1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Extra Plastik San. Tic. A.Ş. (“Extra Plastik”, the “Company”) as data controller, within the scope described below.
- Trade name
- Extra Plastik San. Tic. A.Ş.
- Address
- İkitelli OSB Mah. Milas Cad. No:1 İç Kapı No:8, Başakşehir / İstanbul, Türkiye
- Phone
- +90 262 502 35 35
- bilgi@extraplastik.com
- Website
- https://dev.extraplastik.com
This notice covers natural persons who visit our website at dev.extraplastik.com (the “Site”), create a user account, use the contact form or contact us by phone or e-mail. Separate notices apply to our employees, our business partners' staff and visitors to our plants. Visitors from the European Economic Area should also read our GDPR Notice.
2. Categories of personal data processed
Only the following personal data is processed through the Site, and only to the extent needed for the operation concerned. No products are sold on the Site, so no payment, card or invoice data is collected.
| Category | Data | When? |
|---|---|---|
| Identity | First name, last name | Account, contact form |
| Contact | E-mail address, phone number (optional) | Account, contact form, e-mail and phone correspondence |
| Professional | Company name (optional) | Account, contact form |
| Customer transaction | Department, subject and message of the contact form; notifications sent to your account and their read status | Contact form, user panel |
| Transaction security | Irreversible hash of your password, e-mail verification code, password reset key, session data, IP address, browser data, captcha result, server logs | Everyone using the Site, especially account and form operations |
| Marketing | Your consent to commercial electronic messages (e-mail, SMS, phone) and its date | Only if you give consent |
| Device | Your browser's notification subscription address and encryption keys | Only if you turn on browser notifications |
| Preferences | Language preference, notification settings | Everyone / account holders |
No special categories of personal data (health, religion, biometric data, etc.) are requested on the Site. Please do not write such data in the message field of the contact form; if you do, it is used only to answer your request.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating the user account, verifying the e-mail address, sign-in and password operations, providing the user panel | Necessary for the conclusion or performance of a contract (Art. 5/2-c) |
| Delivering account notifications on the Site, as browser notifications or by e-mail | Performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f) |
| Receiving questions, requests and complaints by contact form, e-mail and phone, routing them to the right department and answering them | Pre-contractual steps (Art. 5/2-c) and legitimate interest (Art. 5/2-f) |
| Information security; preventing abuse, spam and unauthorised access (captcha, rate limiting, server logs) | Legal obligation of the controller (Art. 5/2-ç, KVKK Art. 12) and legitimate interest (Art. 5/2-f) |
| Complying with Law No. 5651 and other legislation and answering requests of competent authorities | Expressly provided by law and legal obligation (Art. 5/2-a, ç) |
| Establishing, exercising or defending a right (in a dispute) | Art. 5/2-e |
| Sending commercial electronic messages about products, announcements and campaigns | Explicit consent (Art. 5/1) and consent under Law No. 6563 |
| Passing the subscription data to your browser vendor's push service to deliver browser notifications | Explicit consent given by allowing notifications in your browser (Art. 5/1, Art. 9) |
Consent to commercial messages and permission for browser notifications are entirely optional; refusing or withdrawing them never affects your account or your use of the Site.
4. How personal data is collected
Personal data is collected electronically: directly from you when you fill in the registration, sign-in, password reset and contact forms, change your settings in the user panel, e-mail or call us; and automatically while you use the Site (IP address, browser data, session and cookie data).
5. Transfers
Your personal data is not sold, rented or shared with third parties for advertising. It may be transferred only as required by the purposes above and in line with KVKK Articles 8 and 9, to:
- Service providers: IT providers that host the Site's server and operate the e-mail infrastructure, acting only on our behalf and instructions.
- Competent public authorities and courts: within our legal obligations and their lawful requests.
- Browser push services (abroad): if you turn on browser notifications, the notification content is passed in encrypted form to your browser vendor's push service (e.g. Google, Mozilla, Apple, Microsoft) so that it reaches your device. These services may be located abroad. This transfer takes place because you allowed notifications in your browser, and you can turn it off at any time in your notification settings.
6. Retention periods
- User account: until you delete it. You can delete your account on the “Delete Account” page of the user panel; your profile, notifications, notification settings and device registrations are then permanently deleted.
- Unverified registrations: the e-mail verification code is valid for 15 minutes; expired registrations can no longer be used.
- Password reset links: valid for 60 minutes and deleted when used.
- Notifications: the latest 80 notifications are kept per user; older ones are deleted automatically.
- Contact form messages: after the request is closed, kept for the statutory limitation periods to protect rights in a possible dispute; if you delete your account, the message is kept without a link to your account.
- Session data: expires after 120 minutes of inactivity.
- Server error logs: kept for 14 days, then deleted automatically.
- Consent to commercial messages: until you withdraw it; the withdrawal date and the earlier consent date are kept as proof for the period required by law.
Personal data whose retention period has ended is deleted, destroyed or anonymised in line with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7. Data security
All communication with the Site is encrypted with HTTPS (TLS); passwords are stored as irreversible hashes; forms are protected by a captcha and rate limiting; only authorised administrators can access the admin panel, and user data is accessible only through the user's own account.
8. Your rights (KVKK Art. 11)
By applying to us you may:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request erasure or destruction under the conditions of KVKK Art. 7,
- request that operations under (e) and (f) be notified to third parties to whom the data was transferred,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage caused by unlawful processing.
9. How to apply
Send your request in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, stating your name, surname, signature (for written applications), Turkish ID number (for foreigners: nationality and passport/ID number), address for notifications, e-mail and phone if any, and the subject of your request:
- in writing or through a notary to İkitelli OSB Mah. Milas Cad. No:1 İç Kapı No:8, Başakşehir / İstanbul, Türkiye,
- by e-mail from the address registered with us to bilgi@extraplastik.com,
- through the contact form, choosing “Personal data (KVKK / GDPR) requests”.
Your application is concluded free of charge as soon as possible and within 30 days at the latest. If the operation requires an additional cost, the fee set by the Personal Data Protection Board may apply. We may ask for additional information to verify your identity. If your application is rejected, the answer is insufficient or not given in time, you may file a complaint with the Personal Data Protection Board.
10. Changes
This notice is updated when our processing activities or the legislation change. The current version is always published on this page, with the date of the last update at the top.