Website Visitors and Contact / Request Form Privacy Notice

The data controller for personal data processed through this website is TRADIQ ULUSLARARASI MARKA GELİŞTİRME SANAYİ VE DIŞ TİCARET LİMİTED ŞİRKETİ ("TRADIQ"). Our registered address is Saraylar Mah. 464 Sk. Durmuş Ali Çoban İş Merkezi No: 1 İç Kapı No: 12 Merkezefendi / Denizli. MERSİS: 0859155503900001. Denizli Trade Registry — 55523. Tax Office: Saraylar · Tax No: 8591555039.

As of this date, no corporate email, phone, or KEP channel has been configured; applications are made in writing to the registered address above. Once these channels go live, the "Application" section of this notice will be updated and republished.

This notice covers the processing of your personal data when you visit our website and when you submit a contact or service request. The information you provide through the form — your name and surname, contact details, information about your relationship with the company you represent, service and communication preferences, and personal data included in your request description — may be processed. Data is collected wholly or partially by automated means, through the form and related electronic correspondence. We ask that you not share identity documents or special-category personal data at the initial enquiry stage.

At this date the contact and request form has been prepared technically but data collection is not active; form fields are disabled and no submission takes place. Once the form is activated, this notice will be updated and republished. No visitor-behaviour tracking, marketing, or advertising analytics tools are in use at this date.

The following technical records are, however, actually kept for the health, security, and ordinary operation of the site:

• —Server access and error logs — request timestamp, HTTP method, endpoint invoked, response status and duration. These logs live in the standard output stream (stdout) of the server container for the container's lifetime.
• —Admin panel login attempts — to enable short-lived rate limiting against repeated failed attempts, the requesting IP address and a timestamp are recorded in the 'admin_login_attempts' MongoDB collection and are automatically deleted after 30 minutes via a TTL index.
• —On the client side, your language preference (TR/EN) is stored in your browser's localStorage under the key 'tradiq.lang'. This is used so the site can load in your chosen language on your next visit.
• —Our hosting provider (Emergent Labs) runs its own platform telemetry (via PostHog) to monitor page-load health; this telemetry is injected into the site's runtime by the platform. Its scope and retention are determined by the hosting provider rather than by TRADIQ; verification is in progress.

As no visitor-submitted personal data is being actively collected at this date, the table below only lists the processing activities that are actually taking place, along with their KVKK Article 5 legal grounds. When the contact and request form is activated, this section will be updated with the form-related processing purposes and grounds.

Where a consulting engagement is entered into (offer, contract, manufacturer / supplier research, import operations, etc.), separate customer / operations privacy notices will apply. This website notice is limited to site visits and the contact / request form.

Personal data may be shared with the verified recipients below, only to the extent necessary for the relevant purpose:

• —Hosting and database infrastructure provider (Emergent Labs) — for the purpose of publishing the site and providing server and database services, acting as a data processor.
• —Font service provider (Google Fonts — Google LLC) — when your browser loads the site's font files, your IP address and browser information are transmitted to the provider.
• —Public authorities empowered by law — only if and to the extent they lawfully request information or documentation.

TRADIQ does not sell the personal data of visitors or form users to third parties, and does not perform any automated sharing with manufacturers, suppliers, or logistics providers at the initial enquiry stage.

The site uses Google Fonts. When your browser connects to that service, your IP address and browser information may be transmitted to the provider (Google LLC — United States). The verification of an appropriate transfer mechanism under KVKK Article 9 (undertaking letter, standard contract, Board authorisation, or another transfer channel) for this transfer is in progress; until verification is complete, the scope of the transfer should be understood as described in this notice.

Verification is also in progress for the jurisdiction and KVKK Article 9 mechanism of the hosting and platform-telemetry providers (Emergent Labs — assets.emergent.sh, ap.emergent.sh, static.prod-images.emergentagent.com). Once completed, the relevant transfers will be reflected explicitly in this notice.

As the form is not active on the publication date of this notice, no third-party service actively transmits form content abroad. Once the form is activated, the applicable transfer structures will be stated openly in this section.

Personal data is retained only for the periods required by the applicable legislation and necessary for the specific processing purpose. When the conditions for processing no longer apply, the data is deleted, destroyed, or anonymised in accordance with the relevant legislation.

The retention behaviour actually observed is as follows: the IP and timestamp records related to admin panel login attempts are automatically deleted 30 minutes after creation, via a TTL index. Server access and error logs live in the container's output stream for the container's lifetime and drop off when the container is restarted. The retention period for the content submitted via the contact and request form will be defined concretely when the form is activated and will be reflected in this section.

Under KVKK Article 11, as a data subject you have the following rights:

• —To learn whether your personal data is being processed.
• —To request information if your personal data has been processed.
• —To learn the purposes of processing and whether the data is used in accordance with those purposes.
• —To know the third parties to whom your personal data has been transferred, domestically or abroad.
• —To request correction of your personal data if it has been processed incompletely or inaccurately.
• —To request deletion or destruction of your personal data within the scope of KVKK Article 7.
• —To request that the correction, deletion, or destruction be notified to the third parties to whom your personal data has been transferred.
• —To object to any outcome that is adverse to you resulting from the exclusively automated analysis of your data.
• —To claim compensation for damages arising from unlawful processing of your personal data.

You may exercise your rights by sending a written application to the registered address above, in accordance with the Communiqué on Application Procedures and Principles for the Data Controller. Under KVKK Article 13, applications are responded to free of charge within thirty days at the latest; where the request incurs an additional cost, the fee determined by the KVKK Board tariff may apply.

This section will be updated and the new channels announced once corporate electronic application channels (corporate email and KEP address) are configured.