KVKK Notice

NFS ÇELİK YAPI İNŞAAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ (“NFS”, “the Company”) is the data controller for personal data processed through this website, its contact and quote forms, and the weight calculators. No separate representative is named in this notice. Applications go to the addresses below.

• Legal name: NFS ÇELİK YAPI İNŞAAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ
• Short name: NFS Çelik Yapı San. Tic. Ltd. Şti.
• Tax office: Sultanbeyli VD
• Head office: Eyüp Sultan Mah. Sandalcı Sk. No: 8, 34885 Sancaktepe / Istanbul
• Branch: Dudullu OSB, B-203 Sk. No: 5, 34775 Ümraniye / Istanbul
• Email: info@nfscelikyapi.com
• Second email: nfscelikinfo@gmail.com
• Mobile: +90 532 622 78 20
• Landline: +90 216 561 63 74
• Website: https://www.nfscelikyapi.com

Tax number, MERSIS number, VERBIS registration and a KEP address are not published on this website. They are not invented here. If the Company publishes them, this notice will list them.

This notice covers visitors of the public site, people who send the contact or quote form, and people who use the weight calculators. The /admin area is for authorised staff only. It is not part of the public site. This page is an information notice, not a legal opinion and not a contract.

The form links to this notice before it is sent. That is how the notice is given at the time the data is collected, by electronic means, as the Communiqué allows.

Only data the site actually uses is listed. Depending on what you do:

• Identity and contact, if you submit a form: name, optional company name, email, phone.
• Enquiry content: optional subject, optional project type (steel or construction), message, and whether the form is a contact or a quote. The date of receipt is stored with the record.
• Calculation list, only if you attach it to the quote: profile, size, length, quantity and weight. The optional unit price stays on your screen. It is not written into the saved list and is not sent with the form.
• Language: the NEXT_LOCALE cookie, which stores TR or EN.
• Staff access, only after an admin login: the nfs_admin session cookie and, if a staff member changes it, the nfs_admin_theme cookie.
• Visit measurement, only if a measurement or ads ID is configured in the site settings: data Google’s tag collects, such as an approximate location, browser and pages viewed. The public build does not load that tag unless the ID exists.
• Map and messaging: if you use the embedded map on the contact page, or you open WhatsApp, a phone link or Google Maps, those services process what they need to complete that action.

The form does not ask for a national ID number, a payment card, health data or any other special-category data. Do not write that kind of data in the message. If you do, it is not used for a special-category purpose.

Purposes are limited to what the site does today. They are not a reserve for later marketing.

• Read and answer a contact or quote request.
• Assess the scope of a quote, including a calculation list if you attached one.
• Keep the request in the Company’s record so the same enquiry can be found again.
• Forward the request to the Company inbox when outbound email is switched on.
• Remember the language you chose.
• Keep an admin session for staff who sign in at /admin, and remember that staff member’s theme choice.
• Deliver the pages you asked to open.

Collection is electronic and wholly or partly automatic. You type the form. The browser sends it to the site. Cookies and browser storage are written by the site or, in the cases below, by Google. The calculation list stays in your browser until you attach it to a quote or delete it.

“Legal basis” means which condition in KVKK Article 5 applies. This site does not rely on explicit consent for the form. The bases actually used are:

• Art. 5/2(c) — steps you asked for toward a contract: reading the quote or contact request, and serving the language you selected.
• Art. 5/2(e) — establishment or defence of a right: keeping the commercial correspondence about that request.
• Art. 5/2(ç) — a legal obligation, only where a statute actually requires the record to be kept. This notice does not treat every email as a statutory record.
• Art. 5/2(f) — legitimate interests: operating and securing the public site, and answering the request, provided this does not override your fundamental rights. This basis is not used for advertising or visit-measurement cookies.

The Board’s decision of 10 March 2022 (2022/229) and the Cookie Guidelines treat analytics and marketing cookies as not strictly necessary. Legitimate interest is not a basis for them. This site has no consent panel. The measurement tag is therefore not part of the public pages unless an ID is configured. Configuring that ID without an opt-in panel would not meet the decision.

Data is read by NFS staff who handle the enquiry. It may also be processed by these groups, only for the purpose stated:

• The host that serves the site and stores the form record, so the page and the record exist.
• An email delivery service, only when outbound email is switched on, so the request reaches the Company inbox. The code can use Resend for that delivery. The usual destination is the address in this notice.
• Google, if you load the embedded map on the contact page, or if a measurement ID is configured.
• WhatsApp / Meta, only if you open a WhatsApp link from the site.

Form data is not sold and is not used for unrelated advertising.

Since 1 June 2024, KVKK Article 9 allows a transfer abroad only when an Article 5 or 6 condition is met and one of the following is also met: an adequacy decision; an appropriate safeguard (an agreement with Board permission, binding corporate rules, a standard contract notified to the Authority, or a written undertaking with Board permission); or an incidental exception in Article 9/6. Explicit consent is only one of those incidental cases. It is not a standing basis for routine transfers.

The form record is stored in the Company’s own system first. If email delivery is on and that provider’s servers are abroad, the transfer has to rest on one of the Article 9 routes. This notice does not publish a standard-contract reference, because none is published by the Company. No visit data is sent to Google unless a measurement ID is configured. The map embed and a WhatsApp link follow Google’s or Meta’s terms once you open them.

A form record is kept long enough to deal with the enquiry and, if the correspondence becomes part of a contract or a commercial book, for the period that statute requires. When the reason ends, the record is deleted or anonymised. This page does not publish an internal destruction schedule. If one is published, it will be added here.

The calculation list stays in your browser until you clear site data. The language cookie set by the country redirect has no expiry in the code, so the browser may drop it when the session ends. The admin session lasts 8 hours. The admin theme cookie lasts one year and is written only after a staff member changes the theme.

Form records are reached through the admin sign-in. The session cookie is httpOnly. No website can promise absolute security. This notice does not claim a certificate the Company has not published.

Under KVKK Article 11 you may ask the Company to:

• Tell you whether your data is processed, and give information if it is.
• Tell you the purpose and whether the data is used in line with that purpose.
• Tell you the third parties in Turkey or abroad to whom the data was transferred.
• Correct incomplete or inaccurate data, and tell the transferees.
• Delete or destroy the data when the reason for processing has ended, and tell the transferees.
• Object to a result against you produced solely by automated analysis.
• Claim compensation if you suffer damage from unlawful processing.

Send a request that shows you are the person concerned. You can write to Eyüp Sultan Mah. Sandalcı Sk. No: 8, 34885 Sancaktepe / Istanbul, or email info@nfscelikyapi.com. A KEP address is not published here, so this notice does not offer one. Under Article 13 the request is concluded within 30 days. It is free unless the reply itself has a cost under the Board’s tariff. A refusal is explained. If the reply is refused, is incomplete, or does not arrive in time, you can complain to the Personal Data Protection Board.

Cookies, local storage and the map embed are set out in the Cookie Policy. The Privacy Policy says the same practices in plainer language. If the site changes — a new form field, a measurement ID, a published registration number — this page and the date above change with it.