1. Scope
Extra Plastik San. Tic. A.Ş. is a company established in Türkiye and primarily processes personal data under the Turkish Personal Data Protection Law No. 6698 (see our KVKK Privacy Notice). For visitors from the European Economic Area (EEA), and for communications directed at persons in the EEA where the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) may apply, we also provide this notice. It contains the information listed in Article 13 GDPR.
2. Controller and contact
- Controller
- Extra Plastik San. Tic. A.Ş.
- Address
- İkitelli OSB Mah. Milas Cad. No:1 İç Kapı No:8, Başakşehir / İstanbul, Türkiye
- bilgi@extraplastik.com
- Phone
- +90 262 502 35 35
We have not appointed a representative in the EU under Article 27 GDPR; please use the contact details above for any request about your personal data.
3. Purposes and legal bases (Article 6 GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| User account, e-mail verification, sign-in, password operations, user panel | First and last name, e-mail, phone (optional), company (optional), password hash | Performance of a contract or pre-contractual steps – Art. 6(1)(b) |
| Delivering account notifications | Notification content, read status, notification settings | Performance of a contract – Art. 6(1)(b) |
| Contact requests | Name, company, e-mail, phone, subject, message, IP address | Legitimate interest in answering your request and pre-contractual steps – Art. 6(1)(f), (b) |
| Security and abuse prevention | IP address, browser data, session data, captcha result, error logs | Legitimate interest – Art. 6(1)(f) |
| Commercial electronic messages | E-mail, phone, consent record | Consent – Art. 6(1)(a) |
| Browser notifications | Push subscription address and keys | Consent – Art. 6(1)(a) |
| Legal obligations and defence of rights | Relevant records | Legal obligation – Art. 6(1)(c); legitimate interest – Art. 6(1)(f) |
Where we rely on legitimate interest, our interest is to operate the Site and accounts securely and to answer questions sent to us. You may object to such processing under Article 21 GDPR.
4. Recipients
Your data may be disclosed to IT providers hosting the Site and operating the e-mail infrastructure (as processors), to competent authorities where required by law and, only if you turn on browser notifications, to your browser vendor's push service (e.g. Google, Mozilla, Apple, Microsoft). Data is not shared for advertising or profiling.
5. Transfers to third countries
As the controller is established in Türkiye, data you enter on the Site from the EEA is processed in Türkiye. The European Commission has not adopted an adequacy decision for Türkiye. The transfer is necessary to provide the service you request (account, answering your enquiry) (Art. 49(1)(b) GDPR); your data is processed in Türkiye under the protection of KVKK and the security measures described in this notice.
6. Retention
Account data until you delete your account; e-mail verification code 15 minutes; password reset link 60 minutes; notifications the latest 80 per user; session 120 minutes of inactivity; server error logs 14 days; contact messages for the statutory limitation periods after the request is closed; marketing consent until withdrawn.
7. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest and to direct marketing (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3)) – use the “Communication Preferences” and “Notification Settings” pages of the user panel or write to us.
You can view and correct most of your account data and delete your account yourself in the user panel. For other requests write to bilgi@extraplastik.com; we answer within one month at the latest. You also have the right to lodge a complaint with the data protection supervisory authority of your EU member state (Art. 77).
8. Mandatory data and automated decisions
First name, last name, e-mail and password are required to create an account; name, e-mail, subject and message are required to send the contact form; without them the service cannot be provided. Other fields are optional. No automated decision-making or profiling producing legal effects within the meaning of Article 22 GDPR takes place on the Site.