Privacy Notic
This Privacy Notice explains how GGCHEM Kimya ve Tekstil San. Tic. Ltd. Şti. ("GGCHEM", "we") processes personal data through the website www.ggchemical.net.
It is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, Articles 13 and 14 of the EU General Data Protection Regulation 2016/679 ("GDPR"). Both regimes are addressed in a single document so that the two never diverge.
The scope of this notice is limited to this website. Personal data processed outside the website — employee records, supplier contracts, physical visitor logs and similar activities — is covered by separate notices.
This is not a consent document. Processing that requires your consent is described separately in our Consent Statement. Our duty to inform you applies regardless of whether you give any consent.
1. Who We Are — Data Controller
| Company | GGCHEM Kimya ve Tekstil San. Tic. Ltd. Şti. |
| Website | www.ggchemical.net |
| info@ggchemical.net | |
| Address | Ergene 2 OSB Mah. Omurtak Cad. No:2 Ulas Ergene/Tekirdag/Turkiye |
| Telephone | +90 282 655 56 78 |
| Mersis No | 0395094270300013 |
| Trade Registry No | 16795 |
| Tax Office / Tax No | Çorlu / 3950942703 |
| Registered electronic mail (KEP) | ggchem@hs01.kep.tr |
2. What Personal Data We Process
Only the following personal data is processed through this website. This list reflects what the website actually does.
| Category | Data | Source |
|---|---|---|
| Identity | First name, last name | Contact form |
| Contact details | E-mail address, telephone number | Contact form |
| Enquiry content | Subject and message text, together with any further information you choose to include | Contact form |
| Technical and security data | IP address, browser and device information, date and time of access, requested page | Server access logs — generated automatically when you visit |
| Marketing | Consent to receive commercial electronic messages, and the record of that consent | Contact form — only if you separately opt in |
| Cookie data | Your cookie preference and session identifier | Cookies — detailed in our Cookie Policy |
We do not request special categories of personal data (health, religious belief, trade union membership and similar) through this website. Please do not include such information in the contact form.
This website is not directed at children and we do not knowingly collect data from them.
3. Why We Process It, and On What Legal Basis
The table below gives the legal basis under both regimes. Where you are in Türkiye, the KVKK column applies; where you are in the EU or EEA, the GDPR column applies.
| Purpose | Legal basis — KVKK | Legal basis — GDPR |
|---|---|---|
| Responding to enquiries, sample requests and quotation requests submitted through the contact form | Art. 5/2-c — directly related to the conclusion or performance of a contract | Art. 6(1)(b) — steps prior to entering into a contract |
| Answering technical questions and providing product documentation | Art. 5/2-c | Art. 6(1)(b) |
| Keeping the website secure and preventing automated abuse | Art. 5/2-f — legitimate interest | Art. 6(1)(f) — legitimate interest |
| Complying with statutory obligations | Art. 5/2-ç — legal obligation | Art. 6(1)(c) — legal obligation |
| Establishing, exercising or defending legal claims | Art. 5/2-e — establishment or protection of a right | Art. 6(1)(f) — legitimate interest |
| Sending commercial electronic messages | Art. 5/1 — explicit consent | Art. 6(1)(a) — consent |
| Non-essential cookies | Art. 5/1 — explicit consent | Art. 6(1)(a) — consent, with ePrivacy Art. 5(3) |
Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms. You may object to such processing at any time (see section 8).
Consent is never a condition of service. You can submit the contact form and receive a reply without opting in to marketing messages.
4. How Long We Keep It
| Data | Retention period | Reason |
|---|---|---|
| Contact form records (name, e-mail, telephone, message) | 2 years from closure of the enquiry | Reasonable period for enquiries that do not lead to a commercial relationship |
| Records of enquiries that become a commercial relationship | 10 years from the end of that relationship | General limitation period, Turkish Code of Obligations Art. 146 |
| Server access logs (IP, timestamp, page) | 1 year | Period required for security monitoring and incident investigation |
| Marketing consent records | 3 years after consent is withdrawn | Burden of proof under Law No. 6563 and the Message Management System (İYS) |
| Record that this notice was provided | Same period as the related record | The burden of demonstrating compliance rests with us |
| Cookie data | Varies by cookie — see the table in our Cookie Policy | According to the function of each cookie |
When a period expires, the data is deleted, destroyed or anonymised.
5. Who We Share It With
| Recipient | Country | Data shared | Purpose | Nature |
|---|---|---|---|---|
| Leaseweb USA, Inc. — hosting provider | United States (Virginia) | All data submitted through the website, and server access logs | Hosting of the website | Continuous |
| Google Ireland Ltd. / Google LLC — reCAPTCHA | Ireland and United States | IP address, browser information, interaction data | Preventing automated form submissions | Continuous |
| Google Ireland Ltd. — Google Maps | Ireland | IP address, browser information | Displaying the location map | Only when you choose to load the map — occasional |
| WhatsApp Ireland Ltd. / Meta | Ireland and United States | Your telephone number and the message you send | Contact via the WhatsApp line | Only when you choose to use it — occasional |
| Competent public authorities | Türkiye | Data requested | Compliance with legal obligations | On request |
We do not sell personal data and we do not share it for third-party advertising.
6. International Transfers
The servers hosting this website are located in the United States. As a result, data submitted through the website — including your IP address and server access logs — is processed outside Türkiye and outside the EEA. Because this happens on every visit, the transfer is continuous rather than occasional.
6.1. Under Turkish law (KVKK Art. 9)
Article 9, as amended by Law No. 7499 with effect from 1 June 2024, permits transfers abroad on three successive grounds:
- Adequacy decision — where the Personal Data Protection Board has issued an adequacy decision for the country, sector or international organisation concerned.
- Appropriate safeguards — where no adequacy decision exists: standard contractual clauses, binding corporate rules, a written undertaking with Board authorisation, or an agreement that is not an international treaty.
- Exceptional cases — where neither of the above is available, and only for transfers that are one-off or occasional and not continuous.
Explicit consent sits in the third tier only. It cannot, on its own, support a continuous transfer. Our hosting transfer is therefore based on appropriate safeguards, not on your consent.
6.2. Under EU law (GDPR Chapter V)
For data subjects in the EEA, transfers to the United States are made on the basis of the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.
You may request a copy of the safeguards in place by contacting us at the address in section 1.
6.3. Transfers you initiate
Loading the map or using the WhatsApp link connects you directly to the relevant provider and transmits your IP address to them. These transfers begin with your own action and are not continuous.
7. How We Protect Your Data
- The website and all form submissions are transmitted over HTTPS.
- Session cookies are protected with the HttpOnly, Secure and SameSite attributes.
- Form submissions are protected against automated abuse.
- Access to the administration panel is restricted to authorised users.
- Access to personal data is limited to staff who need it to perform their duties.
- Our hosting provider is engaged under a contract containing data protection commitments.
8. Your Rights
Your rights arise under Article 11 of the KVKK and, where the GDPR applies, under Articles 15 to 22.
| Right | KVKK | GDPR |
|---|---|---|
| To learn whether your personal data is processed, and to request information about it | Art. 11 | Art. 15 — access |
| To have inaccurate or incomplete data corrected | Art. 11 | Art. 16 — rectification |
| To have your data erased | Art. 11 and Art. 7 | Art. 17 — erasure |
| To have processing restricted | — | Art. 18 — restriction |
| To receive your data in a portable format | — | Art. 20 — portability |
| To object to processing based on legitimate interest, and to direct marketing | Art. 11 | Art. 21 — objection |
| Not to be subject to a decision based solely on automated processing | Art. 11 | Art. 22 |
| To be told which third parties your data has been transferred to | Art. 11 | Art. 15(1)(c) |
| To have corrections and erasures notified to those third parties | Art. 11 | Art. 19 |
| To withdraw consent at any time | Art. 5/1 | Art. 7(3) |
| To claim compensation for damage caused by unlawful processing | Art. 11 | Art. 82 |
We do not carry out automated decision-making or profiling that produces legal effects concerning you.
Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal.
9. How to Exercise Your Rights
Complete the form on our Data Subject Application Form page and submit it by any of the following routes:
- In person at our registered address with a signed copy, or by notice served through a notary
- By e-mail signed with a secure electronic signature or mobile signature
- To our registered electronic mail (KEP) address
- From an e-mail address you have previously provided to us and which is registered in our systems
We respond within thirty days at the latest. Where the GDPR applies, we respond without undue delay and in any event within one month of receipt; that period may be extended by two further months where the request is complex, in which case we will tell you within the first month and explain why.
Applications are free of charge. Where responding involves a cost, we may charge the fee set in the tariff published by the Personal Data Protection Board.
10. Complaints
If your application is refused, if you find our response insufficient, or if we fail to respond in time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning our response and in any event within sixty days of your application.
If you are in the EEA, you may also lodge a complaint with the supervisory authority of your Member State of residence, place of work, or the place of the alleged infringement, and you have the right to an effective judicial remedy.
11. Representative in the European Union
Where we offer goods or services to data subjects in the European Union, we have designated a representative in the Union in writing, in accordance with Article 27 of the GDPR. The representative's details are given in section 1 and may be contacted on all matters relating to the processing of your personal data.
12. Changes to This Notice
We update this notice when our processing activities or the applicable law change. The current version is always published on this page, with its version number and effective date shown below.
Version: 2026.1
Effective date: 2026
