Last updated: [INFO NEEDED: Effective date or last revision date of this Policy]
This Privacy, Personal Data Protection and Security Policy (“Policy”) explains how Eko Kartuş ve Bilişim Sanayi Ticaret Limited Şirketi (the “Company”), operating under the PrintEyes brand and managing https://printeyes.com.tr, collects, uses, stores and protects personal data in connection with its activities, and how individuals may exercise their rights.
The Company provides products and services to business customers, dealers, wholesale purchasers and corporate business partners. Personal data may be processed when an individual creates an account, submits a dealer application, places an order, makes a payment, uses a current-account facility, receives a delivery or contacts customer support through the website.
This Policy applies to website visitors, dealer applicants, authorised dealer users, employees acting on behalf of customers, relevant individuals associated with suppliers and business partners, and other natural persons who contact the Company. Information relating to a legal entity may constitute personal data to the extent that it can be associated with an identifiable natural person.
For the purposes of Turkish Personal Data Protection Law No. 6698 (“KVKK”), the Company responsible for determining the purposes and means of processing personal data is:
Depending on the nature of the service and the requirements of the relevant transaction, the Company may process the following categories of personal data:
The Company does not ordinarily request special categories of personal data as part of standard dealer applications or order processing. If processing such data becomes necessary, it will take place only where a valid legal basis exists and the safeguards required by applicable law are in place.
Personal data may be collected through website forms, dealer applications, account creation and management screens, order and payment processes, current-account transactions, email correspondence, telephone calls, customer support channels, delivery operations and the technical logs of the website.
Data may be obtained directly from the individual or, where appropriate, from a user authorised by the individual's company, suppliers engaged to fulfil orders or deliveries, payment service providers and other sources permitted by law. Where personal data is obtained from third parties, applicable information obligations will be fulfilled.
Subject to applicable law and the relevant legal basis, personal data may be processed for the following purposes:
Personal data is processed for specified, explicit and legitimate purposes. The Company aims not to request data that is unrelated to the purpose of processing or unnecessary for the relevant activity.
Personal data may be processed on one or more of the legal grounds set out in Article 5 of KVKK, depending on the activity concerned. These grounds may include processing expressly provided for by law; processing directly related to the establishment or performance of a contract; processing necessary for the data controller to fulfil a legal obligation; processing necessary to establish, exercise or protect a right; and processing necessary for the legitimate interests of the data controller, provided that this does not prejudice the fundamental rights and freedoms of the individual.
Where explicit consent is required for a particular activity, it will be obtained in relation to a specific matter, on the basis of adequate information and through the individual's freely given choice. Explicit consent will not be imposed as a general or unnecessary condition for processing that can lawfully be carried out on another legal basis. Withdrawal of consent does not, by itself, invalidate processing lawfully carried out before withdrawal.
Payment, accounting, invoicing and commercial recordkeeping may be carried out to meet statutory obligations or contractual requirements. Commercial electronic messages for marketing purposes will be sent in accordance with the applicable rules on consent and opt-out rights.
The Company may transfer personal data to the following categories of recipients, only where the transfer is relevant, limited and proportionate to the relevant purpose and supported by a valid legal basis:
The Company does not intend to sell or rent personal data to third parties for their independent marketing purposes. Where applicable, agreements with service providers include obligations concerning confidentiality, data security and processing data only for defined purposes.
[INFO NEEDED: Confirm the names, data-processing roles and relevant countries of the hosting, email, analytics, payment, backup and other third-party service providers used by the Company.]
International transfers of personal data may arise because of the technical infrastructure or service providers used by the Company. Such a transfer should not be assumed merely because a service is used; the actual data flows, locations of service providers and contractual arrangements must be verified.
Where personal data is transferred abroad, the applicable transfer conditions and safeguards under Article 9 of KVKK and the relevant regulations in force will be followed. Depending on the circumstances, this may involve an adequacy decision, appropriate safeguards or another transfer mechanism permitted by law. Personal data will not be transferred abroad unless the applicable legal conditions are met.
[INFO NEEDED: Confirm whether data is transferred abroad, the destination countries, recipients and applicable legal transfer mechanisms with the Company's technical service providers.]
Personal data is retained for the period necessary for the purpose for which it was processed and in accordance with the retention obligations imposed by applicable law. Retention periods are determined by considering the contractual relationship, commercial and financial recordkeeping obligations, limitation periods, potential disputes and data security requirements.
When the retention purpose ends and no other legal ground requires the data to be kept, personal data will be deleted, destroyed or anonymised in accordance with applicable law. Relevant obligations under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data will be fulfilled where applicable.
Data held in backup systems may be deleted or made inaccessible on a different schedule from data in the main system, depending on the technical processes involved. Appropriate measures are used to prevent ordinary use of such data and to restrict unnecessary access during this process.
[INFO NEEDED: Establish retention periods for each data category and a periodic disposal schedule based on the Company's actual data inventory and legal obligations.]
The Company aims to implement technical and organisational measures appropriate to the nature of the personal data processed and the risks involved, in order to prevent unlawful processing and access and to ensure the secure retention of data.
Where applicable, these measures may include:
Data transmission over the internet and electronic storage cannot be guaranteed to be entirely risk-free. Although the Company aims to apply reasonable and appropriate security measures, it does not guarantee that all risks beyond its control can be completely eliminated.
If a personal data breach occurs, the Company will assess its nature and impact and make notifications to the competent authorities and, where required, affected individuals within the applicable legal time limits.
The website may use cookies or similar technologies to provide essential functions, manage user sessions, maintain security, remember preferences and, where used, measure website performance.
Depending on their purpose, cookies may include session cookies, persistent cookies, strictly necessary cookies, preference cookies and analytics or marketing cookies. The actual categories and durations of the cookies used will be determined by the website's active technical configuration.
Where applicable law requires permission for non-essential cookies or similar technologies, those technologies will not be activated before the required permission is obtained. If a cookie preference tool is available, users may change their preferences through that tool. Users may also manage or delete cookies through their browser settings. Blocking essential cookies may affect the proper operation of certain website functions.
[INFO NEEDED: Verify the actual cookie names, providers, purposes, retention periods and consent mechanism used on the website; publish a separate Cookie Policy if appropriate.]
The Company may send operational notices, contractual notifications, payment reminders and delivery updates necessary for dealer relationships and order fulfilment, subject to the applicable legal requirements. Such service communications are assessed separately from commercial electronic messages sent for advertising or marketing purposes.
Promotional, campaign or marketing messages will be sent in accordance with the permissions and other conditions required by applicable law. Individuals may exercise their right to opt out of commercial electronic messages using the methods provided by law. Following an opt-out request, the Company will take the appropriate action for the relevant communication channel in accordance with legal requirements.
The website may contain links to third-party websites or services. The privacy practices, cookies and security policies of those third parties may be outside the Company's direct control. Providing a link does not mean that the Company endorses every practice of the relevant third party.
Users are encouraged to review the privacy and personal data protection documents of third-party providers before using their services. The Company is responsible for matters outside its control only to the extent required by applicable law.
Under Article 11 of KVKK, individuals have the following rights concerning the processing of their personal data, subject to the scope, conditions and exceptions set out in the law:
The exercise of these rights is subject to the exceptions set out in KVKK and limitations under applicable law. The Company may need to verify the identity or authority of the applicant before fulfilling a request.
Individuals may submit requests under KVKK to the data controller in accordance with the applicable legal requirements. Clearly describing the request, providing sufficient information to verify the applicant's identity and authority, and supplying contact details for the response can help ensure that the request is handled correctly.
[LEGAL CHECK: Confirm the method to be used for KVKK applications, including requirements relating to secure electronic signatures, registered electronic mail or other methods accepted by applicable law. Do not assume that an ordinary email address alone replaces every formal application method.]
Requests will be assessed in accordance with KVKK and the relevant legislation. Applications under Article 13 of KVKK will be concluded as soon as possible and, depending on the nature of the request, within the statutory maximum period. If processing the request incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Board and the conditions permitted by law.
The Company may request additional information or documents depending on the nature of the application. If the request is rejected, the response is considered insufficient or no response is provided within the applicable period, the individual may lodge a complaint with the Personal Data Protection Board, subject to the conditions and time limits set out in KVKK.
Authorised dealer users are responsible for protecting their account details and passwords, not sharing access credentials with unauthorised persons, and monitoring transactions carried out through their accounts. User roles and access permissions provided by the Company must be used only for the relevant business purposes.
Users who suspect that an account has been accessed without authorisation, that their credentials have been exposed or that a suspicious transaction has occurred should promptly notify the Company through its communication channels. Depending on the circumstances, the Company may temporarily restrict an account, request the renewal of access credentials or conduct a security review.
PrintEyes is a platform intended for business customers and dealers and does not target children. The Company does not intend to collect children's personal data as part of commercial account or order processes. If the Company becomes aware that a child's personal data has been collected inappropriately, it will assess the situation in accordance with applicable law and the circumstances of the case.
The Company may amend this Policy because of changes in legislation, service updates, technical infrastructure changes or changes to its data-processing activities. The revised text will be published on https://printeyes.com.tr and will apply from the publication date to the extent permitted or required by applicable law.
Where significant changes require separate notification to affected individuals, the Company will provide the necessary information through appropriate channels. Users are encouraged to review the latest version of this Policy regularly.
For questions concerning this Policy, personal data processing, privacy practices or data security, please use the following contact details:
Cookie Preferences
