1. Data Controller
The data controller is 3Dwovens Kompozit Limited Şirketi, established at Yenibosna Merkez Mah. Yalçın Koreş Cad. Kor Sok. No:9, Bahçelievler / İstanbul / Türkiye. Contact: [email protected], +90 (212) 639 47 49.
2. Personal Data Processed
- Identity and contact: name, email address and telephone number; in quotation request forms also company name and country.
- Delivery and billing: delivery country, province, district, full address and postcode; the billing address where different; for corporate invoices, the company name, tax identification number and tax office; for individual invoices, optionally and solely for the invoice, the Turkish identity number.
- Transaction: order number, customer type, order items and amounts, currency, order note, order and payment status, the payment institution's transaction reference, the time and text version of the confirmation of the legal texts and of the made-to-specification acknowledgement, the tracking number and correspondence.
- Request content and technical files: the profile type, dimensions, quantity, fibre preference, non-disclosure agreement (NDA) request and message you send in a quotation form; DXF files you upload for CNC cutting and the measurements computed from them; STEP, STP, DXF or PDF files attached to a quotation request (including any names, company and project details they contain).
- Technical data: IP address, browser and device information and form security verification records; for the prevention of misuse and fraud, an irreversible hash of the IP address and the country from which the connection is made. The raw IP address is not stored in order and request records.
- Usage statistics: the pages viewed and events relating to product, cart and order steps; browser, operating system, device type, screen size, language, time zone, the referring site and a random visit identifier held in the browser's memory only while the page is open (Cookie Policy, Section 3). When an order is submitted this identifier is added to the order record; when the order is paid, only the identifier, order number, amount and currency are sent to PostHog.
No special categories of personal data are collected; please do not enter such data or data belonging to third parties into the forms. Card details are not seen or stored by us.
3. Purposes and Legal Bases of Processing
- Receiving, reviewing and approving the order, payment, concluding and performing the contract, delivery, order emails and after-sales support; measuring, pricing, checking and cutting uploaded drawings; assessing quotation and non-disclosure agreement (NDA) requests: KVKK Art. 5(2)(c) (necessary for the conclusion or performance of a contract).
- Notifying authorised staff of orders and requests for approval and assessment: KVKK Art. 5(2)(c) and Art. 5(2)(f).
- Invoicing, accounting and tax obligations, retention of distance contract and e-commerce records; export control, end-user declarations and sanctions compliance for orders abroad: KVKK Art. 5(2)(ç) (legal obligation).
- Security of the Site, forms and payments and prevention of fraud and misuse; measuring Site usage statistics in aggregate and improving the Site: KVKK Art. 5(2)(f) (legitimate interest).
- Establishment, exercise or protection of legal claims: KVKK Art. 5(2)(e) and Art. 5(2)(f).
Data is collected by non-automated means through forms and by automated means through strictly necessary cookies, usage statistics and server logs, and is processed only to the extent limited to these purposes. If any processing based on explicit consent is started, consent is obtained separately from this notice; it may be withdrawn at any time, and withdrawal does not affect the lawfulness of earlier processing.
4. Transfer of Personal Data
Personal data is shared only with the recipients below, in accordance with Articles 8 and 9 of the KVKK, and is not sold or rented for marketing purposes. Your technical files are viewed only by authorised staff for pricing, quotation and production and, where a non-disclosure agreement (NDA) has been signed, are also protected under it.
Recipients in Türkiye:
- PayTR (payment institution licensed under Law No. 6493): the order number and amount for the payment link and, where the link is sent through PayTR, the name and email address. Card details are processed directly by PayTR.
- Carrier (Yurtiçi Kargo): name, delivery address and telephone number, for delivery within Türkiye.
- Financial advisers, audit service providers and authorised public institutions: within the scope of obligations arising from legislation.
Recipients abroad:
- Resend, Inc. (sending order, shipping, invoice and form emails): United States of America.
- Cloudflare, Inc. (site traffic, security and form verification): United States of America and the countries where Cloudflare's data centres are located.
- DigitalOcean, LLC (server hosting the Site and the order records): Germany (Frankfurt).
- Microsoft Corporation, Microsoft 365 (company mailbox [email protected]; order, request and correspondence records): Microsoft's data centres in the European Union.
- PostHog Inc. (cookieless Site usage statistics; the IP address is not passed on): data centre in Frankfurt, Germany.
- International carriers and customs agents (deliveries abroad only): name or company name, delivery address, telephone number and contents of the consignment, for delivery and customs clearance; the delivery country and countries on the transport route.
Resend, Cloudflare, DigitalOcean, Microsoft and PostHog are data processors; transfers to them are made solely for the services stated and are subject to the conditions of Article 9 of the KVKK (appropriate safeguards such as the standard contract announced by the Personal Data Protection Board). Transfers to carriers and customs agents for deliveries abroad are occasional and necessary for the performance of the contract (KVKK Art. 9(6)(b)).
5. Retention Periods
- Contract, invoice and transaction records of paid orders: ten years (Law No. 6563 on the Regulation of Electronic Commerce, Art. 11/3, the Tax Procedure Law and the Turkish Commercial Code; this also covers the three-year period under Art. 20 of the Regulation on Distance Contracts). These records are kept in our e-mail correspondence and accounting records.
- Personal data and drawing files of orders placed on the Site, held on the order server: two years (730 days) from the order date; then deleted or anonymised.
- DXF uploads not linked to an order: 24 hours.
- Quotation requests and their attachments (from the last update of the request) and contact form requests (from their conclusion): two years (730 days), then deleted or anonymised. Requests that lead to a contract are kept with the contract records.
- IP address hash and country: deleted or anonymised together with the related order or request record; in block records, kept for the duration of the block.
- Server security logs: one year at most. Cookies: the periods stated in the Cookie Policy.
When these periods expire, the data is deleted, destroyed or anonymised. At your request, technical files not subject to a legal retention obligation are deleted before the period ends.
6. Your Rights and How to Apply
Under Article 11 of the KVKK you may apply to the data controller to exercise the following rights:
- to learn whether your personal data is processed and, if so, to request information about it,
- to learn the purpose of processing and whether the data is used in accordance with it,
- to know the third parties in Türkiye or abroad to whom the data is transferred,
- to request rectification of incomplete or inaccurate data, erasure or destruction under the conditions of Article 7 of the KVKK, and notification of these operations to the third parties to whom the data was transferred,
- to object to a result to your detriment arising from analysis exclusively by automated systems,
- to claim compensation for loss suffered due to unlawful processing.
You may submit your application in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, with information verifying your identity and your request, by email to [email protected] or in writing to Yenibosna Merkez Mah. Yalçın Koreş Cad. Kor Sok. No:9, Bahçelievler / İstanbul / Türkiye. Your request is concluded free of charge within thirty days at the latest; where the operation entails additional cost, the fee in the Board's tariff may be charged. If your application is refused or not answered in time, you retain the right to lodge a complaint with the Personal Data Protection Board.
7. Cookies, Security and Changes
Only strictly necessary cookies and browser storage records are used on the Site; site usage statistics are measured without cookies (Cookie Policy, https://3dwovens.com/en/legal/cookie-policy).
Data transmission is encrypted with SSL/TLS, access to personal data is limited to staff who need it for their duties, and appropriate administrative and technical measures are taken to prevent unlawful processing and access.
This notice may be updated in line with changes in legislation and processes; the current text is published on the Site with the date shown at the top of the page.