Privacy Notice (KVKK)

Data controller: Derya İnşaat Malzemeleri İnşaat Taahhüt Sanayi ve Ticaret Limited Şirketi (the “Company” or “we”). Our trade name, address and contact details are shown in the “Company and contact details” box above. This website is operated by our Company to present DERMIX-branded construction chemicals. As our Company is established in Türkiye, there is no data controller’s representative.

If you have any questions about your personal data, you can write to halilsahin@dermixyapi.com.tr or call +90 324 237 04 98. The formal channels for exercising your rights are set out below under “How to submit an application”.

This notice covers five situations:

• Your visit to the website: technical records generated while the pages are delivered to your browser.
• The quote and technical support form and e-mail: requests you send by using the form on the contact page or by writing directly to halilsahin@dermixyapi.com.tr.
• Telephone: your calls to the +90 324 237 04 98 number shown on the website.
• WhatsApp: your messages to us on WhatsApp, via the WhatsApp button on the website or to the +90 532 313 24 15 number.
• The map on the contact page: the Google map, which is loaded only if you give your explicit consent.

Sales processes that may begin after your request, such as order fulfilment, shipping and invoicing, are not covered by this notice. Information stored in your browser (e.g. the comparison list) is explained separately in the Cookie Policy.

When you open a page, your browser connects to the servers of İHS Kurumsal Teknoloji Hizmetleri A.Ş. (Türkiye), which hosts the website. During this connection the following information is processed automatically: your IP address, the date and time of the connection, the address of the page you requested, the type and version of your browser and operating system (user agent), the address of the referring page (if any), the request method and connection protocol, the response code returned by the server and the amount of data transferred.

A filter term you type in the product list is added to the page address. The term may therefore enter these records in subsequent requests (e.g. when you open a product, reload the page or change the language) as part of the requested page address or of the referring page address.

We process this information to deliver the website to you and to protect it against attacks and misuse. We do not attempt to use this information to identify you, track your visits or create a profile of you.

The website does not use its own cookies and contains no analytics, advertising or social media tools. The security cookie that the hosting provider may set only during an attack is explained in the Cookie Policy. Fonts and site search files are loaded from this website. The text you type into the site search is processed in your browser and is not sent to any server. The language suggestion is displayed by reading your browser’s language setting on your device.

In the form we ask for the following information: your first name and surname (required), company name (optional), your telephone number and e-mail address (at least one of them is required), the subject of your request (Quote request, Technical support, Document request (SDS), Dealer application or Other), the product you are interested in (optional) and your message (required).

The form does not itself send the information to us. When you press the “Send” button, the e-mail application on your device opens with a message prepared for sending to halilsahin@dermixyapi.com.tr. The message does not reach us until you send it from your e-mail application, and it is not stored anywhere on this website. When you send it, the message is delivered to us via the e-mail service you have chosen; how that service processes the message is subject to its own terms.

Together with your e-mail, we also receive your e-mail address, the display name and signature added by your e-mail application, the date of sending and the technical header information of the e-mail (e.g. the addresses of the servers through which the message passed). Files you attach to the message (e.g. project drawings, bills of quantities, photographs of the application area) are also processed. The same information is processed if you write directly to halilsahin@dermixyapi.com.tr without using the form.

The form contains a hidden field that is not shown to people. This field serves to filter out unwanted messages sent by automated programs and contains no personal data.

If in the future we switch to sending the form via an online form service, we will update this notice before that change takes effect.

When you call the +90 324 237 04 98 number shown on the website, your telephone number and the information you provide during the call (e.g. your name, your company, the product you are interested in and your request) are processed. Our employee may take notes on the call in order to follow up on your request. We process this information for the same purposes, on the same legal grounds and for the same periods as requests received via the form or by e-mail.

The WhatsApp button in the bottom right-hand corner of the website opens a short information window. When you click the “Start a WhatsApp chat” button in that window or the +90 532 313 24 15 number shown on the website, the WhatsApp app or WhatsApp Web opens with a message prepared for sending to us; on product pages the message contains the product name. The message does not reach us until you send it. The website contains no WhatsApp code or cookies; no information is sent to WhatsApp unless you click these links.

When you message us on WhatsApp, we receive your telephone number, the name shown in WhatsApp and the profile information your privacy settings allow, your messages and the files you send (e.g. photos, documents or your location). We process this information for the same purposes, on the same legal grounds and for the same periods as requests received via the form or by e-mail.

The WhatsApp service is provided by WhatsApp Ireland Limited for users in the European Region and by WhatsApp LLC (USA) for other users. Messages are end-to-end encrypted; WhatsApp cannot see their content. WhatsApp processes account and service data such as your telephone number and connection and usage information for its own purposes as an independent data controller, in accordance with the WhatsApp Privacy Policy.

You do not have to use WhatsApp; you can also reach us by phone, by e-mail or via the form for the same requests.

The map on the contact page is provided by Google LLC (USA) and is not loaded until you click the “Show map” button. No request is sent to Google before you click. If you have previously ticked the “Load the map in this browser for 6 months without asking me” box, the map is loaded without asking during that period.

Our address and the “Get directions” and “Open in Google Maps” links to Google Maps are always visible (“Get directions” is also in the footer of every page). These links open Google’s website in a new tab, where Google’s own terms apply.

When you load the map, your browser loads it directly from Google’s servers. In doing so, Google receives your IP address and technical information about your browser and device (e.g. browser type and language setting). The website does not send the address of the page you are on to Google when loading the map; however, Google may learn that the map is displayed on this website. Google may set or read its own cookies. Google processes this data for its own purposes as an independent data controller in accordance with the Google Privacy Policy. This data does not reach us.

In place of the map, a text headed “Information about the Google map” is shown first, and below it a separate consent statement headed “Explicit consent”. The legal ground for this processing is the explicit consent you give by reading this statement and clicking the “Show map” button (Art. 5(1) KVKK). Not giving consent does not affect any other part of the website.

If you tick the “Load the map in this browser for 6 months without asking me” box, your choice is stored for 6 months in this browser only. During this period the map is loaded each time you open the contact page without asking you again. You can withdraw your consent at any time using the “Hide map and withdraw my consent” button below the map or the “Withdraw my consent for the map” button at the end of the Cookie Policy; withdrawal does not affect processing carried out up to that point.

Below we set out each purpose, the data processed and the legal ground on which it is based. The legal grounds are the conditions set out in Article 5 of the KVKK.

Requests you make by telephone are likewise based, depending on their subject, on the purpose and legal ground in the quote, technical support, document, dealership or general question row. We do not use your contact details for any purpose other than those shown in this table (e.g. for marketing).

We collect your personal data in the following ways:

• Website visit: by automated means, through your browser connecting to the servers of İHS Kurumsal Teknoloji Hizmetleri A.Ş. (Türkiye).
• Form and e-mail: electronically, through the e-mail you send us; our e-mail system records the message automatically.
• Telephone: orally during the call; by non-automated means, through the notes taken by our employee.
• WhatsApp: electronically, through the messages you send us; the messages remain stored in our WhatsApp app.
• Map: by automated means, through your browser connecting directly to Google after you choose to load the map. This data is collected by Google and does not reach us.
• KVKK application: through the written or electronic channels set out below.

Within our Company, your information is accessed by those of our employees who handle sales, technical support or dealer applications, depending on the subject of your request. During the retention period, these records may be accessed only by our authorised employees responsible for fulfilling our legal obligations, responding to KVKK applications or handling a dispute.

Outside our Company, your data is disclosed only to the recipients below, for the stated purpose and to the extent necessary:

We do not sell your information and do not share it with third parties for their own marketing purposes.

The Personal Data Protection Board (Kişisel Verileri Koruma Kurulu; the “Board”) has not yet issued an adequacy decision for any country. A transfer to a recipient abroad is therefore subject to the specific conditions set out in Article 9 of the KVKK.

Our hosting and e-mail service provider İHS Kurumsal Teknoloji Hizmetleri A.Ş. (Türkiye) processes data on our behalf and on our instructions on its servers in Türkiye. Connection data from your website visit and the e-mails and attachments you send us are not transferred abroad through this provider.

If you choose to load the map, your data goes directly from your browser to Google without passing through our systems and may be processed by Google in the USA and in other countries where Google has servers. If this transmission constitutes a transfer abroad, its legal basis is the explicit consent you give by clicking the “Show map” button after being informed of the following risks (Art. 9(6)(a) KVKK):

• Your data is not processed in a country that the Board has found to provide adequate protection; not all of the safeguards of the KVKK may apply there.
• Your data becomes subject to the law of that country; the public authorities of that country may access the data under their own legislation.
• It may be more difficult to exercise your rights and to seek legal remedies against a company abroad than in Türkiye.
• How Google uses the data is not under our Company’s control.

If you do not give consent, the map is not loaded and no data is sent to Google. You can still see our address and, if you wish, go to Google’s website yourself via the “Open in Google Maps” link.

If you choose to message us on WhatsApp, your messages and account information are transmitted via WhatsApp’s infrastructure and may be processed by WhatsApp in the countries where it has servers, including the USA. The risks listed above apply to this transmission as well; how WhatsApp uses the data is likewise not under our Company’s control. If this transmission constitutes a transfer abroad, its legal basis is the explicit consent you give by choosing to message us on WhatsApp after being informed of these risks (Art. 9(6)(a) KVKK); the WhatsApp window on the website shows this information before the chat starts. If you do not wish to give consent, you can reach us by phone, by e-mail or via the form.

We retain your data only for the following periods:

If a dispute arises before the period expires, we retain the relevant records until the dispute has been finally resolved.

When the period expires, we delete, destroy or anonymise the data. We do so within three months at the latest from the date on which the reason for retention ceases to exist.

To respond to your request, we do not need special categories of personal data (e.g. data concerning health, religion, ethnic origin, criminal convictions, biometric or genetic data) or copies of identity cards, passports or driving licences. Please do not share them in the form, in e-mails, on WhatsApp or in attachments. If they are nevertheless sent, we delete such information and document copies that are not required to respond to your request as soon as we notice them.

If you pass on another person’s contact details to us (e.g. a site manager or a colleague), please inform that person of this notice.

We do not use your contact details to send marketing messages. Should we wish to do so in the future, we will obtain your separate and optional consent and register it in the Message Management System (İleti Yönetim Sistemi; “İYS”); not giving consent does not affect the response to any of your requests.

We do not take any decision about you based solely on automated processing, and we do not create profiles.

The website is served over an encrypted connection (HTTPS). Form data is not stored on the website. Request e-mails are accessed only by our employees responsible for responding to these requests or for handling the retention, application and dispute procedures described above. We conclude contracts with our service providers requiring them to process data only in accordance with our instructions and securely.

Under Article 11 of the KVKK, you may exercise the following rights by applying to us:

• To learn whether your personal data is being processed.
• If it has been processed, to request information about it.
• To learn the purpose of the processing and whether the data is used in accordance with that purpose.
• To know the third parties in Türkiye or abroad to whom your data is transferred.
• To request rectification if the data has been processed incompletely or inaccurately.
• To request erasure or destruction of the data within the framework of the conditions set out in Article 7 of the KVKK.
• To request that rectification, erasure or destruction be notified to the third parties to whom the data has been transferred.
• To object to an outcome to your detriment arising from the analysis of the data exclusively through automated systems.
• To claim compensation for damage if you suffer damage as a result of unlawful processing.

You may also withdraw the explicit consent you gave for the map at any time.

You may submit your application in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), in Turkish, by one of the following means:

• In writing: by delivering your petition bearing your wet-ink signature by hand to Turgutreis Mah. 4101 Sk. Derya Apt. No: 2 A, Akdeniz / Mersin, Türkiye or by sending it by post or courier. Writing “KVKK Başvurusu” (KVKK application) on the envelope speeds up processing.
• By registered electronic mail (Kayıtlı Elektronik Posta; “KEP”): from your own KEP address to our Company’s KEP address. You can use this channel once our KEP address is shown in the “Company and contact details” box above.
• With a secure electronic signature or mobile signature: by sending your application, signed with one of these signatures, by e-mail to halilsahin@dermixyapi.com.tr.
• By e-mail: by writing to halilsahin@dermixyapi.com.tr from an e-mail address that you have previously notified to us and that is registered in our system (e.g. the address from which you sent your request).

Your application must contain: your first name, surname and, for written applications, your signature; if you are a citizen of the Republic of Türkiye, your Turkish identity number (T.C. kimlik numarası), or, if you are a foreign national, your nationality and passport number or, if any, your identity number; your residential or business address for service of notifications; if any, your e-mail address, telephone or fax number for notifications; and the subject of your request. If there are documents relating to your request, attach them to the application.

If we need to verify that the application is yours, we may ask you for additional information.

We will conclude your application free of charge as soon as possible, depending on its nature, and within 30 days at the latest. However, if our response is given in writing and exceeds 10 pages, a processing fee of TRY 1 may be charged for each page beyond the 10th page. If the response is provided on a recording medium such as a CD or a memory stick, any fee charged may not exceed the cost of that medium. If the application arose from an error on our part, we will refund any fee charged.

If your application is rejected, if you find our response insufficient or if we do not respond in time, you may lodge a complaint with the Personal Data Protection Board within 30 days from the date on which you learn of our response and in any case within 60 days from the date of your application. To complain to the Board, you must first have applied to us. Further information: Personal Data Protection Authority.

When we amend this notice, we publish the current version on this page together with the date of the update. We update the notice before we begin to process your data for a new purpose or to transfer it to a new recipient. If the information or consent text relating to the map changes, we ask for your consent again before the map is loaded.

This section is intended for persons located in the European Union or the European Economic Area (EEA) whose personal data is processed subject to the EU General Data Protection Regulation (GDPR). It supplements the information above; the retention periods set out above also apply here.

Controller: Derya İnşaat Malzemeleri İnşaat Taahhüt Sanayi ve Ticaret Limited Şirketi, Turgutreis Mah. 4101 Sk. Derya Apt. No: 2 A, Akdeniz / Mersin, Türkiye. Contact: halilsahin@dermixyapi.com.tr, +90 324 237 04 98.

We process your data on the following legal bases under Article 6(1) GDPR:

Providing your personal data to us is neither a statutory nor a contractual requirement; however, if you do not provide your contact details, we cannot respond to your request. We do not take any decision about you based solely on automated processing, and we do not create profiles.

The recipients are listed in the table above. In its own privacy policy, Google names Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as the controller for users in the EU/EEA and Switzerland. If you message us on WhatsApp, WhatsApp’s own privacy policy names WhatsApp Ireland Limited as the service provider and controller for users in the European Region.

The controller of the data you send directly to us is our Company, which is established in Türkiye. There is no adequacy decision of the European Commission in respect of Türkiye. According to the interpretation of the European Data Protection Board (EDPB), your sending data directly to us does not constitute a transfer within the meaning of Chapter V GDPR; the protection afforded by the GDPR continues to apply to this data.

Our hosting and e-mail service provider İHS Kurumsal Teknoloji Hizmetleri A.Ş. (Türkiye), which processes this data on our behalf, is also located in Türkiye; the data is not transferred to another country through this provider. Google LLC states on Google’s page on data transfer frameworks that it is certified under the EU–US Data Privacy Framework and relies on standard contractual clauses where necessary.

Under the GDPR, you have the right to access your data (Art. 15) and to request its rectification (Art. 16), its erasure (Art. 17) and the restriction of its processing (Art. 18). You may receive your data that is processed by automated means on the basis of consent or a contract in a structured, commonly used and machine-readable format and request that it be transmitted to another controller (Art. 20). You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal (Art. 7(3)).

You may submit your requests in Turkish or English using the contact details above. We will respond to your request within one month at the latest; where necessary, this period may be extended by a further two months, in which case we will inform you.

You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country of your habitual residence, your place of work or the place of the alleged infringement (Art. 77). List of supervisory authorities: Members of the European Data Protection Board.

You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 6(1)(f)) (Art. 21). If you object, we will stop processing this data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. We do not carry out direct marketing.