Privacy Notice

1. Data Controller

This notice is provided in our capacity as data controller under the Turkish Personal Data Protection Law (KVKK No. 6698) and EU General Data Protection Regulation (GDPR) by TDM Otomotiv Sanayi ve Ticaret Anonim Şirketi ("TDM Otomotiv", "Company" or "we").

Legal Name

TDM Otomotiv Sanayi ve Ticaret Anonim Şirketi

Address

Hasanağa OSB Mah., 15. Cad., No: 11, Nilüfer / Bursa, Türkiye

Tax Office / Number

Çekirge Tax Office / 8331144531

Contact

web@tdmtr.com · +90 224 484 25 73

2. Personal Data We Process

When you contact us or apply for a position through our website, the following personal data may be processed:

Through the contact form

• Identity: name, surname
• Contact details: email, phone, company name
• Content: message body, subject line

Through the career form

• Identity: name, surname
• Contact details: email, phone
• Professional experience: applied department, all information in the CV

Automatically collected

Two distinct categories apply:

• Necessary technical / security data: IP address, server logs, browser information, security records, Cloudflare Turnstile bot-protection interactions, and the cookie-consent preference record. These are processed automatically for the security and availability of the website, on the basis of our legitimate interests / technical necessity.
• Consent-based cookies and embedded third-party content: YouTube videos, Google Maps, and similar embeds are only loaded after you give consent through our cookie banner. See our Cookie Policy.

3. Purposes of Processing

• Responding to your inquiries and managing the quotation process
• Evaluating job applications and contacting suitable candidates
• Complying with our legal obligations (tax, commercial, employment law)
• Ensuring the security of our website and preventing misuse
• Continuously improving the quality of our services

4. Legal Bases

Your data is processed on one or more of the following legal bases (KVKK Art. 5 / GDPR Art. 6). The primary basis depends on the data type:

• Necessity for the conclusion or performance of a contract (KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b)): the primary basis for processing data you submit via the contact and career forms (pre-contractual measures).
• Our legitimate interests (KVKK Art. 5(2)(f) / GDPR Art. 6(1)(f)): website security, server and security logs, bot protection, and the prevention of misuse.
• Compliance with a legal obligation (KVKK Art. 5(2)(ç) / GDPR Art. 6(1)(c)): tax, commercial and employment-law retention requirements.
• Your explicit consent (KVKK Art. 5(1) / GDPR Art. 6(1)(a)) — where required: for consent-based cookies and embedded third-party content (YouTube, Google Maps), marketing communications, retention of your CV for future positions, and — where applicable — cross-border transfers; consent is obtained as a separate, specific and revocable choice.

5. Data Sharing

Your data may be shared with:

• Service providers: Resend (USA — email infrastructure), Cloudflare Turnstile (USA — bot protection), Vercel (USA — website hosting)
• Public authorities: where required by law
• Internal staff: authorised personnel on a need-to-know basis

Cross-border transfers are managed under three distinct legal frameworks: (i) transfers from Türkiye are governed by KVKK Art. 9 on the basis of appropriate safeguards (undertakings / standard contracts), binding corporate rules, or — where applicable — explicit consent; (ii) transfers of EU/EEA personal data to third countries are based on adequacy decisions or Standard Contractual Clauses (SCCs) with supplementary measures under GDPR Chapter V; (iii) recipients in the United States are addressed via the EU-US Data Privacy Framework where the recipient is certified, otherwise via SCCs and additional safeguards. Provider-level details are available on request.

Career form: special category data warning

Please do not include special category personal data or information that is not relevant to your application — such as health data, religious or political views, trade union/association membership, biometric data, or unnecessary personal data of third parties — in your CV or attachments. If such data is submitted, it may be processed only to the extent necessary for the recruitment process or deleted.

6. Retention

• Contact form records: up to 2 years after the inquiry is resolved
• Job applications: 1 year from application date; deleted earlier if not shortlisted
• Legal obligation: as required by applicable law

7. Your Rights

Under KVKK Art. 11 and GDPR Chapter III, you have the right to:

• Be informed whether your data is being processed
• Request information about processed data
• Learn the purpose and whether data is used for that purpose
• Know third parties to whom data has been transferred (domestic or international)
• Request correction of incomplete or inaccurate data
• Request erasure or destruction under KVKK Art. 7 conditions
• Request notification of correction/erasure to third parties to whom data was transferred
• Object to outcomes of solely automated processing
• Claim compensation for damages caused by unlawful processing
• Withdraw consent at any time (without affecting past processing)
• Lodge a complaint with the Turkish Personal Data Protection Authority (KVK Kurulu) or your competent supervisory authority

8. How to Exercise Your Rights

• Email: web@tdmtr.com
• Postal: Hasanağa OSB Mah., 15. Cad., No: 11, Nilüfer / Bursa, Türkiye

We will respond within 30 days as required by the Turkish "Communiqué on the Procedures and Principles of Application to the Data Controller".

See also our Privacy Policy and Cookie Policy.