name, service requested, message content
• Security: IP address, time of submission, server access logs

3. Purposes of processing

• Reviewing and responding to your quotation, site survey and information requests
• Preparing quotations and carrying out pre-contractual steps
• Communicating with you
• Information security, and preventing spam and misuse
• Complying with legal obligations and requests from competent authorities

4. How we collect data and legal bases

We collect your personal data partly by automated means through the contact form on our website, email, phone and WhatsApp. We process it on the following legal bases under Article 5(2) of the KVKK:

• Processing is directly related to establishing a contract (Art. 5/2-c): quotation and information requests
• Compliance with our legal obligations (Art. 5/2-ç)
• Our legitimate interests, provided they do not harm your fundamental rights and freedoms (Art. 5/2-f): information security and preventing misuse

5. Transfers of personal data

Within Türkiye: Your personal data may be shared only with the service provider that hosts and maintains our website (as data processor), for the purpose of providing that service, and with competent public authorities upon lawful request.

Outside Türkiye: Our website and contact form infrastructure are hosted on servers in Türkiye. However, messages sent via the contact form and email correspondence with us are transmitted and stored on servers outside Türkiye operated by our email service providers (Google LLC – Google Workspace, GoDaddy Inc.). If you contact us via WhatsApp, your messages are transmitted through WhatsApp (Meta Platforms) infrastructure. These transfers are limited to responding to your request and are carried out within the conditions set out in Article 9 of the KVKK.

6. Retention

Contact form messages and email correspondence are kept for no longer than 2 years after communication about your request ends, or, if a contract is established, for the periods required by applicable law. Email and IP addresses in the contact form server logs are stored in masked form. Data whose retention period has expired is deleted, destroyed or anonymised.

7. Cookies

Our website does not use advertising, analytics or tracking cookies. The map on the contact page is loaded from Google Maps only when you press “Show map”; Google may then use cookies under its own privacy policy.

8. Your rights

Under Article 11 of the KVKK, you have the right to apply to the data controller to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of data under the conditions of Article 7 of the KVKK;
• request that corrections, deletions or destructions be notified to third parties to whom data was transferred;
• object to a result against you arising from analysis of data exclusively by automated systems;
• claim compensation for damage arising from unlawful processing.

9. How to apply

You may submit requests regarding your rights in writing to Altıntepe Mah. İstasyon Yolu Sok. No:3/1, Maltepe / İstanbul or by email to mert@bsmmechanical.com, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are resolved free of charge within thirty days at the latest, depending on their nature; if the process involves an additional cost, the fee set by the Personal Data Protection Board may be charged.