Privacy Policy
Detailed information on how we collect, use, share and protect your personal data.
1. Introduction
This Privacy Policy explains how TDM Otomotiv Sanayi ve Ticaret Anonim Şirketi ("TDM Otomotiv", "we") processes personal data via tdmtr.com under Turkish KVKK No. 6698 and EU GDPR.
For point-of-collection details, see our Privacy Notice; for cookies, see our Cookie Policy.
2. Data Controller
- Address
- Hasanağa OSB Mah., 15. Cad., No: 11, Nilüfer / Bursa, Türkiye
- Tax Number (VKN)
- 8331144531 — Çekirge Tax Office
- Contact
- web@tdmtr.com · +90 224 484 25 73
3. Data We Collect
| Category | Source | Examples |
|---|---|---|
| Identity | Contact / career form | Name, surname |
| Contact details | Contact / career form | Email, phone, company |
| Professional experience | Career form (CV upload) | Education, work history, skills |
| Content | Contact form | Message, subject |
| Necessary technical / security data | Automatic (server, security) | IP, server logs, browser info, Cloudflare Turnstile interactions, cookie-consent record — processed on the basis of legitimate interest / technical necessity |
| Consent-based cookies / embedded third-party content | After cookie banner consent | YouTube, Google Maps embeds — only loaded if you give explicit consent |
4. Purposes
- Responding to inquiries
- Managing supplier / customer relationships and quotation processes
- Evaluating job applications
- Fulfilling legal and tax obligations
- Securing the website (bot protection via Cloudflare Turnstile)
- Continuous service improvement
5. Legal Bases
Your data is processed on one or more of the following bases. The primary basis depends on the data type:
- Contract performance (Art. 5(2)(c) / 6(1)(b)) — primary basis for processing contact-form / career-form submissions (pre-contractual measures)
- Legitimate interest (Art. 5(2)(f) / 6(1)(f)) — site security, server / security logs, bot protection, prevention of misuse
- Legal obligation (Art. 5(2)(ç) / 6(1)(c)) — tax, commercial and employment law retention
- Explicit consent (KVKK Art. 5(1) / GDPR Art. 6(1)(a)) — used only for processing genuinely based on consent: consent-based cookies and embedded third-party content (YouTube, Google Maps), marketing communications, retention of your CV for future positions, and — where applicable — cross-border transfers
6. Retention
- Contact messages: up to 2 years after resolution
- Job applications: 1 year (earlier on request)
- Contractual relationship: 10 years from termination (Turkish Commercial Code Art. 82)
- Cookies: as defined in the Cookie Policy
7. Third-Party Sharing
We do not sell your data. Sharing may occur with:
- Processors: Vercel (hosting — USA), Resend (email delivery — USA), Cloudflare (bot protection — USA)
- Public authorities when legally required
- Professional advisers (lawyers, auditors) as necessary
8. International Transfers
Some of our processors may operate infrastructure in the EU and/or USA. Three legal frameworks apply in parallel:
- Transfers from Türkiye — KVKK Art. 9: appropriate safeguards (undertakings / standard contracts), binding corporate rules or — where applicable — explicit consent. Provider-level mechanisms are documented internally.
- Transfers of EU/EEA personal data to third countries — GDPR Chapter V: adequacy decisions or Standard Contractual Clauses (SCCs) with supplementary technical / organisational measures.
- Recipients in the United States: EU-US Data Privacy Framework where the recipient is DPF-certified, otherwise SCCs with additional safeguards.
Current provider-level mechanism details are available on request from web@tdmtr.com.
9. Security
- HTTPS / TLS encryption
- Bot protection on form submissions (Cloudflare Turnstile)
- Access control and least-privilege principle
- Regular security updates and backups
- Staff confidentiality undertakings
10. Your Rights
- Right of access, rectification, erasure, restriction of processing
- Right to data portability (GDPR Art. 20)
- Right to object to processing
- Right to withdraw consent at any time
- Right to lodge a complaint with the KVKK Authority or your local supervisory authority
To exercise these rights: web@tdmtr.com. We respond within 30 days.
11. Children
Our website does not target persons under 18. We do not knowingly collect personal data from minors.
12. Policy Changes
This Privacy Policy is an information document and may be updated over time. Material changes will be published with an updated date at the top. We recommend reviewing this page from time to time.
13. Contact
- Email: web@tdmtr.com
- Phone: +90 224 484 25 73
- Post: Hasanağa OSB Mah., 15. Cad., No: 11, Nilüfer / Bursa, Türkiye