Skip to Content
B2B registration →
English (US)

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

Last updated: 27 September 2026

This Privacy Notice has been prepared by MABAYCO Endüstriyel Ürünler Limited Şirketi (the "Company"), as data controller, pursuant to Article 10 of Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, regarding the processing of personal data of our customers, prospective customers and website visitors.

Data controller

MABAYCO Endüstriyel Ürünler Ltd. Şti. · 19 Mayıs Mah. Yamaç Sk. Vera Plaza No:3 Kat:2 İç Kapı No:3, 34736 Kadıköy/Istanbul, Türkiye · hello@mabayco.com · +90 216 599 05 19 · Registered e-mail (KEP): mabayco@hs01.kep.tr

MERSIS No: 0478053740300001 · Trade Registry No: 864066

a) Categories of personal data processed

  • Identity data (name, title)
  • Contact data (email, phone, address, company name)
  • Customer transaction data (quotation, order, invoice and delivery records)
  • Financial data (invoicing and payment information)
  • Transaction security data (IP address, session and cookie records)

b) Method of collection and legal grounds

Your personal data is collected electronically or physically, by automated or non-automated means, through channels such as our website, email, telephone, quotation and order forms, contracts, trade fairs and business meetings. It is processed on the legal grounds set out in Article 5(2) of the Law, namely (c) conclusion or performance of a contract, (ç) compliance with a legal obligation, (e) establishment, exercise or protection of a right and (f) legitimate interest, and, for non-essential cookies, on the basis of your explicit consent.

c) Purposes of processing

  • Managing quotation, order and contract processes
  • Delivering products, invoicing and collecting payments
  • Managing customer relations and requests
  • Complying with legal obligations and responding to requests from competent authorities
  • Ensuring information security and operating and improving the website

d) Recipients and purposes of transfer

Limited to the purposes above and in accordance with Articles 8 and 9 of the Law, your personal data may be transferred to our business partners and suppliers, shipping and logistics companies, payment institutions and banks, IT and hosting service providers, our accountants and legal advisers, and legally authorised public authorities and private-law entities.

e) Your rights under Article 11 of the Law

As a data subject, you have the right:

  • to learn whether your personal data is processed;
  • to request information if your personal data has been processed;
  • to learn the purpose of processing and whether the data is used in line with that purpose;
  • to know the third parties in Türkiye or abroad to whom your personal data is transferred;
  • to request rectification of incomplete or inaccurate data and notification of the rectification to third parties to whom the data has been transferred;
  • to request erasure or destruction of your personal data where the reasons for processing no longer exist, although processed lawfully, and notification of this to third parties to whom the data has been transferred;
  • to object to a result against you arising from analysis of your data exclusively through automated systems;
  • to claim compensation for damage suffered due to unlawful processing of your personal data.

Under Article 28(2) of the Law, the rights above, except the right to claim compensation, cannot be exercised where:

  • processing is necessary for the prevention of crime or for a criminal investigation;
  • the personal data has been made public by the data subject;
  • processing is necessary for the performance of supervisory or regulatory duties or for disciplinary investigations or prosecutions by public authorities and professional organisations with public-institution status authorised by law;
  • processing is necessary to protect the economic and financial interests of the State with regard to budgetary, tax and financial matters.

Under Article 28(1) of the Law, the following fall outside the scope of the Law, and requests concerning such data will not be processed:

  • processing by natural persons solely within the scope of activities relating to themselves or family members living in the same household, provided the data is not disclosed to third parties and data security obligations are complied with;
  • processing for official statistics or, after anonymisation, for purposes such as research, planning and statistics;
  • processing for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, privacy or personal rights, or constitute a crime;
  • processing within the scope of preventive, protective and intelligence activities carried out by public authorities authorised by law to ensure national defence, national security, public security, public order or economic security;
  • processing by judicial or enforcement authorities in connection with investigations, prosecutions, trials or enforcement proceedings.

f) How to apply

You may submit requests concerning your rights, together with information and documents identifying you, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller, by one of the following methods:

  • In writing with a wet signature, by hand, through a notary or by registered mail with return receipt to: 19 Mayıs Mah. Yamaç Sk. Vera Plaza No:3 Kat:2 İç Kapı No:3, 34736 Kadıköy/Istanbul, Türkiye
  • Signed with a secure electronic signature or mobile signature and sent by registered e-mail (KEP) to: mabayco@hs01.kep.tr
  • From an email address previously registered in our Company's systems to: hello@mabayco.com

Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreign nationals, nationality and passport or ID number), your residential or business address for notifications, your email address, telephone and fax number if any, and the subject of your request.

Requests are concluded free of charge as soon as possible and within 30 (thirty) days at the latest; however, if the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged. Applications on behalf of another person require a notarised special power of attorney. The Company may request additional information to verify that the application belongs to the data subject and to clarify the request.

If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law.

​