TR 1. Data controller and scope
Data controller: TESKA Armatür San. ve Tic. A.Ş.
MERSİS: 0840072229100001
Address: İkitelli OSB Mah. 10 Cad. 34 Portall Plaza, No:7F, Başakşehir, İstanbul – Türkiye
Telephone: +90 212 417 04 94 · Fax: +90 212 417 04 78
General enquiries: info@teska.com.tr
Personal data requests: insankaynaklari@teska.com.tr
Registered electronic mail (KEP): teskaarmatur@hs02.kep.tr
This policy sets out the general framework for website visitors, customers and prospective customers, service requests and candidate applications connected with the TESKA website. Employee personnel administration, facility CCTV and separate online stores are not automatically brought within its scope; the relevant process requires its own notice.
2. Notices by process
3. Core principles
Personal data is processed lawfully and fairly, accurately and, where necessary, kept up to date, for specific and legitimate purposes, and in a relevant and proportionate manner. The need and retention basis for each category are assessed separately. Public availability does not permit use for every purpose. Reading a notice does not constitute consent to all processing activities.
4. Legal bases and special-category data
Depending on the specific processing activity, a directly relevant contract, legal obligation, establishment/exercise/defence of a right, or legitimate interest that does not harm fundamental rights may apply. The basis is determined separately for each activity. Consent-based processing requires a specific, informed and freely given choice. Health, biometric/genetic information, criminal convictions, religious or political views and other special-category data are not requested in general contact or service forms. Where processing is necessary, the applicable condition in the current Article 6 of the KVKK is identified and the sufficient measures prescribed by the Board are applied; general customer approval is not enough.
5. Recipients and international transfers
Website hosting and corporate email services are provided in Türkiye. Your request is processed, to the extent required for the task, by relevant TESKA departments and hosting, email and technical support providers in Türkiye. Information is disclosed to competent public authorities and courts only to the extent legally required. Contracted service providers’ access is limited by their duties and confidentiality obligations.
Optional Google Analytics measurement may involve processing outside Türkiye, depending on your choice. Its purposes, recipients and preference controls are described in the Cookie Policy. Submitting a form does not constitute permission for analytics or advertising. For regular international transfers, the applicable conditions under Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK) must be satisfied separately; cookie consent does not replace those conditions.
An adequacy decision or appropriate safeguards listed in KVKK Article 9 must be assessed. Where a standard contract is used, the correct parties and transfer roles must be selected, its annexes must reflect actual data flows and the notification obligation must be met. Exceptional or occasional transfer provisions cannot be used as the general basis for continuous analytics or advertising.
6. Retention and security
Records needed to assess and resolve a request are retained while the relevant purpose continues. Further retention after a transaction is completed is assessed against an applicable legal obligation or the need to establish, exercise or defend a specific right. The same retention period is not automatically applied to every message and attachment. Unnecessary copies, irrelevant attachments and records whose purpose has ended enter a deletion, destruction or anonymisation process. Access to records retained for an ongoing dispute is restricted.
Specific cookie and preference-record periods are stated in the Cookie Policy. You may use the personal data request channels to ask about the retention criteria applicable to your records.
Operating principles include routing requests and incident reports to the responsible team, reviewing access when duties change, defining supplier obligations and sharing personal-data files under controlled access. Suspected breaches are investigated, and applicable notification duties and time limits are assessed for the incident.
7. GDPR scope
The EU General Data Protection Regulation (GDPR) is considered where the conditions in its Article 3 apply. Accessibility from the EU alone does not bring every operation within scope. Offering goods/services to people in the EU or monitoring their behaviour there requires a separate assessment.
Where the GDPR applies, rights of access, rectification, erasure, restriction, objection and, where applicable, portability, withdrawal of consent and complaint to the competent supervisory authority remain available. Requests are normally answered within one month; any justified extension is communicated within that first month. The KVKK’s thirty-day period and the GDPR’s one-month period are not interchangeable. Applicable representative/DPO and third-country transfer arrangements must be completed separately.
8. Exercise your rights
Under Article 11 of the KVKK, you may learn whether your personal data is processed; request information if it has been processed; learn the purpose and whether it is used in accordance with that purpose; and learn the recipients in Türkiye or abroad. You may request correction of incomplete or inaccurate data, deletion or destruction where the legal conditions are met, and notification of these actions to third parties to whom the data was transferred. You may object to a result against you arising from analysis exclusively by automated systems and seek compensation for damage caused by unlawful processing.
Request channels and time limits are explained on the Data Subject Request page. Withdrawal of consent does not retroactively invalidate processing lawfully carried out on the basis of that consent before withdrawal.