At [Company name] (the "Company") we consider the privacy and security of the personal data of our customers, business partners and website visitors a core responsibility. This policy sets out the principles we follow and the safeguards we apply. Details of which data we process and why are given in our Privacy Notice. In case of any discrepancy, the Turkish version prevails.

1. Scope

This policy applies to all personal data processed through https://www.tandempnomatik.com, the hose configurator, quotation and order processes and related e-mail and phone communication, under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation.

2. Our principles

• Lawfulness and fairness: we process data only on legal grounds set out in the law, transparently.
• Accuracy: we promptly handle your rectification requests.
• Specific, explicit and legitimate purposes: data is processed only for the purposes stated in our privacy notice.
• Data minimisation: our forms require only what is needed. Hose tracking pages and QR labels show no personal data, only an unguessable tracking key.
• Storage limitation: form submissions are automatically deleted after 730 days; other data is kept only for the periods in our retention policy.

3. Security measures

3.1 Technical measures

• Encrypted connections (HTTPS/TLS) between your browser and the website,
• Role-based access to the admin panel, strong password hashing (Argon2), optional two-factor authentication and IP allowlisting,
• Audit logs of admin panel actions,
• Rate limiting, bot protection, honeypot fields and CSRF protection on forms,
• Restrictions on uploaded file types and sizes; sanitisation of image files,
• Regular backups with restricted access; automatic deletion of expired form submissions,
• Up-to-date software, security patches and malware protection.

3.2 Organisational measures

• Need-to-know access to personal data,
• Data protection and information security training and confidentiality undertakings for employees,
• Data security clauses in contracts with service providers,
• Regular review of our data inventory and policies.

4. Data breaches

If we detect that personal data has been obtained by others unlawfully, we notify the Personal Data Protection Board without delay and within 72 hours at the latest, in line with Board Decision No. 2019/10, and the affected persons as soon as reasonably possible.

5. Automated decisions and children

We do not take decisions producing legal effects solely by automated means. The product selector and product assistant are rule-based and do not ask for personal data. Our website and products are intended for industrial users and not for persons under 18.

6. Contact

For questions about this policy, write to info@tandempnomatik.com or call +90 212 000 00 00. The current version and its date are always published on this page.