1. Data Controller
The data controller is 3Dwovens Kompozit Limited Şirketi, established at Yenibosna Merkez Mah. Yalçın Koreş Cad. Kor Sok. No:9, Bahçelievler / İstanbul / Türkiye. Contact: [email protected], +90 (212) 639 47 49.
2. Personal Data Processed
- Identity and contact: name and email address; optionally telephone number and company name.
- Delivery and billing: the delivery country in the request form; requested by email before the proforma invoice for concluding and performing the contract: province, district, full address and postcode, the billing address where different; for corporate invoices, the company name, tax identification number and tax office; for individual invoices, optionally and solely for the invoice, the Turkish identity number.
- Transaction: request and order number, the page the request came from (product page, CNC cutting, Part Check, custom manufacturing, contact), product code, quantity and the amounts computed by the server, currency, request note, customer type, order and payment status, the payment institution's transaction reference, the proforma invoice number, the time and text version of the legal texts sent (in former order records, the time of confirmation), the tracking number and correspondence.
- Request content and technical files: the quantity and message you send in the request form; the measurements computed in your browser from your drawing by the CNC cutting calculator or the Part Check tool and added to the request (such as outer dimensions, area and number of holes); the DXF, DWG, STEP, STP, IGES, IGS, STL or PDF file attached to the request (including any names, company and project details it contains); the profile type, dimensions, fibre preference and non-disclosure agreement (NDA) request sent with the former quotation forms, and the DXF files and measurements uploaded for CNC cutting in former order records.
- Technical data: IP address, browser and device information and form security verification records; for the prevention of misuse and fraud, an irreversible hash of the IP address and the country from which the connection is made. The raw IP address is not stored in order and request records.
- Usage statistics: the pages viewed and events relating to product pages, tool use and the submission of the request form (only the type of page the request came from; no name, email, file or form text); browser, operating system, device type, screen size, language, time zone, the referring site and a random visit identifier held in the browser's memory only while the page is open (Cookie Policy, Section 3). This identifier is not added to the request record.
No special categories of personal data are collected; please do not enter such data or data belonging to third parties into the forms. Card details are not seen or stored by us.
3. Purposes and Legal Bases of Processing
- Receiving, reviewing and answering order and quotation requests, the proforma invoice, payment, concluding and performing the contract, delivery, request and order emails and after-sales support; reviewing, pricing, checking and cutting the drawings sent; assessing quotation and non-disclosure agreement (NDA) requests: KVKK Art. 5(2)(c) (necessary for the conclusion or performance of a contract).
- Notifying authorised staff of orders and requests for approval and assessment: KVKK Art. 5(2)(c) and Art. 5(2)(f).
- Invoicing, accounting and tax obligations, retention of distance contract and e-commerce records; export control, end-user declarations and sanctions compliance for orders abroad: KVKK Art. 5(2)(ç) (legal obligation).
- Security of the Site, forms and payments and prevention of fraud and misuse; measuring Site usage statistics in aggregate and improving the Site: KVKK Art. 5(2)(f) (legitimate interest).
- Establishment, exercise or protection of legal claims: KVKK Art. 5(2)(e) and Art. 5(2)(f).
Data is collected by non-automated means through forms and by automated means through strictly necessary cookies, usage statistics and server logs, and is processed only to the extent limited to these purposes. If any processing based on explicit consent is started, consent is obtained separately from this notice; it may be withdrawn at any time, and withdrawal does not affect the lawfulness of earlier processing.
4. Transfer of Personal Data
Personal data is shared only with the recipients below, in accordance with Articles 8 and 9 of the KVKK, and is not sold or rented for marketing purposes. Your technical files are viewed only by authorised staff for pricing, quotation and production and, where a non-disclosure agreement (NDA) has been signed, are also protected under it.
Recipients in Türkiye:
- PayTR (payment institution licensed under Law No. 6493): the order number and amount for the payment link and, where the link is sent through PayTR, the name and email address. Card details are processed directly by PayTR.
- Carrier (Yurtiçi Kargo): name, delivery address and telephone number, for delivery within Türkiye.
- Financial advisers, audit service providers and authorised public institutions: within the scope of obligations arising from legislation.
Recipients abroad:
- Resend, Inc. (sending order, shipping, invoice and form emails): United States of America.
- Cloudflare, Inc. (site traffic, security and form verification): United States of America and the countries where Cloudflare's data centres are located.
- DigitalOcean, LLC (server hosting the Site and the order records): Germany (Frankfurt).
- Microsoft Corporation, Microsoft 365 (company mailbox [email protected]; order, request and correspondence records): Microsoft's data centres in the European Union.
- PostHog Inc. (cookieless Site usage statistics; the IP address is not passed on): data centre in Frankfurt, Germany.
- International carriers and customs agents (deliveries abroad only): name or company name, delivery address, telephone number and contents of the consignment, for delivery and customs clearance; the delivery country and countries on the transport route.
Resend, Cloudflare, DigitalOcean, Microsoft and PostHog are data processors; transfers to them are made solely for the services stated and are subject to the conditions of Article 9 of the KVKK (appropriate safeguards such as the standard contract announced by the Personal Data Protection Board). Transfers to carriers and customs agents for deliveries abroad are occasional and necessary for the performance of the contract (KVKK Art. 9(6)(b)).
5. Retention Periods
- Contract, invoice and transaction records of paid orders: ten years (Law No. 6563 on the Regulation of Electronic Commerce, Art. 11/3, the Tax Procedure Law and the Turkish Commercial Code; this also covers the three-year period under Art. 20 of the Regulation on Distance Contracts). These records are kept in our e-mail correspondence and accounting records.
- Personal data and drawing files of orders placed on the Site, held on the order server: two years (730 days) from the order date; then deleted or anonymised.
- Order and quotation requests sent through the request form (including the contact page), their attachments and measurements (from the last update of the request) and former contact form requests (from their conclusion): two years (730 days), then deleted or anonymised. Requests that lead to a contract are kept with the contract records.
- IP address hash and country: deleted or anonymised together with the related order or request record; in block records, kept for the duration of the block.
- Server security logs: one year at most. Cookies: the periods stated in the Cookie Policy.
When these periods expire, the data is deleted, destroyed or anonymised. At your request, technical files not subject to a legal retention obligation are deleted before the period ends.
6. Your Rights and How to Apply
Under Article 11 of the KVKK you may apply to the data controller to exercise the following rights:
- to learn whether your personal data is processed and, if so, to request information about it,
- to learn the purpose of processing and whether the data is used in accordance with it,
- to know the third parties in Türkiye or abroad to whom the data is transferred,
- to request rectification of incomplete or inaccurate data, erasure or destruction under the conditions of Article 7 of the KVKK, and notification of these operations to the third parties to whom the data was transferred,
- to object to a result to your detriment arising from analysis exclusively by automated systems,
- to claim compensation for loss suffered due to unlawful processing.
You may submit your application in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, with information verifying your identity and your request, by email to [email protected] or in writing to Yenibosna Merkez Mah. Yalçın Koreş Cad. Kor Sok. No:9, Bahçelievler / İstanbul / Türkiye. Your request is concluded free of charge within thirty days at the latest; where the operation entails additional cost, the fee in the Board's tariff may be charged. If your application is refused or not answered in time, you retain the right to lodge a complaint with the Personal Data Protection Board.
7. Cookies, Security and Changes
Only strictly necessary cookies and browser storage records are used on the Site; site usage statistics are measured without cookies (Cookie Policy, https://3dwovens.com/en/legal/cookie-policy).
Data transmission is encrypted with SSL/TLS, access to personal data is limited to staff who need it for their duties, and appropriate administrative and technical measures are taken to prevent unlawful processing and access.
This notice may be updated in line with changes in legislation and processes; the current text is published on the Site with the date shown at the top of the page.