Personal Data Protection Notice

1. Identity of the Data Controller

Your personal data is processed by DecorPU as data controller, within the scope and conditions described below. Current contact details of the controller: 0531 088 33 93 · info@decorpu.com · Şifa, Cihangir Sk. No:19, 34950 Tuzla/İstanbul

The terms "personal data", "processing", "data subject", "explicit consent" and "data controller" used here correspond to the definitions in Article 3 of KVKK.

2. Categories of Personal Data Processed

Depending on the nature of our relationship, the following categories may be processed: • Identity: first name, last name. • Contact: phone number and, if you choose to share, email address and company name. • Customer transaction: the request/message you submit via the quote or contact form, and the product codes you are interested in or add to your quote basket. • Technical security: IP address, browser and device information, cookie records and server/log records (for site security and, with your consent, analytics).

We do not request special categories of personal data (health, religion, biometric data, etc.) through our site; please do not enter such information into the forms.

3. Purposes of Processing

Your data is processed for the following purposes: • Receiving and evaluating your quote requests and preparing project-specific pricing, • Responding to your request and communicating with you, • Managing and resolving your requests, suggestions and complaints, • Providing and improving our products/services and running our business processes, • Ensuring the security and continuity of the website and detecting errors and misuse, • Where you give explicit consent, analysing visitor behaviour and traffic statistics to improve service quality, • Fulfilling obligations arising from applicable law and meeting our burden of proof before competent authorities.

Your data is not sold or rented to third parties for marketing without your explicit consent.

4. Legal Grounds for Processing

Your data is processed under Article 5 of KVKK on the following grounds: • Direct connection to the conclusion/performance of a contract (Art. 5/2-c): running the quote and request processes. • Compliance with a legal obligation of the controller (Art. 5/2-ç): statutory retention and information duties. • Necessity for the establishment, exercise or protection of a right (Art. 5/2-e): proof in case of dispute. • Legitimate interests of the controller, provided your fundamental rights are not harmed (Art. 5/2-f): site security, core functions and process improvement. Analytics cookies are processed solely on your explicit consent under Art. 5/1; if you do not consent, they are not run.

5. Method of Collection

Your data is collected electronically, by fully or partly automated means, when you fill in the quote and contact forms on our website, contact us by phone/email, and through cookies and similar technologies during your visit.

6. Transfer of Personal Data

Your data may be shared, to the extent required by the purposes and in accordance with Articles 8 and 9 of KVKK, with the following recipient groups: • Our cloud hosting and database provider (Supabase), • Our email notification provider (Resend), • Where you consent, our analytics provider (Google Analytics), • Competent public authorities and judicial/administrative bodies where legally required.

Some of these providers may host their servers abroad. In such cases, transfers are carried out in accordance with the conditions set out in Article 9 of KVKK (explicit consent or the safeguard mechanisms specified in the Law).

7. Retention Period

Your data is retained for as long as necessary for the purpose of processing and, in any case, for the statutory limitation/retention periods set by applicable law. Upon expiry, your data is deleted, destroyed or anonymised in accordance with Article 7 of KVKK and the related regulation.

8. Data Security Measures

To prevent unlawful processing of and access to your data and to ensure secure storage, we apply measures including restricting access privileges, encrypted (HTTPS) connections, row-level access control, strong authentication and the necessary administrative/technical safeguards.

9. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of KVKK you have the right to: • Learn whether your personal data is processed, • Request information if it has been processed, • Learn the purpose of processing and whether it is used accordingly, • Know the third parties to whom it is transferred at home or abroad, • Request rectification of incomplete or inaccurate data, • Request erasure or destruction under Article 7, • Request that rectification/erasure be notified to third parties to whom the data was transferred, • Object to a result against you arising solely from automated analysis, • Claim compensation for damages suffered due to unlawful processing.

10. How to Apply

You may submit requests concerning your rights, including the minimum information required by the relevant regulation (name, signature if written, subject of the request, etc.) and documents verifying your identity, through the channels below: Phone: 0531 088 33 93 Email: info@decorpu.com Address: Şifa, Cihangir Sk. No:19, 34950 Tuzla/İstanbul Your request will be concluded free of charge as soon as possible and within 30 days at the latest; however, if the process incurs additional cost, a fee in the tariff set by the Authority may be charged.

11. Changes to This Notice

DecorPU may revise this notice in line with legislative changes and updates to its business processes. The current version is always published on this page, and the last update date is shown in the header.