Privacy Notice (KVKK)
This notice has been prepared pursuant to Article 10 of Personal Data Protection Law No. 6698 (KVKK) (the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ), in order to explain how your personal data is processed on the otoideal.com website. This notice is not a consent form; it exists to inform you.
1. Identity of the data controller
The data controller is Otoideal Otomotiv Bilişim, which operates the otoideal.com website.
| Legal name | Otoideal Otomotiv Bilişim |
|---|---|
| Address | Istanbul, Türkiye |
| info@otoideal.com |
Company registration is in progress. The following will be added to this page once it is complete: Tax / ID number, MERSİS number, Trade registry number.
Registration of the business with the trade registry has not yet been completed. For this reason, this notice does not contain a trade name, MERSİS number, trade registry number, tax identification number or registered electronic mail (KEP) address. This information has not been invented and has been deliberately left blank; once registration is complete it will be added and the version number updated. As we are established in Türkiye, we do not have a data controller representative within the meaning of the Law.
You can reach us at info@otoideal.com.
Because we remain below the thresholds for annual number of employees and annual financial balance sheet, and because our main field of activity is not the processing of special categories of personal data, we are not obliged to register with the Data Controllers' Registry (VERBİS). This exemption relates only to the obligation to register with the Registry; all other obligations under the Law — including the duty to inform, data security, responding to applications, and erasure/destruction — continue to apply to us in full.
2. Which of your data we process, for what purpose, and on what legal basis
The website has no membership, account creation or password system, and no payment is taken through the site. Orders are received as a request through the "Order" form; price and stock confirmation and payment proceed outside the website.
| Activity | Personal data processed | Purpose of processing | Legal basis (Art. 5 of the Law) |
|---|---|---|---|
| Contact form | Full name (mandatory), e-mail address (mandatory), telephone number (optional), subject, message text, IP address | Answering the question or request you submit through the form and communicating with you on that matter | Art. 5(2)(f): processing being necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms |
| "Ask Us" form on the product page | Full name, telephone number (mandatory), e-mail address (optional), the product you ask about, message text, IP address | Answering your question about the product | Art. 5(2)(f) legitimate interest |
| "Order" form (order request) | Full name, telephone number (mandatory), e-mail address (optional), product, quantity, message text, IP address | Meeting your request; contacting you to confirm price, stock and delivery terms | Art. 5(2)(c): processing being necessary provided that it is directly related to the establishment or performance of a contract. Where no contract is established, Art. 5(2)(f) legitimate interest |
| Product review form | The name you provide, review text, rating | Publishing your review on the relevant product page after we have examined and approved it | Art. 5(2)(f) legitimate interest |
| Newsletter subscription | E-mail address, name, IP address, date of registration | Sending commercial electronic messages containing campaigns, new products and promotional content | For sending, Art. 5(1): explicit consent. For retaining the record of consent, Art. 5(2)(ç): compliance with a legal obligation of the data controller (Law No. 6563 and the related Regulation) |
| Form security | IP address | Preventing forms from being completed by automated tools and limiting the number of submissions per minute | Art. 5(2)(f) legitimate interest |
| Visiting the site (session record) | IP address, browser information (user agent) | Maintaining the session and ensuring the security of the site | Art. 5(2)(f) legitimate interest |
| Product review invitation e-mail | Name, e-mail address, name of the product purchased | Asking for your opinion about a product in cases where you have previously purchased it | Art. 5(2)(f) legitimate interest |
A warning about free-text fields: everything you write in the message field of our forms is recorded. Please do not enter special categories of personal data listed in Article 6 of the Law — such as health information, identity numbers, religion or membership details — into these fields; we have no purpose in processing such data.
Product reviews: after approval, your review is published publicly on the product page together with the name you provided in it. You are not required to write your full name. No e-mail address or IP address is collected in the review form.
Newsletter: since registration with the Message Management System (İleti Yönetim Sistemi – İYS), which is required for sending commercial electronic messages, has not yet been completed, no newsletter is currently being sent. You may withdraw your explicit consent at any time; simply write to info@otoideal.com.
3. The method by which we collect your personal data
Your personal data is obtained entirely by automated means, through the electronic forms on our website (the contact form, the product question and order request forms, the newsletter box and the review form) and through the session and cookie mechanism that operates while you visit the site. Apart from this, the historical records described below were obtained by means of a database migration from our previous e-commerce system.
4. Records inherited from our previous website
For the sake of transparency: when our website was rebuilt, the records held in our previous e-commerce system were migrated to the new database:
- 114 customer records (first name, surname, e-mail address, telephone number) and 35 address records linked to them,
- 51 order records (full name, e-mail, telephone, billing and delivery address, payment and shipping method, customer note, IP address),
- 1,169 newsletter subscriber records (e-mail address, name, IP address),
- 124 blog comment records (name, e-mail address, comment text; e-mail addresses are not published on the site),
- 45 product review records (author name, review text and rating only).
Because the site has no membership system, the password information in the inherited customer records has not been used and has been invalidated; it is not possible to log in to the site with these records.
The inherited records are being reviewed. Order records will be retained as required by the applicable financial and commercial legislation; beyond that, records that no longer serve a current purpose, together with the IP addresses contained in them, will be erased or anonymised.
5. To whom and for what purpose we transfer your personal data
We do not sell your personal data and we do not share it with third parties for marketing purposes. Your data is transferred only to the following recipients, for the purposes stated next to each of them.
| Recipient | Capacity and country | Data transferred | Purpose of transfer |
|---|---|---|---|
| Our hosting provider | Data processor — Türkiye | All data processed on the site (stored on the server) | Hosting of the website and the database |
| Brevo (Sendinblue SAS) | Data processor — France (abroad) | The full name, e-mail address, telephone number, product and message content you submit through a form; in review invitation e-mails, the name, e-mail address and product name | Technical delivery of outgoing e-mails |
| Cloudflare, Inc. | Data processor — USA (abroad) | The content and sender details of e-mails sent to info@otoideal.com | Domain name management (DNS) and routing of incoming e-mail |
| Google LLC (Gmail) | Data processor — USA (abroad) | All e-mails reaching info@otoideal.com | Hosting of the corporate mailbox |
| Competent public authorities and institutions | Data controller — Türkiye | The data requested | Fulfilment of the obligation to provide information and documents arising from legislation (Art. 5(2)(ç) and Art. 8(2)(a)) |
Your site data is stored on servers located in Türkiye. Visitor traffic reaches the server in Türkiye directly; visitor IP addresses do not pass through a content delivery network.
Transfer abroad
As shown in the table above, your personal data is transferred abroad because of the e-mail flow. We are not hiding this.
The Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) has to date issued no adequacy decision for any country, sector or international organisation; accordingly, there is no adequacy decision for France or the USA either. Because these transfers are part of our ordinary business flow, the "occasional" grounds set out in Article 9(6) of the Law cannot be relied upon either. The transfer must therefore be based on the standard contract published by the Board under Article 9(4) of the Law; once that process is complete, its date and the notification made to the Authority will be added to this section.
Onward transfers by our service providers to their own sub-processors are subject to the same rules pursuant to Article 9(8) of the Law.
6. Cookies
Only two first-party cookies, both strictly necessary for the operation of the site, are used on our website:
| Cookie name | Purpose | Type | Party | Retention period |
|---|---|---|---|---|
| XSRF-TOKEN | Ensuring form and session security against cross-site request forgery (CSRF) | Mandatory (strictly necessary) | First party | 2 hours |
| otoideal-session | Maintaining session continuity; enabling the contact, product question, order request and review forms to work | Mandatory (strictly necessary) | First party | 2 hours |
The data collected through these cookies is processed on the basis of the legitimate interest condition in Article 5(2)(f) of the Law.
No cookies for analytics, performance, advertising, marketing or profiling are used on our site. There are no third-party cookies; tracking technologies such as Google Analytics, Google Tag Manager, advertising pixels and reCAPTCHA are not used. No personal data is transferred abroad through cookies.
Why is there no cookie consent banner? All of the cookies we use are strictly necessary for the site to function, so explicit consent is not required for them. Where a processing condition other than explicit consent exists, asking for consent has been found by the Board to be contrary to the principle of good faith. For this reason we do not show you an "accept / reject" banner that offers a choice which does not in fact exist. If a non-essential cookie is added in the future, you will be informed in advance and your explicit consent will be obtained separately.
You can delete or block cookies through your browser settings; however, if you block the strictly necessary cookies, parts of the site — including form submission — will not work.
7. Retention periods
These periods are not merely written down: an automated clean-up job runs on the server every night and deletes records whose period has expired.
| Record | Retention period |
|---|---|
| Session records (IP address and browser information) | 2 hours; automatically deleted on expiry |
| IP records kept for form security (submission rate limit) | 1 minute |
| IP address recorded with a form message | 90 days; then cleared automatically, while the message itself remains |
| Contact form, product question and order request messages | 3 years from the creation of the record; then deleted automatically |
| Published product reviews | For as long as the review remains published; deleted when it is taken down |
| Newsletter consent records | 3 years from the date on which the consent ceases to be valid (Art. 13 of the Regulation on Commercial Communication and Commercial Electronic Messages). The IP address of anyone who unsubscribes is cleared immediately. |
| Order and invoice records | For the retention periods laid down in the applicable tax and commercial legislation (up to 10 years) |
| Records inherited from our previous website that no longer serve a current purpose | Erased or anonymised once the review is complete |
8. What we do not do
- No payment is taken through the site; no credit card or bank details are collected or stored.
- There is no membership, account or password system.
- No analytics or advertising tool that tracks visitor behaviour is used.
- Your personal data is not analysed exclusively by automated systems; no automated decision-making or profiling is carried out about you.
- We have no purpose in collecting special categories of personal data (health, religion, biometric data, etc.).
9. Your rights under Article 11 of the Law
By applying to the data controller, you have the following rights in relation to yourself:
- a) to learn whether your personal data is being processed,
- b) to request information if your personal data has been processed,
- c) to learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
- ç) to know the third parties in Türkiye or abroad to whom your personal data is transferred,
- d) to request the correction of your personal data if it has been processed incompletely or inaccurately,
- e) to request the erasure or destruction of your personal data within the conditions set out in Article 7 of the Law,
- f) to request that the actions taken under paragraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
- g) to object to a result arising against you as a consequence of your processed data being analysed exclusively through automated systems,
- ğ) to claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.
In addition, for processing that is based on explicit consent — such as newsletter subscription — you may withdraw your explicit consent at any time.
10. How to apply
You must submit your application in Turkish and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ). Your application must mandatorily include the following information:
- your first name, surname and, if the application is in writing, your signature,
- your Turkish identity number; if you are a foreign national, your nationality, passport number, or identity number if you have one,
- your place of residence or business address for service of notice,
- your e-mail address for notification, if any,
- the subject of your request.
You may send your application to info@otoideal.com with a secure electronic signature or mobile signature, or from the e-mail address you have previously notified to us and which is registered in our system. Since we do not yet have a registered electronic mail (KEP) address, applications cannot be received via KEP; this section will be updated once a KEP address is obtained. Where your identity cannot be verified, we may request additional information and documents from you.
Your application will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. If your application is rejected, if you find our response insufficient, or if no response is given within the time limit, you reserve the right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
11. Updating of this notice and entry into force
This notice is updated if there is any change in our data processing activities or our infrastructure. If we need to start processing your personal data for a new purpose, we will inform you separately before that processing begins.
Effective date: 10 September 2026 | Version: 1.0
