Privacy
Personal data processing notice
Last updated: 2026-07-13
This notice, provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), explains which personal data we process when you use chemotto.com, for which purposes, by which methods and on which legal grounds, to whom it may be transferred, and your rights. The site has no membership system, no marketing database, no ad tracking and no profiling.
1. Data controller
Chemotto Kimya Ltd. Şti. — Atatürk Mah. Gülnihal Sk. My Towerland No: 3377-3C Daire: 95, 34758 Ataşehir/İstanbul, Türkiye · info@chemotto.com · +90 533 048 84 86. “ChemOtto” in this notice refers to this company.
2. Data we process and how we collect it
Quote request form (/tr-en/quote/): full name, company, business email, optional phone, country;
requested products (name, CAS number where applicable, quantity/unit, optional grade/packaging) and documents
(TDS, SDS, CoA); optional message; the internal request reference; the versions of this notice and of the
explicit consent notice shown to you, your consent choice and the server timestamp. A form may contain up to
20 product lines.
Contact form (/tr-en/contact/): full name, company, business email, optional phone, country, message;
the same version/choice/timestamp records.
Security and technical data: your IP address is processed momentarily during form submission for rate
limiting (at most 5 submissions per minute per IP) and Cloudflare Turnstile bot verification; ChemOtto does
not attach it to the form content and does not retain it in application logs. Infrastructure providers may
process connection and security data in their own systems to operate and secure the service. On arrival at
the site root, your country code and browser language are read momentarily to determine the correct regional
site version; neither is stored. A single region cookie handles regional routing (see the Cookie Policy).
Visitor statistics are cookieless and aggregate; they do not build individual profiles.
Special categories: we do not request special categories of personal data under Article 6 of the KVKK. Please do not enter special-category data, or third-party data that is not necessary for your request, in free-text fields; if submitted, it is not used beyond what the request requires and is deleted where appropriate. Our services are directed at businesses.
3. Internal request reference
When a quote request is submitted, the system generates an internal reference in the form
REGION-LOCALE-DATE-SEQUENCE. On its own it contains no direct identifier; combined with the submission it
distinguishes your request. It is used only for internal tracking, the email notification and aggregate
service telemetry designed to contain no personal data; it never appears in any address shown to you or in a
cookie, and the daily counter itself stores no personal data.
4. Purposes and legal grounds
| Purpose | Data | Legal ground (KVKK Art. 5) |
|---|---|---|
| Receiving, preparing and answering your quote request; supplying requested TDS/SDS/CoA documents | Identity, contact, company, country, product request, message | Art. 5/2(c) — directly related to the establishment or performance of a contract |
| Answering enquiries sent via the contact form | Identity, contact, company, country, message | Art. 5/2(f) — legitimate interest |
| Preventing abuse of the forms (spam, bots) | IP (momentary), limited technical data | Art. 5/2(f) — legitimate interest |
| Evidencing the notice and consent records | Text versions, consent choice, timestamp | Art. 5/2(e) — establishment or protection of a right |
| Regional site routing | Country code, browser language (momentary), region cookie | Art. 5/2(f) — legitimate interest |
| Service security and operational continuity | Logs and aggregate telemetry designed to contain no personal data | Art. 5/2(f) — legitimate interest |
| Responding to requests from competent authorities | Limited to the information requested | Art. 5/2(a) / 5/2(ç) / 5/2(e) |
The processing conditions (Art. 5) and the conditions for transfers abroad (Art. 9) are distinct; transfers are explained separately below.
5. Transfers of personal data
Your data is not sold, rented, or shared for third parties’ own marketing.
5.1. Within Türkiye: data may be disclosed only to courts and competent public authorities, limited to the information requested, where a legal obligation, the establishment or protection of a right, or a duly issued official request so requires.
5.2. Service providers located abroad: owing to the site’s technical infrastructure and our corporate email processes, your data may be processed by the following providers acting as data processors:
| Provider | Role | Location/scope |
|---|---|---|
| Cloudflare, Inc. | Site infrastructure, security, bot verification, server-layer handling of form requests, and object storage for the website’s static content | Global network + sub-processors; the website’s static content is stored under Cloudflare R2’s European Union jurisdiction |
| Amazon Web Services (SES) | Delivery of your form submission to our corporate mailbox as an email | Frankfurt, Germany (eu-central-1) |
| Google (Workspace) | Receipt, storage and answering of that email (info@chemotto.com) | Global infrastructure + sub-processors |
Your submission is converted into an email notification and delivered via Amazon SES (Frankfurt) to info@chemotto.com; your email address is set as the reply-to address so we can respond directly. As our corporate mailbox is hosted on Google Workspace, subsequent correspondence may also be processed on Google’s infrastructure abroad.
No adequacy decision announced by the Turkish Personal Data Protection Board exists for these transfers, and ChemOtto does not currently apply a Standard Contract or another appropriate safeguard for this flow. For that reason, a separate Cross-Border Data Transfer Explicit Consent Notice is presented before form submission and your explicit consent is requested; the checkbox is never pre-ticked. If you do not give consent, the form is not submitted — you can reach ChemOtto by telephone (calls are not recorded) or by post at the address above. Because email sent directly to info@chemotto.com is also processed on Google Workspace, direct email is not an alternative free of cross-border transfer.
5.3. Possible risks: abroad, your data may be subject to protection rules and rights/oversight mechanisms different from those in Türkiye; it may be accessible to foreign public authorities under the laws of the relevant country; it may be processed in more than one country due to the providers’ global infrastructures; and practical difficulties may arise in exercising your rights.
5.4. Withdrawing explicit consent: you may withdraw your consent at any time through the application channels in Section 8. Withdrawal takes effect prospectively; it does not retroactively undo transfers already completed. Where no other legal ground or statutory retention obligation exists, subsequent processing based solely on consent is stopped and erasure/destruction is assessed. Each new form submission is assessed separately and consent is requested again where required.
6. Method of collection
Your data is collected electronically, by automatic or partly automatic means, through the site’s forms, the
server layer processing them, Cloudflare security and bot-verification services, Amazon SES delivery, the
Google Workspace email infrastructure and the region cookie.
7. Retention periods
Your data is retained for the periods prescribed by the applicable legislation or for no longer than necessary for the purposes for which it is processed. When the period ends and no other legal ground remains, the data is erased, destroyed or anonymised.
| Data or record type | Retention |
|---|---|
| General enquiries and information requests that do not lead to a commercial process | Up to 24 months from the last contact |
| Quotes, quote requests, order and contract correspondence and other commercial records | For the statutory period; 10 years for commercial correspondence and documents under the Turkish Commercial Code |
| Invoices, accounting and tax records | Generally 5 years under the Tax Procedure Law; 10 years where the record also falls under the Turkish Commercial Code |
| Notice/consent versions, choice and timestamp | Same period as the related submission |
| Emails and correspondence in the corporate mailbox | The applicable period above, by nature of the correspondence |
| Operational application logs | ~7 days (the Cloudflare Workers Logs window; form content and email addresses are not written by design) |
| Aggregate service telemetry designed to contain no personal data | ~90 days |
region cookie | 12 months; renewed on subsequent visits to the site root |
Where a legal dispute, an official request or the protection of our legitimate rights so requires, the relevant data may be retained, limited to that purpose, until the end of the applicable limitation and statutory retention periods.
8. Your rights under Article 11 of the KVKK and how to apply
You have the right to learn whether your personal data is processed; to request information; to learn whether it is used in line with its purpose; to know the third parties to whom it is transferred in Türkiye or abroad; to request rectification; to request erasure or destruction under Article 7; to request that these operations be notified to third parties to whom the data was transferred; to object to a result arising against you from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.
How to apply: (a) in writing — deliver or post your wet-ink-signed application marked “Chemotto Kimya Ltd. Şti. — Personal Data Application” to the address above; (b) by email — from the email address you previously provided to ChemOtto and registered in our systems, to info@chemotto.com (suggested subject: “Personal Data Application”). The application must include your full name, signature if written, Turkish ID number (for foreign nationals: nationality and passport/ID number), your address for notification, your email/phone if any, and the subject of your request; proportionate additional information may be requested to verify identity. Applications are concluded free of charge within 30 days at the latest; where a transaction entails a separate cost, the fee in the Board’s tariff may be charged. After exhausting the application route to the controller, you retain the right to lodge a complaint with the Turkish Personal Data Protection Board.
9. Automated decision-making and profiling
No automated decision-making or profiling is performed; requests are reviewed and answered by authorised persons. Cloudflare’s automated spam/bot/security assessments serve only site security and do not produce decisions with legal or similarly significant effects on you.
10. Changes
When this notice changes, the “Last updated” date is renewed. Our duty to inform does not depend on your acceptance; the version shown to you and its timestamp are recorded. Explicit consent for transfers abroad is presented separately from this notice; if a material change affects the scope of such transfers, it is notified before subsequent transfers and fresh consent is obtained where required.