Privacy Notice

This privacy notice explains how personal data is processed on tekstilrehberi.com ("Tekstil Rehberi") under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. This English version is provided for information; the Turkish version prevails.

1. Data controller

Your personal data is processed by MERT ÇELİK DENİZER (a sole proprietorship; "Tekstil Rehberi") as the data controller.

Address: Kartaltepe Mah. Malazgirt Caddesi No:10/B D:119 Küçükçekmece/İstanbul
Tax office and tax ID number: Kocasinan V.D., 2920840438
Email: [email protected]

2. Personal data we process

Category	Examples	From
Identity	Name, job title	People who register for the company panel, submit a quote request or use the contact form
Contact	Email address, phone number	People who register for the company panel, submit a quote request or use the contact form
Company panel account	Name, email address, phone number, an irreversible hash of the password, last login time, the date and version of this privacy notice you acknowledged, the date you accepted the Terms of Use and the Membership Agreement and their versions, notification preferences, email addresses entered for team invitations	People who register for the company panel or through the quick company sign-up form, or are invited to a company team
Company details	Company name, address, province, field of activity, company phone and email, tax number (optional, stored encrypted)	Company representatives
Verification and claim documents	Tax certificate, trade registry document and the representative details they contain; phone verification record	Company representatives
Paid package orders	Billing name or company name, tax office, tax ID or national ID number, billing address, email and phone; the package ordered, its price and the order date; bank transfer details and the payment receipt; invoice records; the date you approved the pre-information form and the distance sales agreement and their versions	Company representatives who buy a paid package
Buyer record	Email address, name, language, the date the email address was confirmed, the date and version of this privacy notice you acknowledged, the number of requests sent to companies	Buyers who request quotes
Request content	The needs in a request for quotation (category, request type, quantity, delivery place and date, target price, certificates and samples asked for), the request title and description, the buyer's company name, phone and country, files attached to the request (e.g. tech packs, sample photos); topic, company name and message in the contact form	Buyers, people who use the contact form
Quotes and messages	Companies' quotes (price, minimum order, lead time, sample details and message), messages between the buyer and a company and their attachments, reports and the reporter's email address	Buyers, companies that receive a request
Content and infringement reports	The reason and note given in the product or listing report form ("Report this content"), an optional email address; for infringement reports, the reporter's name or company name, contact details, documents proving the right, and the correspondence on the report and any objection	People who report content, report an infringement or object to a report
Job postings	The name of the posting company's contact person (optional), phone and WhatsApp number, email address, calling days and hours; the posting text and its versions; with each version, the company's legal name and tax number at that date (stored encrypted); the name of the user who sent or edited the posting or decided on it, and the time; the date and version of the job posting rules accepted; for an agency posting, the İŞKUR licence number; moderation decisions (the moderator who decided, the reason and note)	Company representatives and team members who post jobs; moderators
Job posting contact counts	The number of views of a job posting and of clicks on its "Show number", "Call", WhatsApp and email buttons (daily totals); to count the same visitor once a day, an irreversible hash of the IP address is held in the server cache only until the end of that day and is never stored permanently; the same hash is used for the same time for the daily limit that prevents harvesting of numbers	Visitors of the job posting pages
Job posting reports	The reason and note given in the job posting report form, an optional email address	People who report a job posting
Security	An irreversible hash of the IP address, submission time, browser type, the spam score of a request; on the block list only an irreversible hash of an email address, domain, phone number or IP address; while a session lasts, the IP address and browser details in the session record	Everyone using the forms, the request and message pages and the company panel

Tekstil Rehberi does not collect applications, CVs or candidate details from job seekers, and job seekers have no accounts. For visitors of the job posting pages, only the counting and security data listed above are processed, and the report details if they report a posting. What a candidate shares when contacting an employer through the contact details of a posting goes directly to the employer, who is the independent data controller of it.

Information pages such as the blog, glossary and company directory set no cookies of our own and do not store visitors' IP addresses. Pages with forms and the company panel use strictly necessary cookies so the form and the session can work securely; for these sessions, the session record keeps your IP address and browser details for the duration of the session, for security purposes. The cookies are listed in our Cookie Policy. The site is delivered through Cloudflare's content delivery and security network; the Cloudflare Turnstile bot check on forms and the OpenStreetMap map on company profiles are also third-party services (see section 4).

3. Purposes and legal bases

Purpose	Legal basis (KVKK Art. 5/2)
Opening and managing company panel accounts, reviewing company profiles and publishing them in the directory	Establishment or performance of a contract (c)
Recording and proving acceptance of the Terms of Use, the Membership Agreement and, with the first job posting, the job posting rules (date and version)	Establishment or performance of a contract (c); establishing, exercising or defending a right (e)
Verifying company ownership and details (reviewing claim and verification documents, phone checks)	Establishment or performance of a contract (c); legitimate interest (f)
Keeping accounts secure and preventing unauthorized access (last login time, session records)	Legitimate interest (f)
Proving that this privacy notice was provided (date and version acknowledged)	Legal obligation (ç)
Taking paid package orders, providing pre-contract information and concluding the distance sales agreement, tracking payment, activating the package and sending order notifications	Establishment or performance of a contract (c)
Issuing invoices and keeping accounting and tax records	Legal obligation (ç)
Receiving requests for quotation, verifying them by email confirmation, checking them for spam and, where needed, by a moderator, and sending them to the company you chose or to companies in the field	Establishment or performance of a contract (c)
Sending companies' quotes to the buyer, running the correspondence between buyer and company on the platform, sending request and message notifications	Establishment or performance of a contract (c)
Checking correspondence against fraud and spam (link, repetition and prepayment checks, reviewing reported conversations and held messages)	Legitimate interest (f)
Sending notification e-mails to account holders, companies, buyers, job posting owners and customers (including approval, rejection and expiry reminders of job postings)	Establishment or performance of a contract (c)
Reviewing and answering questions, requests and reports sent with the contact form	Legitimate interest (f); legal obligation (ç) for personal data requests
Reviewing product, listing and job posting reports and infringement reports, temporarily hiding or taking content down where needed, asking the company for a correction, informing the company that published it, assessing objections and replying to the reporter	Legal obligation (ç); legitimate interest (f)
Publishing job postings and showing the employer's contact details to candidates	Establishment or performance of a contract (c); legitimate interest (f) for a contact person who is an employee of the company
Checking job postings for discrimination and fraud, and keeping posting versions and moderation decisions as an audit record (Law No. 6701, Law No. 4904, Law No. 6563 Art. 11/3)	Legal obligation (ç); legitimate interest (f)
Showing the posting company the views and contact statistics of its job postings	Legitimate interest (f)
Preventing spam, fraud and abuse, and keeping the site secure	Legitimate interest (f)
Complying with legal obligations and requests from authorities	Legal obligation (ç)
Establishing, exercising or defending legal claims	Art. 5/2 (e)

Tekstil Rehberi sends no commercial electronic messages (advertising or promotional e-mails or text messages); we only send e-mails about your account, requests, quotes and orders. Any optional processing (for example a newsletter) will only take place with your separate explicit consent or approval.

4. Who receives your data

The company you chose for a direct request: a request you send from a company's profile (your needs, description and attachments) goes only to that company. If the company does not use the company panel, the request is sent to the email address on its profile; that email includes your description only if our team reviewed the request, and never your attachments.
Companies matched to an open request (RFQ): an open request is sent to at most 20 companies in the field, and companies on the platform can also see it under "Open requests" in their company panel. There the description is shown, but not your attachments or contact details. Your attachments are only shown to companies that receive your request or send a quote.
Your contact details: your name, company name, email address, phone number and country are shown only if you chose to share them on the form, and only to companies that receive your request or send a quote. If you do not share them, you correspond only through the platform. Your contact details never appear on the public list, under open requests or in email digests.
Public list of requests: if you allowed your open request to be listed, the sourcing requests page shows only the category, request type, quantity, delivery place and date, and a title approved by our team. Your description, attachments, name, company and contact details are never published.
Quotes and conversations: companies' quotes and messages are sent to you; your messages and attachments go only to the company you correspond with.
Moderation: requests, held messages and reported conversations may be reviewed by authorized moderators. Only the site administrator can read whole conversations, and every access is logged.
Published company profiles: the company details entered in the company panel (company name, contact details, address, field of activity) are published in the directory. The account holder's own name, personal contact details and the tax number are not published.
Verification and claim documents: stored in private, access-restricted storage, reviewed only by authorized moderators and not shared with anyone.
Infringement reports: so that the company that published the content can object, the subject of the report, its grounds and the right holder's name or company name may be passed on to that company. Your email address and other contact details are not shared with the company unless you agree.
Payments and invoicing: paid packages are paid by bank transfer; payment details are shared with the banks involved in the transfer, and invoice details with the electronic document systems of the Turkish Revenue Administration and our accountant, as required by law.
Service providers (data processors): providers of hosting, e-mail and site security access data only as far as needed to provide these services and on our instructions:
- Google (Google Workspace / Gmail): notification e-mails sent by the site and correspondence sent to and from [email protected] are processed on Google's servers.
- Cloudflare, Inc. (USA): every request to the site passes through Cloudflare's network for content delivery and security; your IP address and technical details of the request (e.g. browser type, the address requested) are processed in the process.
Cloudflare Turnstile: forms and the company panel registration use the Turnstile service of Cloudflare, Inc. (USA) to tell automated (bot) submissions apart. During the check, your IP address and technical signals about your browser and device are sent to Cloudflare.
OpenStreetMap: the location map on company profiles is loaded from the servers of the OpenStreetMap Foundation (United Kingdom). The map loads when you approach the map section of the page; your IP address and browser details are then sent to these servers.
Job postings: the contact details of a posting (contact person's name, phone, WhatsApp, email and calling hours) are published to everyone who views it. Job posting records, their versions and moderation decisions are shared, on a request based on legal authority, with the Human Rights and Equality Institution of Türkiye, the Turkish Employment Agency (İŞKUR), labour inspectors of the Ministry of Labour and Social Security, the authority competent under Law No. 5651 and the courts.
Authorities: competent public authorities and courts, where required by law.

Transfers abroad: some of the servers of Google, Cloudflare and OpenStreetMap are located outside Turkey, so processing under these services is a transfer abroad. As the Personal Data Protection Board has not issued an adequacy decision for the countries concerned, these transfers rely on the appropriate safeguards set out in Article 9 of the KVKK (as amended by Law No. 7499), in particular the standard contracts published by the Board.

5. How we collect data

Personal data is collected electronically, wholly or partly by automated means, through the company panel registration, profile, verification and order pages, the job posting form, the "Request a quote", "Contact" and "Report this content" forms, the request, quote and message pages, e-mail correspondence, payment notifications and phone calls made for verification.

6. Retention

Requests marked as spam: deleted 30 days after they were created.
Requests not confirmed by email: deleted 30 days after the confirmation link (72 hours) expired.
Quick company sign-up submissions: deleted 7 days after they were sent, whether or not they were confirmed by email. The details of a confirmed submission move to the company panel account and the company profile, which follow the periods below.
Requests, quotes and messages: 24 months after a request is closed, the buyer's personal data (name, company name, phone, request title and description, messages) is deleted; the needs and quote figures, which contain no personal data, are kept anonymously for statistics. The email address and name in the buyer record are deleted once the last request is anonymized and there has been no new activity for 24 months.
Attachments of requests, quotes and messages: deleted 90 days after the request is closed.
Email address in reports and content reports (job posting reports included): deleted 12 months after the report was handled.
Job postings (contact details included): until the company record is permanently deleted. The contact details of a closed, expired or deleted posting are not shown on the site.
Versions and moderation records of job postings: 10 years from the date of the record; then deleted. These records, including the name of the user who acted and the contact details of the posting, are kept for this period even if the company account or the company record is deleted (Law No. 6563 Art. 11/3).
Daily view and contact counts of job postings: 36 months; no record of the visitor is kept.
Clicks on company contact buttons: 24 months; daily totals are kept anonymously.
Impressions and clicks of sponsored placements and ads: kept only as daily totals; counting uses no cookies and no record of the visitor is kept. To avoid counting the same visitor twice, an irreversible hash of the IP address is held in the server cache for up to 1 hour.
Company panel accounts: as long as the account is open. When you delete your account in the panel, your name, email address and phone number are anonymized; your name in the audit records of job postings is deleted at the end of their retention period.
Records of contract acceptance: as long as the account is open; once the account is deleted they are kept without any link to the person (anonymized).
Paid and refunded orders, payment and invoice records, and the distance sales agreements and pre-information forms of these orders: for the retention periods set by the Turkish Commercial Code and the Tax Procedure Law (10 years from the end of the calendar year the record belongs to).
Unpaid (expired or cancelled) orders and their document copies: deleted 24 months after the order date.
Uploaded payment receipts: deleted 12 months after the order is closed (paid, refunded, cancelled or expired).
Billing details saved for later orders: until the company record is permanently deleted; if you want them deleted earlier, write to [email protected].
Company profiles: 6 months for rejected listings; for published profiles, as long as the profile is online and 2 years after it is removed.
Verification and claim documents: as long as the verification remains valid on the profile; up to 2 years if the request is rejected or the verification is withdrawn.
Contact form messages (including infringement reports): up to 2 years from the date they are sent.
Security records: up to 2 years; session records are deleted when the session expires.

If a dispute or an official investigation is ongoing, the related records may be kept until it is concluded. Data is deleted, destroyed or anonymized when its retention period ends.

7. Your rights

Under Article 11 of the KVKK you have the right to learn whether your data is processed and to request information about it, to learn the purpose of processing and whether data is used accordingly, to know the third parties in Turkey or abroad that receive it, to request correction of incomplete or inaccurate data, to request deletion or destruction under Article 7, to request that these actions are notified to the recipients, to object to outcomes against you that arise solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

8. How to apply

You can send requests regarding your rights, with information that verifies your identity as required by the Communiqué on the Procedures and Principles of Applications to the Data Controller, in any of these ways:

through the contact form with the topic "Personal data request",
by e-mail to [email protected],
in writing to Kartaltepe Mah. Malazgirt Caddesi No:10/B D:119 Küçükçekmece/İstanbul.

Requests are answered free of charge within 30 days at the latest. If your request is rejected, you find the answer insufficient or it is not answered in time, you can file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.