Personal Data Protection Notice (KVKK)

1. Data Controller

This notice is provided pursuant to Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on Principles and Procedures for the Fulfilment of the Obligation to Inform. The data controller is ION MAKİNA ("ION Thermal Systems"), Kocabaş Mah., Mermerciler/3. Sk. No: 2/1, 20330 Honaz, Denizli, Türkiye.

Contact: ion@ionthermalsystems.com · +90 258 373 0120

2. Personal Data Processed

• Identity and contact data: name, e-mail address, phone number (optional), country (optional).
• Professional data: company name.
• Request data: product of interest, maximum operating temperature, maximum load size, process description and the content of your messages.
• Documents you choose to attach to a quote request (technical specifications, drawings, product/mould images, process documents). These may contain personal data only to the extent you include it.
• Technical data processed when you visit the website: IP address, browser and device information, requested pages and timestamps in server/security logs kept by the hosting provider.
• Data you share with us when you contact us directly by e-mail or phone.

3. Purposes of Processing

• Evaluating and responding to quote requests and enquiries, and carrying out the related pre-contractual communication.
• Sending an automatic confirmation e-mail that your request has been received.
• Operating the website securely, ensuring its availability and preventing misuse.
• Fulfilling legal obligations and responding to requests from authorised public authorities.
• Establishing, exercising or defending legal claims where necessary.

4. Method of Collection and Legal Grounds

Personal data are collected electronically through the quote request form on the website, by e-mail and by phone, and automatically through the technical infrastructure of the website. They are processed on the following legal grounds under Article 5(2) KVKK:

• Art. 5(2)(c): processing is necessary for the establishment or performance of a contract, including steps taken at your request before entering into a contract (evaluating and answering quote requests).
• Art. 5(2)(ç): processing is necessary for compliance with a legal obligation of the data controller (e.g. retention of commercial correspondence).
• Art. 5(2)(e): processing is necessary for the establishment, exercise or protection of a right.
• Art. 5(2)(f): processing is necessary for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed (website security, technical logs, communication with business contacts).

5. Recipients of Personal Data

Personal data are shared only to the extent necessary for the purposes above with the following service providers, and with authorised public institutions where required by law:

• Vercel Inc. (USA) — website hosting, server logs and temporary storage of uploaded files.
• Resend (USA) — e-mail delivery of quote requests to our sales mailbox and of the confirmation e-mail to you.
• IONOS — hosting of the company's e-mail mailbox.

6. Transfer of Personal Data Abroad

Because Vercel and Resend are located abroad and their servers may be outside Türkiye, your personal data are transferred abroad. As no adequacy decision has been announced for these countries, the transfers are based on the appropriate safeguards set out in Article 9(4) KVKK (as amended by Law No. 7499 with effect from 1 June 2024): the standard contracts announced by the Personal Data Protection Board are concluded with these service providers and notified to the Personal Data Protection Authority within five business days of signature. We do not rely on explicit consent for these transfers.

7. Retention

Files attached to the quote request form are stored temporarily only until the request e-mail is sent and are then deleted; any remaining uploads are deleted automatically within 24 hours. Quote requests and correspondence that form part of a business relationship are kept as commercial correspondence for ten years from the end of the calendar year in which they were received or sent (Turkish Commercial Code, Art. 82). Requests that do not lead to a business relationship are deleted, destroyed or anonymised once the purpose of processing has ended, in the next periodic destruction cycle, which takes place at intervals of no more than six months. Server and security logs are kept by the hosting provider for a limited period under its own retention policy.

8. Your Rights (Article 11 KVKK)

• To learn whether your personal data are processed;
• To request information if your personal data have been processed;
• To learn the purpose of processing and whether data are used in accordance with that purpose;
• To know the third parties in Türkiye or abroad to whom personal data are transferred;
• To request rectification of incomplete or inaccurate data;
• To request erasure or destruction of personal data under the conditions in Article 7 KVKK;
• To request notification of rectification, erasure or destruction to third parties to whom the data were transferred;
• To object to a result to your detriment arising from analysis exclusively through automated systems;
• To claim compensation for damage arising from unlawful processing.

9. How to Apply

You may submit your requests in accordance with Article 13 KVKK and the Communiqué on the Principles and Procedures for Application to the Data Controller: in writing to Kocabaş Mah., Mermerciler/3. Sk. No: 2/1, 20330 Honaz, Denizli, Türkiye, via registered electronic mail (KEP), with a secure electronic or mobile signature, or by e-mail to ion@ionthermalsystems.com from an e-mail address previously registered in our systems.

Your application must include your name, signature (for written applications), T.R. identity number (for Turkish citizens) or nationality and passport/identity number (for foreigners), residence or business address for notification, e-mail address, phone number if any, and the subject of your request.

Requests are answered free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. If the response requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, the response is found insufficient or not given in time, you may lodge a complaint with the Board within the periods set out in Article 14 KVKK.