Privacy Notice under the Turkish Data Protection Law (KVKK)

Last updated: 2026-05-20

1. Data Controller

MTS Hijyen Malz. San. Tic. LTD. ŞTİ. ("MTS Hygiene" or the "Company") acts as the data controller under Turkish Data Protection Law No. 6698 ("KVKK"). Registered address: Atatürk Mah. Uysal Cad. No:116, Sancaktepe / İstanbul.

2. Categories of Personal Data Processed

• Identification data: Name, surname, Turkish national ID / tax ID, signature.
• Contact data: E-mail, phone, billing and delivery address.
• Financial data: Bank / account data (for payment processing only), invoice and order amounts, current account balance.
• Transaction history: Order content, delivery records, returns, support requests.
• Digital footprint: IP address, session tokens, browser/device info, and page-view records of signed-in users (linked to your account; kept to detect unauthorised access and ensure processing security).
• Marketing preferences: Only with your explicit consent, commercial electronic message consent (İYS record).

3. Purposes of Processing

• Executing B2B order processes and invoicing
• E-Invoice / e-Archive legal obligations (Turkish Tax Procedure Law, e-Transformation legislation)
• Current account tracking and collection management
• Customer support and complaint management
• Product delivery and logistics coordination
• User account security and authentication
• Legal notification obligations (tax authority, SGK, court orders, etc.)
• Analytical and statistical reporting (anonymous / pseudonymized)
• If permitted: commercial e-mail and SMS notifications

4. Legal Basis

Your personal data is processed under the following legal bases:

• Formation or performance of a contract (KVKK Art. 5/2-c): Order, invoice and logistics processes.
• Compliance with a legal obligation (KVKK Art. 5/2-ç): Tax and accounting records.
• Legitimate interest (KVKK Art. 5/2-f): Fraud prevention, system security.
• Explicit consent (KVKK Art. 5/1): Marketing communications (only where you have given consent).

5. Data Transfers

Your personal data may be shared domestically with courier and logistics companies, payment institutions, the e-Invoice integrator, the cloud infrastructure provider and authorized public bodies as required by law. For cross-border transfers, the safeguards under KVKK Art. 9 are applied.

6. Retention Periods

• Invoice and accounting records: 10 years (Turkish Tax Procedure Law Art. 253)
• Order and delivery records: 5 years
• Customer communication records: 3 years
• Session, security and page-view logs: queryable for 1 year (Law No. 5651), then archived
• Marketing consents and İYS records: Until consent is withdrawn

7. Your Rights (KVKK Article 11)

As a data subject you have the following rights:

• Learn whether your personal data is being processed
• Request information about processing if it occurs
• Learn the purpose of processing and whether the data is used for that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction if the data is incomplete or inaccurate
• Request erasure or destruction when the legal basis no longer exists
• Object to outcomes generated against you by automated processing
• Seek compensation if you suffer damages

You can submit requests to kvkk@mtshijyen.com or in writing to Atatürk Mah. Uysal Cad. No:116 Sancaktepe / İstanbul. Your request will be answered within 30 days; you retain the right to apply to the Personal Data Protection Authority where necessary.