Privacy Policy

1. Data Controller

The data controller responsible for the personal data described in this Policy is Eksper Metal Limited Şirketi, located at Şerifali Mh. Kıble Sk. No:19/21, Loft Up 7.60, Floor 1, Apartment 4, Ümraniye, İstanbul, Türkiye. Contact details for all data-protection matters are listed in Section 16 (Contact) below.

2. Personal Data We Collect

We collect the following categories of personal data:

• Account information: full name, email address, password, phone number, and company name provided when a user registers for the Portal or completes an invited account.
• Invitation information: when Eksper Metal Limited Şirketi invites a prospective customer to the Portal, a sales representative may enter that person's name, email address, phone number, and company name before the invited person has interacted with the Portal themselves.
• Sign-in information: if a user chooses to sign in with Google, we receive the profile information Google shares under that sign-in (such as name and email address), as permitted by the user's Google account settings.
• Consent and preference records: whether a user has accepted the Terms of Use and whether they have opted in to marketing communications, together with the time these choices were made.
• Security and verification data: a Cloudflare Turnstile token and related interaction signals used to confirm that a form submission (login, registration, invitation acceptance, or password reset) comes from a human rather than an automated script.
• Session data: a strictly necessary authentication cookie that keeps a user signed in between page visits, described further in Section 8 (Cookies and Similar Technologies).

3. Chatbot Conversations (Planned Feature)

The Portal is designed to include an AI chat assistant that lets website visitors describe the products they are looking for. This feature has not yet been released, and no chatbot conversation data is collected today.

Once released, chat conversations will be processed to extract structured information such as product type, quantity, and destination port, using Anthropic's Claude AI models as the underlying processing engine, so that the conversation can be routed to the appropriate regional sales representative. This Policy will be updated with further detail before that feature becomes active.

4. How We Use Your Data

We use personal data for the following purposes:

• Creating and administering user accounts, including inviting prospective customers and completing invited accounts.
• Authenticating users and keeping the Portal secure, including distinguishing human users from automated bots.
• Operating quotation, order, and production-tracking functionality, and, once available, the AI chat assistant described in Section 3.
• Sending transactional emails, such as account confirmation, invitation, and password-reset messages.
• Sending product updates and marketing communications, but only to users who have opted in.
• Complying with applicable legal, tax, and regulatory obligations.

5. Legal Basis for Processing

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), we process personal data where it is necessary for the establishment or performance of a contract with the user (account creation, quotation, and order processing), where it is necessary for our legitimate interests (Portal security and bot prevention), where it is required to comply with a legal obligation, or based on the user's explicit consent (marketing communications).

For users to whom the EU General Data Protection Regulation (“GDPR”) applies, the equivalent legal bases under GDPR Article 6 are, respectively: performance of a contract, legitimate interests, legal obligation, and consent.

6. Marketing Consent

During registration or invitation acceptance, users may choose whether to receive product updates and offers. This choice is optional, separate from acceptance of the Terms of Use, and defaults to checked but can be unchecked before submitting the form.

A user may withdraw marketing consent at any time by contacting Eksper Metal Limited Şirketi through the channels listed in Section 16 (Contact). Withdrawing consent does not affect transactional emails necessary for operating the account, such as confirmation, invitation, or password-reset messages.

7. Who We Share Your Data With

We do not sell personal data. We share personal data only with service providers who process it on our behalf, to the extent necessary to operate the Portal:

• Supabase — hosts our database and authentication system, and therefore stores account and invitation data described in Section 2.
• Google — provides the optional “Continue with Google” sign-in, sharing the profile information the user's Google account permits.
• Cloudflare — provides Turnstile bot-detection on login, registration, invitation-acceptance, and password-reset forms, and hosts the Portal's infrastructure.
• Mailchimp Transactional (Mandrill) — delivers account confirmation, invitation, and password-reset emails on our behalf, through our authentication provider.
• Anthropic — once the AI chat assistant described in Section 3 is released, will process chat conversation content as the underlying AI engine. No conversation data is shared with Anthropic today.

We may also disclose personal data where required by law, court order, or a lawful request from a competent public authority.

8. Cookies and Similar Technologies

The Portal uses one strictly necessary session cookie to keep a signed-in user authenticated between page visits, and receives a Turnstile verification token when a user submits a login, registration, invitation-acceptance, or password-reset form. Both are required for the Portal to function and are not used for advertising or cross-site tracking.

The Portal does not currently use analytics, advertising, or other tracking cookies, so no cookie-consent banner is shown today. If that changes, this Policy and the Portal's cookie practices will be updated accordingly, and consent will be requested where required.

9. International Data Transfers

Eksper Metal Limited Şirketi is established in Türkiye, and some of the service providers listed in Section 7 operate infrastructure outside Türkiye, including in the European Union and the United States. Where personal data is transferred internationally, we rely on the safeguards available under applicable law — such as contractual undertakings with our service providers — to protect that data, consistent with KVKK Article 9 and, where applicable, Chapter V of the GDPR.

10. Data Retention

We retain personal data for as long as a user's account remains active, and for a reasonable period afterward where necessary for legitimate business purposes, such as resolving disputes, maintaining accounting or order records, or complying with legal obligations.

The Portal does not currently offer a self-service option to delete an account. To request deletion or review of personal data, contact Eksper Metal Limited Şirketi through the channels listed in Section 16 (Contact).

11. Your Rights

Under KVKK Article 11, a user may apply to Eksper Metal Limited Şirketi to: learn whether their personal data is being processed; request information about such processing; learn the purpose of processing and whether the data is used consistently with that purpose; know the third parties to whom data is transferred, both domestically and abroad; request correction of incomplete or inaccurate data; request deletion or destruction of data where the grounds for processing no longer apply; request that any correction, deletion, or destruction be notified to third parties the data was shared with; object to a result that arises solely from automated analysis of their data and is to their detriment; and request compensation for damage arising from unlawful processing.

For users to whom GDPR applies, these rights correspond to the rights of access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests can be submitted through the channels listed in Section 16 (Contact).

12. Data Security

We apply reasonable technical and organizational measures to protect personal data, including encrypted data transmission, access controls limiting who within Eksper Metal Limited Şirketi can view account and invitation data, and authentication safeguards on the Portal. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children's Privacy

The Portal is a business-to-business platform intended for use by adults acting on behalf of a company or organization. It is not directed at, and is not knowingly used by, individuals under the age of 18. If we become aware that we have collected personal data from a minor without appropriate authorization, we will take reasonable steps to delete it.

14. Changes to This Policy

Eksper Metal Limited Şirketi may update this Policy when necessary, including as new Portal features such as the AI chat assistant are released. The updated version becomes effective on the date it is published on the Portal, shown as the “Last Updated” date above.

15. Governing Law

This Policy is governed by the laws of the Republic of Türkiye, including KVKK. Where a user is located in the European Economic Area, this Policy is intended to be applied consistently with the GDPR in addition to Turkish law.

16. Contact

For questions about this Policy, to exercise the rights described in Section 11, or to request account or data deletion, please contact Eksper Metal Limited Şirketi through the following channels:

• Email: info@ekspermetal.com
• Telephone: +90 216 504 16 96
• Address: Şerifali Mh. Kıble Sk. No:19/21, Loft Up 7.60, Floor 1, Apartment 4, Ümraniye, İstanbul, Türkiye