Personal Data Notice (KVKK)

This privacy notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (KVKK; the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform persons who visit our website, contact us or take part in our quotation processes about how their personal data is processed.

1. Data controller

Your personal data is processed by MAHMUT TARI MAFREN MÜHENDİSLİK DANIŞMANLIK HİZMETLERİ ("MARFEN Mühendislik") in its capacity as data controller.

• Address: Şehitler Mah. 416. Sk. No: 2 İç Kapı No: 1, 41650 Gölcük / Kocaeli, Türkiye
• E-mail: info@marfen.com.tr
• Registered e-mail (KEP) address: mahmut.tari@hs01.kep.tr
• Trade registry number: Gölcük / 6196
• MERSİS (central registry) number: 4943840532200001

2. Categories of personal data processed

Contact form

Identity and contact information (full name, telephone number, e-mail address), the service you select and the content of your message. Project, location or document information that you add to your message of your own accord is also processed within this scope.

Quotation and correspondence processes

The contact information you share during the preparation of quotes and contract negotiations, the trade name of the organization you represent, project and real estate information (location, block/parcel, existing design and permit documents) and the content of correspondence.

Transaction security

The IP address, browser and device information and time stamp generated during your visit to the site and your form submission.

Cookies

The data processed through cookies and the legal grounds for such processing are explained separately in the Cookie Policy.

3. Purposes of processing

• To respond to your contact requests and questions,
• To prepare a quote for the service you request, to conduct contract negotiations and to establish the contract,
• To fulfill legal obligations relating to accounting, invoicing and commercial records,
• To ensure the security of the site and the form infrastructure, and to prevent misuse and unsolicited submissions (spam),
• To respond to requests for information and documents from authorized public institutions and organizations,
• If you give your explicit consent, to improve the content by analyzing statistics on the use of the site.

4. Legal grounds

• Law Art. 5/2-c: Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract (contact form, quotation and correspondence processes).
• Law Art. 5/2-ç: Processing is mandatory for the data controller to be able to fulfill its legal obligation (retention of commercial records, requests from authorized institutions).
• Law Art. 5/2-f: Processing of data is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (transaction security records, spam prevention).
• Law Art. 5/1: Your explicit consent (processing carried out through analytics cookies).

5. Transfer of personal data

Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in accordance with Articles 8 and 9 of the Law:

• Hosting service provider: The company that operates the servers on which the site and the form infrastructure run.
• E-mail service provider: The company that provides the e-mail infrastructure through which form messages and correspondence are transmitted and stored.
• Google Analytics (Google): Only if you give your explicit consent to analytics cookies, site usage data may be processed on Google's servers abroad.
• Authorized public institutions and organizations: Within the scope of obligations arising from legislation and upon request.

Transfers abroad are carried out on the basis of one of the conditions set out in Article 9 of the Law, as amended in 2024: for transfers to countries for which there is no adequacy decision, appropriate safeguards such as a standard contract signed with the service provider, or the exceptional cases listed in the Law (e.g., your explicit consent), are relied upon. The same rules also apply where the service provider's servers are located abroad.

6. Method of collecting personal data

Your personal data is collected by partly automated and partly non-automated means through the contact form on our website, e-mail, telephone, KEP and face-to-face meetings. Transaction security records and (subject to your explicit consent) analytics data are generated by automated means during your visit to the site.

7. Retention periods

We retain your personal data for as long as the purpose of processing requires and, at the end of that period, destroy it by deletion, destruction or anonymization. Our policy is as follows:

• Contact form messages: Up to 2 years from the conclusion of the request.
• Quotes and correspondence that result in a contract: For the retention periods set out in the Turkish Commercial Code and tax legislation.
• Transaction security records: For as long as necessary for security purposes, up to a maximum of 1 year.
• Cookie data: The periods specified for each cookie in the Cookie Policy.

8. Your rights under Article 11 of the Law

By applying to the data controller, you have the right to:

• Learn whether your personal data is being processed,
• Request information about the processing if your personal data has been processed,
• Learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• Know the third parties, domestically or abroad, to whom your personal data is transferred,
• Request the rectification of your personal data if it has been processed incompletely or inaccurately,
• Request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law,
• Request that the rectification, erasure or destruction operations be notified to the third parties to whom your personal data has been transferred,
• Object to a result to your detriment arising from the analysis of your processed data exclusively through automated systems,
• Claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

You can withdraw the explicit consent you have given for analytics cookies at any time via the "Cookie preferences" link at the bottom corner of the site.

9. Application procedure

You may submit your requests regarding your rights, pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information that allows your identity to be established, through one of the following channels:

• By a written petition bearing your wet signature, delivered by hand or sent by post to the address Şehitler Mah. 416. Sk. No: 2 İç Kapı No: 1, 41650 Gölcük / Kocaeli, Türkiye,
• From your registered e-mail (KEP) address to mahmut.tari@hs01.kep.tr,
• From your e-mail address that you have previously notified to us and that is registered in our system, to info@marfen.com.tr.

Your application must include your full name, Turkish identity number (for foreign nationals, nationality and passport or identity number), address for notifications, e-mail address if any, telephone number and the subject of your request. We will conclude your application free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If your application is rejected, if you find the response insufficient, or if no response is given in due time, you may file a complaint with the Personal Data Protection Board pursuant to Article 14 of the Law.

Last updated: 2026-10-01