Privacy notice

Kim Üretir (kimuretir.com) is the data controller for the personal data processed on this website under the Turkish Personal Data Protection Law No. 6698 (KVKK). Where the EU General Data Protection Regulation (GDPR) applies, it is observed as well.

Account data: your name, e-mail address, preferred language and role, and a one-way (scrypt) hash of your password — never the password itself.

Security data: sign-in records with IP address and browser information, kept in our audit trail to protect accounts.

Content you submit: company applications and profiles, requests for quotation (RFQs), replies, saved searches and uploaded files (logos, photos, certificates, drawings).

We only use technical cookies: ku_session (keeps you signed in, 30 days), ku_upload (links drawings uploaded before sending an RFQ to your browser, 24 hours) and sp_locale (your language). No advertising, tracking or analytics cookies are used.

Form drafts, the shortlist and comparison lists are kept only in your own browser (local storage) and never contain passwords.

To create and secure your account, publish company profiles, route RFQs to the manufacturers you choose and deliver their answers, send service e-mails (welcome, password reset, notifications about your applications and requests) and detect and prevent abuse.

Establishing and performing the contract you enter into by creating an account or sending a request (KVKK Art. 5(2)(c)), our legitimate interest in running a secure service (Art. 5(2)(f)) and legal obligations (Art. 5(2)(ç)). Where the law requires it, we ask for your explicit consent.

An RFQ, including the contact details you enter, is shared with the manufacturers you selected or that our team routed it to. Company profiles you publish are public. Our hosting and e-mail providers process data on our behalf as data processors. We do not sell personal data.

Account data is kept while your account exists. Sessions expire after 30 days without use, password reset links after 1 hour, uploads that were never sent after 24 hours, and database backups after 14 days.

Connections are encrypted (HTTPS). Passwords are stored only as scrypt hashes; session and reset tokens only as SHA-256 hashes. Files are checked by their content and served only to people entitled to see them. Access to the back office is limited to authorised staff and every change is logged.

Under KVKK Article 11 (and GDPR Articles 15–22 where they apply) you can learn whether your data is processed, request information about it, have it corrected, deleted or anonymised, learn who it was shared with, object to a result based solely on automated processing and claim compensation for unlawful processing. We answer requests within 30 days.

Signed-in users can delete their account at any time on the account page (Delete account). The account, its sessions, saved searches and pending reset links are erased, and your name, e-mail address and IP address are removed from our audit and e-mail logs. RFQs you sent stay with their recipients as business correspondence, without a link to your account.