This notice explains how Ay Kilit handles personal data when you visit this website or contact us. It is written to meet the EU and UK General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law No. 6698 (KVKK) and comparable laws in other countries where our customers are based.
Who is responsible
Ay Kilit İmalat Pazarlama San. ve Dış Tic. Ltd. Şti., Esenşehir Mah., Dudullu OSB, İMES Sanayi Sitesi A106 Sk. No:17, 34775 Ümraniye, Istanbul, Türkiye. Email: [email protected]. We are the data controller.
What we collect
- Quote and contact requests: your name, company, email address, phone number, country, the products you are interested in, your message and any files you send.
- Email, phone and WhatsApp: the details you give us when you contact us directly.
- Technical data: when you open the site, our hosting provider automatically processes your IP address, browser type, date and time, and the page requested, to deliver the site and protect it against attacks.
We do not use cookies for tracking, advertising or analytics, and we do not build profiles of visitors.
Why we use it and on what basis
- To answer your request and prepare a quote: steps before a contract and performing a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To run, secure and improve the website: our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- To keep business and tax records where the law requires it: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
We do not sell your data and do not use it for unsolicited marketing.
Who receives it
Only staff who need it to handle your request, and service providers working on our behalf: website hosting and security (Cloudflare), web fonts (Google Fonts, which receives your IP address when the page loads) and our email provider. If you message us on WhatsApp or follow our Instagram link, Meta processes that data under its own privacy terms. We share data with authorities only where the law requires it.
International transfers
Ay Kilit is based in Türkiye, so data you send us from abroad is processed in Türkiye. Our service providers may also process data in other countries, including the United States. Where the law requires it, these transfers are protected by standard contractual clauses or similar safeguards, or are necessary to answer the request you made (GDPR Art. 49(1)(b); KVKK Art. 9).
How long we keep it
Requests that do not lead to an order are deleted within 2 years of our last contact. Data connected to an order is kept for as long as commercial and tax law requires, typically up to 10 years. Server logs held by our hosting provider are kept for a short period only.
Your rights
You can ask us to tell you what data we hold about you, to correct or delete it, to restrict or object to its use, and to receive a copy in a portable format (GDPR Art. 15–21; KVKK Art. 11). Where we rely on your consent, you can withdraw it at any time. Write to [email protected]; we answer within 30 days. You may also complain to the data protection authority in your country or, in Türkiye, to the Personal Data Protection Authority (KVKK).
Security
The site is served only over encrypted HTTPS connections, and access to your data is limited to the people who need it.
Changes
We may update this notice when our services or the law change. The current version is always on this page.
Last updated: October 2026
