PERSONAL DATA PROTECTION (KVKK) AND GDPR DISCLOSURE NOTICE

1. Identity of the Data Controller

In accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"), your personal data may be processed by ETKO Ekolojik Tarım Kontrol Organizasyonu LTD ŞTİ ("Company" / "ETKO") as Data Controller, within the scope described below.

Data Controller: ETKO Ekolojik Tarım Kontrol Organizasyonu LTD ŞTİ

Mersis No: 0381023693100017

Address: Kazımdirik Mahallesi 160 Sokak No:13 Daire:3 Bornova/Izmir, Türkiye

Registered electronic mail (KEP) for data-subject requests: etko@hs01.kep.tr | Website: https://www.etko.com.tr

2. Categories of Personal Data Processed

Depending on how you interact with us, we may process the following categories of data:

Identity and contact data (name, email, phone, company/organisation, role),
Communication and request content (contact forms, appeal/complaint messages, career applications, quote and certification-related requests, survey responses),
Documents and files you upload (for example CV/PDF attachments, certificates or supporting documents submitted with quote/certification flows, and similar attachments),
Transaction security and technical data (IP address, browser/device information, timestamps, security and application logs),
Cookie and preference data (consent choices, language preference, limited functional/analytics identifiers where consented),
Content interaction data needed to operate the site (for example announcement display and content-view deduplication).

Special categories of personal data (KVKK Article 6 / GDPR Article 9): Unless we expressly request otherwise, please do not include special-category / sensitive personal data in CVs or other uploaded documents (for example race or ethnic origin, political opinions, religion or beliefs, appearance/clothing related to belief, membership of associations/foundations/trade unions, health data, or criminal conviction / criminal-record data). ETKO does not seek to collect such data through website uploads. If you nevertheless include them, they may be processed only to the limited extent necessary to handle your submission and in accordance with applicable law.

3. Purposes of Processing and Legal Bases

Under KVKK Article 5 / GDPR Article 6, each processing purpose is linked to a specific legal basis. Your personal data is processed, limited to what is necessary, for the following purposes:

Providing certification, inspection, and consultancy-related information and services; handling quote and certification-related requests and supporting documents (Legal basis: performance of a contract or steps prior to entering into a contract — KVKK Art. 5/2-c / GDPR Art. 6(1)(b)).
Responding to contact, career, survey, appeal, and complaint requests, including related attachments such as CVs (Legal basis: legitimate interests in responding to and managing requests — KVKK Art. 5/2-f / GDPR Art. 6(1)(f); and/or steps prior to a contract where an application may lead to employment or service engagement — KVKK Art. 5/2-c / GDPR Art. 6(1)(b)).
Operating, securing, and improving the website (language preference, consent record, fraud/abuse prevention, security logs) (Legal basis: legitimate interests in secure and functional website operation — KVKK Art. 5/2-f / GDPR Art. 6(1)(f)).
Measuring website usage and performance via analytics tools (Google Analytics / Tag Manager, Vercel Analytics & Speed Insights) (Legal basis: explicit consent — KVKK Art. 5/1 / GDPR Art. 6(1)(a); non-essential cookies load only after consent).
Loading functional third-party embeds in content where enabled (Legal basis: explicit consent — KVKK Art. 5/1 / GDPR Art. 6(1)(a)).
Complying with legal obligations applicable to ETKO as an inspection/certification body (Legal basis: legal obligation — KVKK Art. 5/2-ç / GDPR Art. 6(1)(c)).
Establishing, exercising, or defending legal claims where necessary (Legal basis: legitimate interests / establishment, exercise or defence of legal claims — KVKK Art. 5/2-e and 5/2-f / GDPR Art. 6(1)(f)).

4. Collection Methods

Personal data is collected through website forms and interactive features (including file uploads), email and other electronic correspondence, cookies and similar technologies (as described in our Cookie Policy), and technical logs generated while you use the site.

5. Recipients and Transfers

Within the limits of applicable law (KVKK Articles 8–9 and GDPR Chapter V), personal data may be disclosed to:

Service providers acting as processors on our behalf — in particular Vercel Inc. for website hosting and cloud object storage (Vercel Blob) used for uploaded files; email delivery providers; and analytics providers such as Google and Vercel Analytics where you have consented,
Business partners and suppliers to the extent necessary to deliver requested services,
Authorised public institutions and organisations where legally required,
Legal advisors and other professionals to establish, exercise, or defend legal claims.

Some providers may process data outside Türkiye / the EEA (including the United States). International transfers are carried out under KVKK Articles 8–9 and GDPR Chapter V, using appropriate safeguards applied by the relevant providers (for example standard contractual clauses and related contractual/technical measures). Cookie-based analytics tools load only after consent, as set out in our Cookie Policy.

6. Storage of Uploaded Files

When you or authorised staff upload files through the website (such as a CV with a career application, certificates or supporting documents in quote/certification processes, signed documents, public library documents, or content images), those files are stored as follows:

Production environment: files are stored in Vercel Blob (cloud object storage operated by Vercel Inc.), typically with private access controls so that downloads are served through our application to authorised users only,
Development / non-production environments: files may temporarily be stored on the application server under a restricted uploads path,
Database records store metadata and storage references (for example file path or URL) needed to retrieve the file,
Uploaded files are processed only for the purpose of the related request or content operation and are not used for unrelated marketing.

Because Vercel Blob is a cloud service, storage and related technical processing may involve infrastructure located outside Türkiye / the EEA. This constitutes a transfer to a processor as described in Section 5. Access to files containing personal data is limited to authorised ETKO personnel and technical processors acting on our instructions.

7. Retention Periods

We retain personal data only for as long as necessary for the purposes above and as required or permitted by law, including limitation periods for legal claims. Indicative periods:

Cookie consent record: about 180 days (or until you update preferences / consent version changes),
Contact, quote, career, survey, and similar form submissions (including attached files such as CVs): for the time needed to handle the request and related legal retention duties; files are deleted or destroyed together with or after the related record when no longer needed,
Security and application logs: for a limited period needed for security, troubleshooting, and abuse prevention,
Certification and contractual records and related supporting documents: according to sector-specific and contractual retention requirements.

When the retention period expires, data and associated uploaded files are deleted, destroyed, or anonymised in accordance with applicable rules.

8. Rights of the Data Subject (KVKK Article 11 and GDPR)

As a data subject, you have the right to:

Learn whether your personal data is processed,
Request information about processing,
Learn the purpose of processing and whether data is used in line with that purpose,
Know the third parties to whom personal data is transferred domestically or abroad,
Request correction of incomplete or inaccurate data,
Request deletion or destruction under the conditions set by KVKK and GDPR (including erasure where applicable),
Object to processing based on legitimate interests,
Withdraw consent at any time where processing is based on consent (without affecting prior lawful processing),
Request restriction of processing and data portability where GDPR applies,
Lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) and, where GDPR applies, with a competent supervisory authority,
Request compensation for damage arising from unlawful processing of personal data.

Automated decision-making and profiling (GDPR Articles 13(2)(f) and 22): We do not use fully automated decision-making or profiling systems that produce legal or similarly significant effects on you. Decisions relating to certification, applications, and similar processes involve human review by authorised personnel.

9. Cookies and Related Technologies

We use strictly necessary cookies for core site operation. Functional embeds and analytics tools (Google Analytics / Tag Manager and Vercel Analytics & Speed Insights) run only after consent. Marketing cookies are not currently used. Full category descriptions, inventory, and preference controls are available in our Cookie Policy and via Cookie settings in the website footer.

10. Security Measures

ETKO implements administrative and technical measures appropriate to the nature of the data and processing risks, including access controls, encrypted transport (HTTPS) where applicable, private storage settings for uploaded files where configured, and limiting access to authorised personnel and processors acting under instructions.

11. How to Contact Us

You may submit requests regarding your rights in writing to the Company address above or via our registered electronic mail (KEP) address etko@hs01.kep.tr. Depending on the nature of the request, it will be concluded free of charge as soon as possible and within thirty (30) days at the latest, subject to any fees permitted by law for certain requests.

Last updated: July 2026