Privacy Notice (KVKK)

As MB GLOBAL KIMYA Sanayi ve Dış Ticaret Limited Şirketi (the "Company" or "MB Global Kimya"), we act as data controller under Personal Data Protection Law No. 6698 (the "Law", known as KVKK). This notice has been prepared to explain, within the framework of Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, for what purposes and on what legal grounds we process the personal data we obtain through our website at mbglobalkimya.com, to whom it is transferred, and what your rights are.

1. Identity of the data controller

Trade name: MB GLOBAL KIMYA Sanayi ve Dış Ticaret Limited Şirketi
Address: Nisbetiye Mahallesi, Gazi Güçnar Sokak, Uygur İş Merkezi, Blok No: 4, İç Kapı No: 2, Beşiktaş / İstanbul, Turkey
Email: info@mbglobalkimya.com
Phone: +90 534 935 65 83

2. Personal data we process

Our website has no membership system. Personal data is processed only when you fill in a form and through the website's technical records.

Data category	Data processed	How it is obtained
Identity	First name, last name	Quote, contact and trial program forms
Contact	Email address, phone number	The same forms
Customer transaction	Company name, request type, product of interest, quantity, delivery country, message content	The same forms
Transaction security	IP address, browser and device information (user agent), date and time of the request, the address you came to the site from, page language	Recorded automatically by the server when a form is submitted
Measurement	Page viewed, time of visit and a technical visitor ID that expires every day, derived from the anonymized IP address and browser information	Automatically, while you use the site

We do not request or process special categories of personal data (health, religion, membership, biometric data, etc.). Please do not enter such data in our forms.

3. Purposes of processing

• Responding to your requests for quotes, samples, catalogs, technical documents and the trial program,
• Contacting you about your request and providing technical advice,
• Carrying out product supply and sales processes, pre-contract negotiations and the performance of the contract,
• Carrying out sales of goods and services and after-sales support processes,
• Following up requests and complaints and managing customer relationships,
• Carrying out finance, accounting and invoicing operations,
• Fulfilling our legal obligations and providing information to authorized institutions and organizations,
• Ensuring information security and detecting misuse and automated request (bot) attempts,
• Producing aggregate, non-identifying statistics to improve the performance and content of the website,
• Establishing, exercising and protecting our rights in the event of a dispute.

We do not process your personal data for any purpose other than those listed in this notice. We do not send commercial electronic messages (advertising, campaigns, newsletters) without your consent.

4. Legal grounds

Your personal data is processed on the basis of the following conditions listed in Article 5 of the Law, limited to the purposes in this notice:

• Processing is directly related to the formation or performance of a contract (Art. 5/2-c): responding to your quote request, pre-contract negotiations and order processes.
• Processing is necessary for the data controller to fulfill its legal obligation (Art. 5/2-ç): record-keeping and retention obligations under tax, commercial and accounting legislation.
• Processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e): being able to prove the content and timing of a request in the event of a dispute.
• Processing is necessary for our legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f): information security records, detection of misuse and improvement of the site through non-identifying statistics.
• Your explicit consent (Art. 5/1): only where none of the conditions above is met, and only if it is separately requested. You can withdraw your explicit consent at any time; withdrawal does not affect processing lawfully carried out up to that date.

5. Method of collection

Your personal data is collected electronically, by fully or partly automated means, when you fill in the forms on our website and through the records our server keeps while you use the site. If you email us directly or reach us by phone, the data you provide is processed for the same purposes.

6. Transfer of personal data

We do not sell your personal data or share it with third parties for advertising. Transfers are made only to the recipient groups below, only with the data that is necessary, and limited to the purposes above:

• Our information technology service providers: suppliers whose services we use to operate the website and the corporate email infrastructure.
• Our legal, financial advisory and audit consultants: only where a dispute, an audit or a legal obligation is involved.
• Logistics, transport and customs service providers: only if the process moves on to an order, and limited to the information needed for delivery.
• Authorized public institutions and organizations and judicial authorities: where there is a request or obligation arising from legislation.

Transfer abroad

As part of the provision of information technology infrastructure services, your personal data may be stored on servers located abroad. This transfer is carried out within the framework of the conditions set out in Article 9 of the Law.

7. Cookies and measurement

Our website does not use tracking, advertising or analytics cookies; there are no third-party measurement or ad-tracking tools such as Google Analytics on our site.

The only cookie our site sets is a functional preference cookie named mb_tema. It is written to your device only when you press the light/dark theme button at the top of the page, stores only the view you chose (light or dark), contains no personal data and deletes itself after one year. If you do not use the button, this cookie is not set either.

Visit statistics are kept through a technical ID generated from the anonymized IP address and browser information with a key that changes every day and whose previous version is deleted. By design, it is technically impossible to match a visitor's record today with their records from previous days; no fingerprinting is performed.

8. Retention periods

• Form requests and correspondence: 10 years from the date the request is received. This period has been set taking into account the obligations regarding the retention of commercial books and documents and the general statute of limitations.
• Information security records (IP, browser information): together with the related form record, for the same period.
• Measurement records: the daily key that generates the visitor ID is destroyed every day; statistics are kept once they have become non-identifying and aggregated.

When the period expires or the reasons requiring processing no longer exist, your personal data is deleted, destroyed or anonymized.

9. Data security

We take technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data and unlawful access to it. Site and admin panel traffic is encrypted with TLS, the database is kept in a directory closed to web access, access to the admin panel is restricted by authorization and session security controls, and forms run with cross-site request forgery (CSRF) and automated submission protections.

10. Your rights under Article 11 of the Law

By applying to the data controller, you have the following rights regarding yourself:

1. To learn whether your personal data is processed,
2. To request information about it if your personal data has been processed,
3. To learn the purpose of processing your personal data and whether it is used in line with that purpose,
4. To know the third parties in Turkey or abroad to whom your personal data is transferred,
5. To request the correction of your personal data if it has been processed incompletely or inaccurately,
6. To request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law,
7. To request that the operations carried out under items (5) and (6) be notified to third parties to whom your personal data has been transferred,
8. To object to a result against you arising from the analysis of your processed data exclusively through automated systems,
9. To claim compensation for damage if you suffer damage due to the unlawful processing of your personal data.

11. How to apply

You can submit requests concerning your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by the following means:

• In writing: with a wet-signed petition to Nisbetiye Mahallesi, Gazi Güçnar Sokak, Uygur İş Merkezi, Blok No: 4, İç Kapı No: 2, Beşiktaş / İstanbul, Turkey (please write "Request for Information under the Personal Data Protection Law" on the envelope),
• Electronically: to info@mbglobalkimya.com, using a secure electronic signature, a mobile signature or the email address you have previously notified to us and that is registered in our system.

Your application must include your first and last name; your signature if the application is in writing; your Turkish ID number if you are a citizen of the Republic of Turkey, or otherwise your nationality and passport number; your residential or business address for notification; your email address, phone and fax number for notification, if any; and the subject of your request. Information and documents relating to the subject should be attached to the application.

We conclude your request free of charge as soon as possible, depending on its nature, and within thirty days at the latest. If the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, if you find our answer insufficient, or if no answer is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the answer and, in any case, within sixty days of the application date.

If there is doubt about the identity of the applicant, we may request additional information to verify your identity before concluding the request.

12. Updates to this notice

We may update this privacy notice in line with changes in legislation and developments in our business processes. The current version is always published on this page.