GDPR Notice.

1. Controller

The controller of the personal data described in this notice is TSY Energy, Köşklü Çeşme Mah. 563. Sk. No: 17 İç Kapı No: 1, Gebze / Kocaeli, Türkiye. You can contact us at kvkk@tsyenergy.com or by telephone on +90 (262) 658 2102.

2. Scope

This notice applies to visitors of this website located in the EU/EEA and to employees and representatives of our customers, suppliers and other business partners established there, insofar as Regulation (EU) 2016/679 ("GDPR") applies to our processing. It supplements our Cookie Policy and the privacy notices issued under Turkish Law No. 6698.

3. Categories of Personal Data

Depending on how you interact with us, we process the following categories of personal data. Providing data in our forms is voluntary; without the mandatory fields we cannot respond to your request.

• Identity and contact data: name, company, job title, country, business e-mail address and telephone number provided in our quote, contact, document request, career, data subject request and newsletter forms.
• Request content: the details of your enquiry and, for quote requests, any technical drawings you choose to attach (up to 16 MB).
• Application data: your CV and the information in your career application.
• Technical data: the page URL, referrer and UTM campaign parameters submitted with a form, a truncated IP address, and the browser user-agent recorded with form submissions and security logs.
• Consent data: a random consent ID, the cookie categories you selected, the policy version, language, truncated IP address and timestamp; marketing and newsletter consents (newsletter subscriptions are confirmed by double opt-in).

4. Purposes and Legal Bases

We process personal data only for the purposes below, each on the corresponding legal basis. Submitting a form never depends on giving marketing consent.

• Art. 6(1)(b) GDPR — contract and pre-contractual steps: responding to quote and product enquiries, preparing offers and performing contracts with our customers and suppliers.
• Art. 6(1)(c) GDPR — legal obligation: retaining records required by commercial and tax law and answering requests from competent authorities.
• Art. 6(1)(f) GDPR — legitimate interests: answering general contact requests, managing business relationships, evaluating job applications, and keeping the website and our systems secure (for example through rate limiting and audit logs). Our interest is the orderly operation of our manufacturing business and the protection of our systems.
• Art. 6(1)(a) GDPR — consent: marketing e-mails, the newsletter, and analytics and marketing cookies. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Recipients

Personal data is accessible only to authorised TSY Energy personnel on a role basis, and to service providers that host and operate our website and e-mail systems on our behalf. Data is disclosed to public authorities only where we are legally required to do so. We do not sell personal data.

6. International Transfers

TSY Energy is established in Türkiye, and personal data is processed on servers located in Türkiye. The European Commission has not adopted an adequacy decision for Türkiye.

When you send us a request from the EU/EEA, the transfer of your data to Türkiye is necessary for pre-contractual or contractual measures taken at your request and is based on Art. 49(1)(b) GDPR. Where we receive personal data from business partners in the EU/EEA under a contract, we agree Standard Contractual Clauses adopted by the European Commission with them where these are required.

If you consent to analytics or marketing cookies, Google and LinkedIn may process data in the United States under their own transfer frameworks. These services are not loaded without your consent; see the Cookie Policy. Google Maps loads only when you click to display the map. Fonts are served from our own servers.

7. Retention

We keep personal data only for the fixed periods set for each form type and record. When a period expires, records are anonymised or deleted automatically in a nightly process.

8. Security

We protect personal data with HTTPS/TLS encryption in transit, role-based access control, CSRF protection, rate limiting, validation of uploaded files, hashed passwords and an append-only audit log.

9. Your Rights

Under Articles 15 to 22 GDPR you have the following rights, subject to the conditions set out in the Regulation:

• Access to the personal data we hold about you (Art. 15).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten") (Art. 17).
• Restriction of processing (Art. 18).
• Data portability for data you provided to us on the basis of consent or contract (Art. 20).
• Objection to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Withdrawal of consent at any time, with effect for the future (Art. 7(3)).
• Complaint to the data protection supervisory authority of the EU/EEA member state in which you live or work, or where an alleged infringement took place (Art. 77).

10. Exercising Your Rights

You can submit a request through our Data Controller Application Form or by e-mail to kvkk@tsyenergy.com. We may ask for information needed to confirm your identity and will respond within one month of receipt; where the GDPR allows, this period may be extended and we will inform you of the reasons. You can change your cookie choices at any time through the cookie settings on this website.

11. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. This website is intended for business users and is not directed at children.

12. Changes to This Notice

We may update this notice when our processing or the applicable law changes. The current version is always published on this page.