Skip to main content
Under Law No. 6698

We protect your personal data with lawfulness, transparency and security as our guiding principles.

This policy explains our fundamental approach to processing personal data in the context of your relationship with Versan Boya as a customer, business partner, supplier, job applicant or website visitor.

01
Scope and responsibility

Data controller

For the purposes of the Personal Data Protection Law No. 6698, the data controller, located at Kimya Sanayicileri Organize Sanayi Bölgesi, Melek Aras Bulvarı No:38, Tuzla / Istanbul, is Versan Boya Vernik Kimya Sanayi ve Ticaret Limited Şirketi.

This page explains the general corporate policy. Activity-specific privacy notices and, where necessary, explicit consent forms provided when personal data is obtained also apply.

02
Information processed

Personal data categories

Depending on the nature of the relationship and the request submitted, the following categories of data may be processed on a limited and proportionate basis. Website forms do not request special categories of personal data; please do not share such information where it is unnecessary.

Identity informationFirst name, last name and information identifying the request
Contact detailsEmail, telephone and address information
Transaction and enquiry informationCompany, product, quotation, order and message content
Professional informationJob application, CV, education and experience information
03
Processing framework

Purposes and legal bases

Personal data may be processed to respond to contact and support enquiries, manage quotation and order processes, provide products and services, manage customer and supplier relationships, assess job applications, ensure information security and fulfil legal obligations.

  • 01

    Processing is directly related to entering into or performing a contract.

  • 02

    Versan Boya must fulfil its legal obligations.

  • 03

    Processing is necessary for the establishment, exercise or protection of a right.

  • 04

    Processing is necessary for legitimate interests, provided that it does not prejudice the data subject’s fundamental rights.

  • 05

    The data subject has given explicit consent where required by law.

04
Data collection channels

Collection methods

Personal data may be obtained through website forms, email and telephone communications, written requests, documents arising from business relationships, trade fairs and corporate meetings, and technical logs created for the secure operation of the website, by automated means or by non-automated means where part of a data filing system.

Digital channels

Web forms, email, technical logs and online communication channels.

Corporate channels

Written requests, contractual processes, meetings and physical applications.

05
Limited sharing

Transfer of personal data

To the extent required by the processing purpose, personal data may be transferred to authorised public institutions and organisations, legal and financial advisers, information technology and hosting providers, and logistics and operational business partners in accordance with the conditions in Articles 8 and 9 of the Law.

Where data is transferred abroad, the conditions prescribed by applicable legislation, appropriate safeguards and necessary technical and organisational measures are applied.

06
Life-cycle management

Retention, erasure and security

Personal data is retained for the period required by the relevant processing purpose and applicable legislation. When the basis for processing ceases to exist, data is erased, destroyed or anonymised in accordance with applicable legislation and corporate retention and disposal procedures.

Technical and organisational measures

Access restrictions, authorisation, logging, backup and awareness measures are implemented.

Purpose-limited retention

Data is managed according to the principle that it must not be retained for longer than necessary.

07
Article 11 of the Law

Rights of the data subject

Data subjects may exercise the following rights concerning their personal data by applying to the data controller.

  • 01

    Learn whether their personal data is processed and request information if it has been processed.

  • 02

    Learn the purpose of processing and whether the data is used in accordance with that purpose.

  • 03

    Know the third parties to whom data is transferred domestically or abroad.

  • 04

    Request correction of incomplete or inaccurate data.

  • 05

    Request erasure or destruction of data where the relevant conditions are met.

  • 06

    Request that correction, erasure or destruction be notified to third parties to whom the data has been transferred.

  • 07

    Object to a result arising against them through analysis by automated systems.

  • 08

    Seek compensation for damage suffered as a result of unlawful processing.

08
Requests and contact

Submit your requests under the Personal Data Protection Law.

You may submit a request clearly identifying yourself and your enquiry, marked “KVKK Data Subject Request”, in writing to our company address or from an email address previously provided to us and registered in our system. Other application methods specified in legislation may also be used. Requests are concluded free of charge as soon as possible and no later than thirty days, depending on their nature; if the procedure entails an additional cost, the fee set in the tariff determined by the Board may apply.

Personal data protection contact[email protected]