Privacy Notice (KVKK)

Certified Dış Ticaret A.Ş. (“Certified” or “Data Controller”) has prepared this notice under Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform you about the personal data processed through www.certified.com.tr (the “Site”).

1. Data Controller

Certified Dış Ticaret A.Ş.
Adalet Mah. Manas Blv. No:47/B Folkart Towers A Kule Kat:32 İç Kapı No:3208
Bayraklı / İzmir, Türkiye
MERSİS No: 0621097115300001
E-mail: [email protected]

2. Personal Data Processed and Purposes

We keep data processing on the Site to the minimum needed to run it and to answer your requests. The Site does not use analytics, advertising, remarketing, push-notification or CRM tools.

a) Contact and request forms (Contact, Private Label and product pages)
Data: name and surname, company name, e-mail address, phone number and the content of your message. Purpose: answering your request and preparing an offer. Submissions are stored in the Site’s database hosted in Türkiye and sent to us by e-mail. The form does not record your IP address or browser information.

b) Technical data required to deliver the Site
Data: IP address, browser type, requested page and time (in server logs and in the security layer in front of the Site, see Section 4). Purpose: delivering the pages, security and abuse prevention (including a bot check on forms).

c) Cookies
Only cookies strictly necessary for the Site to function are used (session, WooCommerce shop functions, cookie-preference memory, bot check). No statistics, marketing or social-media cookies are used. See the Cookie Policy for the list.

3. Legal Grounds

Form data: taking pre-contractual steps at your request (KVKK art. 5/2-c) and our legitimate interest in responding (art. 5/2-f). Technical data and necessary cookies: legitimate interest (art. 5/2-f). No processing on the Site is based on explicit consent.

4. Recipients and Transfers Abroad

Your data is not sold or shared for marketing. It is processed by the following service providers on our behalf:

• Turhost (hosting) – runs the Site and its database; form submissions are stored here. Data: form content, server logs. Location: Türkiye.
• Cloudflare, Inc. (network security / CDN) – all Site traffic passes through Cloudflare’s network before reaching our server; also provides the bot check on forms (Turnstile) and cookieless page-view counting. Data: IP address and browser data (transit and temporary processing). Location: global network; company based in the USA.
• Brevo (e-mail delivery) – delivers the notification e-mail when you submit a form. Data: form content, in transit as an e-mail. Location: France (EU).
• Microsoft 365 (company e-mail) – receives and stores the notification e-mail. Data: form content. Location: Microsoft data centres (EU/US).
• GTranslate (website translation) – when you view the Site in Turkish or Dutch, those pages are delivered through GTranslate’s own translation network. If you submit a form from a Turkish or Dutch page, the submission also passes through this network. Data: IP address, requested page and form content (transit). Location: GTranslate Inc., USA.

As Cloudflare, Brevo, Microsoft and GTranslate operate outside Türkiye, the data above may be transferred abroad under KVKK art. 9. The transit through Cloudflare is a security function without profiling; the e-mail path is the company’s ordinary business e-mail infrastructure.

5. Retention

Your data is kept for as long as necessary for the purposes above and then deleted or anonymised. Form submissions are kept for a maximum of 2 years.

6. Your Rights

Under KVKK art. 11 you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom your data is transferred in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of KVKK art. 7; to request that these actions be notified to third parties to whom the data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.

You may submit requests to [email protected] or to the postal address above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are answered within 30 days at the latest.

7. Data Security

Necessary technical and organisational measures are in place to protect your personal data.

8. Contact

For questions: [email protected]