Privacy Policy and KVKK Information Notice

English — Privacy Policy and KVKK Information Notice

Last updated: 22 October 2026 · Version: 1.1

This notice explains how ADEPA ELEKTRONİK TİCARET LİMİTED ŞİRKETİ (“AdepaTrade”, “we”, “us”) processes personal data when you visit adepatrade.com, send us a request for quotation (RFQ) or enquiry, or email us about a request. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Cookies are covered in the Cookies section.

1. Data controller

2. Who this notice covers

AdepaTrade is an international business-to-business sourcing and project-supply company for electrical power equipment. Our customers may be based in Türkiye or abroad. This notice covers:

• visitors to our website;
• people who send a request for quotation or a general enquiry through the form on our website, usually on behalf of a company (for example a contractor, developer, procurement team, engineering or consultancy firm, or an industrial or infrastructure owner-operator);
• people who email us documents relating to their request.

3. Personal data we process

3.1 RFQ Privacy Notice

The form shows different fields depending on the type of request you choose. Depending on what you submit, we may process:

• Identity and contact details you provide: your name, company and type of organisation, business email address, phone number and country.
• Your enquiry and project details: the type of request; project name or reference; project location and stage; target delivery timing and delivery terms (for example Incoterms); product families and system lines (description, ratings, quantities); applicable standards; specific technical requirements; and whether you would like to discuss on-site engineering supervision or commissioning support.
• Your messages: any free-text message you write in the form.
• Limited technical and security data: a protected (keyed hash) form of your IP address, the page from which the form was sent, the site language, the date and time of submission, the result of spam checks, and the request reference number we give you.

How the security data work. Your IP address is not stored in readable form in our request records. We keep only a keyed hash of it, which we use to prevent abuse and apply submission limits. We use a similar keyed hash of your email address only to limit how often acknowledgement emails are sent. These hashes are still personal data (pseudonymised, not anonymous). The form does not collect your browser’s user-agent. A hidden anti-spam field (“honeypot”), invisible to human users, helps us identify automated submissions. Submissions blocked in this way are not stored as requests and are not emailed; we keep only a limited security log entry (the keyed hash of the IP address, the time and the reason for blocking).

Please include only the information your request needs, and do not send special categories of personal data (for example health, religious or biometric data).

3.2 Correspondence and supporting documents

Files cannot be uploaded through the website. If you wish to send supporting documents (for example bills of quantities, drawings or technical specifications), you can email them to adepa@adepatrade.com, quoting your request reference. We process the personal data in our correspondence with you and in those documents (for example names, contact details, signature blocks and any people named in the documents).

3.3 Visiting the website

When you visit the website, our hosting provider processes limited technical data needed to deliver the site (for example your IP address and the page requested). For cookies, see section 11.

Website statistics (Plausible Analytics). We use Plausible Analytics, a cookie-free web analytics service provided by Plausible Insights OÜ (Estonia), to produce aggregate statistics about how our website is used (for example which pages are visited and where visits come from). We see only aggregated figures. Plausible is used only on the public pages of the live website (adepatrade.com) and only for visitors who are not logged in.

When a page loads, Plausible processes the page address, the referring website and campaign tags; the browser, operating system and device type, derived from the browser and device information your browser sends (user-agent); your approximate location (country, region and city), derived from your IP address; engagement measurements such as scroll depth and time on page; and the events we configure. Plausible hashes your IP address and user-agent together with a value that is deleted every 24 hours (a “salt”) to calculate a visitor identifier that changes every day; it does not store raw IP addresses or user-agent strings, does not use cookies or persistent identifiers, and does not track visitors across websites, devices or days.

We limit what is sent to Plausible:

• of the campaign tags in links, only the source, medium and campaign name tags are kept, and only if they contain no email address, phone number or similar identifier; all other parameters in the address are removed;
• search terms and the addresses of pages that were not found are not sent; these pages are reported only as a search page or a “page not found” page;
• the address of the website you came from is reduced to its domain;
• Plausible’s automatic tracking of form submissions, outbound link clicks and file downloads is switched off;
• when a request for quotation or enquiry is successfully submitted, we record a single “RFQ Submitted” event; it carries only the category of the request (equipment, project, general or unknown) and does not include your name, company, email address, phone number, message or request reference.

For more information, see Plausible’s privacy policy, data policy and data processing agreement (DPA).

4. Why we process personal data

• to answer your enquiries and requests, and to send you an acknowledgement;
• where you ask for one, to prepare a quotation and clarify technical or commercial points with you;
• to obtain technical and commercial support (prices, technical information, availability) from manufacturers and suppliers in order to source the equipment you request;
• where you ask, to discuss the scope of on-site engineering supervision or commissioning support;
• to establish and manage business relationships with our customers and partners;
• to keep the website and form secure and to prevent spam, abuse and automated submissions;
• to understand, in aggregate, how the website is used and how many requests are submitted through it, so that we can improve the website (see section 3.3);
• to keep records of requests and correspondence, meet our legal obligations, and preserve records where needed to establish, exercise or defend legal claims.

5. Legal grounds for processing

We process your personal data on the following grounds under Article 5(2) KVKK:

6. How we collect personal data

Electronically: through the form on our website, through emails you send us, and, for technical data, automatically while you use the website (including through our website analytics service; see section 3.3).

7. Who we share personal data with, and why

We share personal data only for the purposes above and only as far as necessary:

• Manufacturers and suppliers. To obtain technical and commercial support for your request, we share the relevant project information, technical specifications and commercial requirements (for example equipment type, ratings, quantities, standards, project destination and delivery terms) with selected manufacturers and suppliers. This routine sourcing step does not require your personal contact details, and we do not pass them on as a matter of course. We share personal data with a manufacturer or supplier only where it is genuinely necessary for the quotation or supply (for example a delivery contact, or a name appearing in a technical document you have sent), and only to that extent.
• Hosting and business email provider. Our website and business email (adepa@adepatrade.com) are provided by Hostinger, a contracted service provider that processes data on our behalf to provide these services. Hostinger’s privacy policy and data processing agreement describe how it handles personal data. Using a service provider does not change AdepaTrade’s own responsibility as data controller.
• Website analytics provider. Our website analytics service (Plausible Analytics) is provided by Plausible Insights OÜ (Estonia), which processes the website visit data described in section 3.3 on our behalf as our data processor. Plausible’s privacy policy, data policy and data processing agreement (DPA) describe how it handles this data. Using a service provider does not change AdepaTrade’s own responsibility as data controller.
• Professional advisers (for example legal and accounting advisers), where necessary.
• Competent public authorities, where required by law.

8. Processing outside Türkiye

Some of our service providers, and some of the manufacturers and suppliers we work with, are located or process personal data outside Türkiye. This happens in the following situations:

• Website hosting, database and backups. Our website, including the database in which form submissions are stored, is hosted by Hostinger (see section 7). Hostinger’s published list of data centre locations does not include Türkiye. Our hosting account shows our website server in France and our backups in Lithuania. Connections to the website may also pass through Hostinger’s content delivery network (CDN), which operates in several countries.
• Business email. Our business email (adepa@adepatrade.com) is also provided by Hostinger. This includes any notification emails the website sends us about your request and any documents you email to us. As Hostinger’s published locations do not include Türkiye, email is also processed outside Türkiye. Emails may also pass through the sender’s and recipient’s own email providers and through the service providers listed as sub-processors in Hostinger’s published Data Processing Addendum.
• Website analytics. The website visit data described in section 3.3, including the IP address and user-agent your browser sends with each request, are processed outside Türkiye by Plausible Insights OÜ to produce aggregate website statistics. This data is processed and stored in the European Union and does not leave the EU; Plausible’s servers are in Germany, and the sub-processors that handle this data are Hetzner (Germany), Bunny (Slovenia) and UpCloud (Finland). This processing is a transfer of personal data abroad within the meaning of Article 9 KVKK.
• Manufacturers and suppliers abroad. As explained in section 7, we normally share only project and technical information with manufacturers and suppliers, not your personal contact details. Occasionally, where it is genuinely necessary for a quotation or supply, limited personal data (for example a delivery contact, or a name appearing in a technical document you have sent) may be shared with a manufacturer or supplier outside Türkiye, only for that purpose and only to that extent.

Safeguards for transfers abroad. Under Article 9 KVKK, personal data may be transferred abroad on the basis of an adequacy decision of the Personal Data Protection Board, appropriate safeguards such as the standard contracts published by the Board, or, for occasional transfers only, one of the limited exceptions listed in that article. At the date of this notice, an Article 9 KVKK safeguard for our continuing use of Hostinger and of Plausible Analytics has not yet been put in place. We will update this section if a safeguard is put in place. We will share personal data with a manufacturer or supplier outside Türkiye only where a route under Article 9 KVKK is available for that transfer, such as the Board’s standard contract or, for a genuinely occasional transfer, one of the exceptions in Article 9(6). This notice informs you of these transfers; it is not itself a safeguard and does not by itself establish compliance with Article 9 KVKK. You can ask us for more information about these transfers (see section 12).

9. Information security

We use appropriate technical and organisational measures to protect personal data, including:

• access to the website administration area and to request records requires authentication and is limited to authorised staff with only the permissions they need;
• IP addresses are stored in request records only in protected (keyed hash) form;
• form submissions are stored in our website database with our hosting provider, and form notification emails, where used, are sent through our hosting provider’s email service;
• submission limits and spam protection guard the form against automated submissions and misuse.

10. How long we keep personal data

We keep personal data for as long as needed to answer your request and manage the quotation process and business relationship, and for as long as required by legal retention obligations or to preserve records for legal claims. When these needs end, the data are erased, destroyed or anonymised in line with applicable law.

Copies of your request may exist in more than one place: the form record in our website database; the notification email sent to our business mailbox (with a copy logged by the website’s form system); any documents you email to us, which are kept in our mailbox and handled separately from the form records; and our hosting provider’s backups until the backup cycle completes. We take each of these into account when handling a request for erasure or destruction.

Website statistics. To calculate the statistics, Plausible stores individual event and visit (session) records; it does not store raw IP addresses or user-agent strings, and it deletes the salt used for the visitor identifier every 24 hours. We see only aggregated statistics. These records are kept in our Plausible account until they are deleted. Under Plausible’s data processing agreement, the data are permanently deleted without undue delay when we delete the website’s statistics or our account, and are also deleted, after prior notice to us, if our subscription ends.

11. Cookies

This website uses a small number of strictly necessary or functional first-party cookies, only in the situations described below. We do not use analytics, advertising or marketing cookies on this website. Our website statistics service, Plausible Analytics (see section 3.3), works without cookies, and its script does not write anything to your device. It only reads a browser-storage setting named plausible_ignore, if one is already present; this setting is used to exclude visits from that browser from our statistics.

You can delete or block cookies in your browser settings. Blocking cookies may prevent staff from logging in to the administration area.

12. Your rights (Article 11 KVKK)

Under Article 11 KVKK, you have the right to apply to us to:

1. learn whether your personal data are processed;
2. request information about the processing if your personal data have been processed;
3. learn the purpose of the processing and whether your data are used for that purpose;
4. know the third parties in Türkiye or abroad to whom your personal data are transferred;
5. request correction if your personal data are incomplete or inaccurate;
6. request erasure or destruction of your personal data under the conditions in Article 7 KVKK;
7. request that actions under items 5 and 6 be notified to third parties to whom your personal data have been transferred;
8. object to an outcome against you that results from analysis of your data exclusively by automated systems;
9. claim compensation if you suffer damage because your personal data were processed unlawfully.

How to make a request

Please send your request, identifying yourself and stating what you are asking for:

• by email to adepa@adepatrade.com (subject: “KVKK Request”), sent from an email address that you have previously notified to us and that is registered in our systems, or using a secure electronic signature or mobile signature;
• by registered electronic mail (KEP) to our KEP address adepaelektronik@hs01.kep.tr (subject: “KVKK Request”), sent from your own KEP address; or
• by post or hand delivery to Kurtköy Mah. Rize Sk. Byvista B Blok No: 15/1, İç Kapı No: 9, Pendik / İstanbul, Türkiye.

Please include your name and surname, your signature (for written requests), your Turkish identity number or, if you are not a Turkish citizen, your nationality and passport number or identity number (if any), your residential or business address for notifications, any email address, telephone or fax number for notifications, and the subject of your request, together with any relevant information and documents. Applications must be made in Turkish. We will respond as soon as possible and within thirty days at the latest. Requests are free of charge as a rule; if an action involves additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. We may ask for information to verify your identity.

If your request is refused, you find our reply insufficient, or we do not reply in time, you may complain to the Personal Data Protection Board under Article 14 KVKK within thirty days of learning of our reply, and in any case within sixty days of the date of your application.

13. Changes to this notice

We may update this notice when our processing or the law changes. The current version is always published on this page with its date.

14. Language

This notice is published in Turkish and English. If the two versions differ, the Turkish version prevails.

15. Contact

Questions about this notice or your personal data: adepa@adepatrade.com · ADEPA ELEKTRONİK TİCARET LİMİTED ŞİRKETİ, Kurtköy Mah. Rize Sk. Byvista B Blok No: 15/1, İç Kapı No: 9, Pendik / İstanbul, Türkiye.