As Kırkhanlı İnşaat (the “Company”), we attach great importance to the security of your personal data. This information notice has been prepared, in our capacity as data controller and pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to explain the purposes for which and the legal grounds on which we process your personal data, to whom we may transfer it, and your rights.
1. Data Controller
Kırkhanlı İnşaat
Our contact details are available on the Contact page.
2. Categories of Personal Data Processed
Depending on the nature of your relationship with our Company, the following personal data relating to you may be processed:
| Data category | Examples of data | Data subject group |
|---|---|---|
| Identity | First name, surname, title | Customers, prospective customers, supplier employees, job applicants, visitors |
| Contact | Telephone number, email address, postal address, company name | Customers, prospective customers, supplier employees, job applicants |
| Customer transaction | Quotation requests, project information, order and invoice details, content of correspondence | Customers, prospective customers |
| Finance | Invoice details, tax office and tax number, bank account details | Customers, suppliers |
| Transaction security | IP address, browser information, form submission records, website access logs | Website visitors |
| Professional experience | CV, education and employment history, position applied for | Job applicants |
| Marketing | Cookie records, projects of interest | Website visitors |
As a rule, our Company does not request special categories of personal data (such as health, religion, ethnic origin or biometric data). We kindly ask you not to include such information in documents such as your CV.
3. Purposes of Processing Personal Data
Your personal data are processed for the following purposes, in a manner that is relevant, limited and proportionate to those purposes:
- Receiving, assessing and responding to requests submitted via contact and quotation forms, or by email, telephone or WhatsApp;
- Preparing quotations for construction projects, analysing project requirements and providing information;
- Concluding and performing contracts; carrying out project, construction and handover processes;
- Providing post-handover support services;
- Carrying out invoicing, accounting and finance processes;
- Managing relationships with suppliers and business partners;
- Assessing job applications and carrying out human resources processes;
- Ensuring the security of the website and preventing misuse and spam submissions;
- Compiling statistics on the use of the website and improving service quality;
- Fulfilling obligations arising from legislation and responding to requests from competent public authorities and institutions;
- Establishing, exercising and protecting rights in legal disputes.
4. Legal Grounds for Processing Personal Data
Your personal data are processed on the basis of the following legal grounds set out in Article 5 of the KVKK:
- Processing is expressly provided for by law (Art. 5(2)(a)): retention and reporting obligations under the Tax Procedure Law, the Turkish Commercial Code and related legislation;
- Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): quotation, contract, project and construction processes;
- Processing is necessary for the data controller to fulfil its legal obligations (Art. 5(2)(ç)): invoicing and providing information to public authorities;
- Processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)): use as evidence in potential disputes;
- Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5(2)(f)): responding to requests and complaints, website security and improving service quality;
- Your explicit consent (Art. 5(1)): where none of the above legal grounds applies, for example for non-essential cookies and services requiring the transfer of data abroad.
5. Method of Collecting Personal Data
Your personal data are collected through the contact and quotation forms on our website, email, telephone, WhatsApp, business cards provided at trade fairs and meetings, contracts and order documents, job application channels, and cookies and server logs during use of the website; by fully or partially automated means, or by non-automated means provided that they form part of a data filing system.
6. Transfer of Personal Data
Your personal data may be transferred to the following groups of recipients, to the extent necessary to achieve the purposes set out above and in accordance with Articles 8 and 9 of the KVKK:
- Competent public authorities and institutions: within the scope of obligations arising from legislation (tax offices, courts, law enforcement authorities, etc.);
- Business partners from whom we obtain services: financial advisory, legal advisory, information technology and hosting, courier and logistics companies;
- Our affiliates and solution partners: to the extent necessary to carry out quotation, project and construction processes;
- Service providers established abroad: our website uses map (Google Maps), video (YouTube), visitor statistics (Google Analytics) and form security (Google reCAPTCHA) services. When these services are used, data such as your IP address and browser information may be transferred to servers located abroad. Such transfers are carried out in accordance with the conditions set out in Article 9 of the KVKK.
Under no circumstances are your personal data sold or rented to third parties for commercial purposes.
7. Retention Periods of Personal Data
Your personal data are retained for the period required by the purposes of processing and for the periods prescribed by the relevant legislation. The principal retention periods are as follows:
| Data / document | Retention period |
|---|---|
| Commercial books, invoices and accounting records | 10 years (Turkish Commercial Code, Tax Procedure Law) |
| Contracts and order documents | 10 years from the termination of the contract |
| Contact and quotation form requests, correspondence | 2 years from the conclusion of the request |
| Job applications and CVs | 1 year from the date of application |
| Website access logs | 2 years (Law No. 5651) |
| Cookies | The periods specified in the Cookie Policy |
Personal data whose retention period has expired are periodically erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
8. Security of Personal Data
Pursuant to Article 12 of the KVKK, administrative and technical measures are taken to ensure an appropriate level of security in order to prevent the unlawful processing of and unlawful access to your personal data and to ensure their safekeeping. These measures include encrypted data transmission via SSL/TLS, authorisation and access control, form security (CSRF protection, submission rate limiting, bot protection), regular backups, use of up-to-date software and confidentiality undertakings by employees.
9. Your Rights under the KVKK
Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to:
- Learn whether your personal data are being processed;
- Request information about the processing if your personal data have been processed;
- Learn the purpose of processing of your personal data and whether they are used in accordance with that purpose;
- Know the third parties, in Türkiye or abroad, to whom your personal data have been transferred;
- Request the rectification of your personal data if they have been processed incompletely or inaccurately;
- Request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK;
- Request that the rectification, erasure and destruction operations be notified to third parties to whom your personal data have been transferred;
- Object to any outcome to your detriment arising from the analysis of the processed data exclusively through automated systems;
- Claim compensation for damage if you suffer damage as a result of the unlawful processing of your personal data
You are entitled to each of the rights listed above.
10. Method of Application
You may submit your requests concerning your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by means of a written petition containing information identifying you (first name, surname, Turkish ID number or, for foreign nationals, nationality and passport number), your address for notification, your email address and telephone number if any, and the subject of your request:
- In person or through a notary public to our Company address;
- Via registered electronic mail (KEP), secure electronic signature or mobile signature;
- From the email address you have previously notified to our Company and which is registered in our system, to Contact page.
Your application will be concluded free of charge as soon as possible, depending on its nature, and within 30 days at the latest. Should the process require an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If your application is rejected, the response given is found insufficient, or no response is given in due time, you reserve the right to lodge a complaint with the Personal Data Protection Board.
11. Amendments
This information notice may be updated in line with changes in legislation and Company practices. The current version is always published on this page. For detailed information on cookies, please refer to the Cookie Policy, and for our practices relating to the website, please refer to the Privacy Policy.
Last updated: 15.10.2026