Privacy Policy and KVKK Information Notice

This notice explains how personal data is processed when you visit www.istanbulafrica.com, contact us, or use the Turkey-Africa trade advisory services offered under the Istanbul Africa name. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform, and, for visitors in the European Economic Area, our notice under Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").

1. Data controller

Burak Ünal, who provides Turkey-Africa trade advisory services under the name Istanbul Africa (www.istanbulafrica.com) as a sole proprietorship. Correspondence address: Merkez Mahallesi Hasat Sokak No:12A, 34384 Şişli, İstanbul, Türkiye. Email: info@istanbulafrica.com. Telephone: +90 532 669 30 50.

Istanbul Africa is an advisory practice. We help businesses buy from Turkey and sell into Africa by researching markets, identifying and checking counterparties and structuring trade. We are not a freight forwarder, customs broker, bank or government body.

2. Personal data we process

• Identity: name and surname, job title, the company you represent.
• Contact: email address, telephone and WhatsApp number, country and city, business address.
• Enquiry and client transaction data: the products you want to buy or sell, quantities, target markets, your messages, proposals, contracts, invoices and payment records.
• Business information: documents about your company and trade references you share with us, and information about suppliers or buyers relevant to your project (which can include the names and contact details of their staff).
• Candidate data: your CV, education and references if you apply for our international trade internship.
• Transaction security and technical data: IP address, browser and device information, request logs, and, only with your consent, analytics cookie data (see the Cookie Policy).
• Records of your choices: the date, time and version of the notice you acknowledged on our contact form, and your cookie choice.

We do not ask for special categories of personal data (such as health or religious information). Please do not send them to us.

3. How we collect it

Partly by automated means (the website contact form, cookies and server logs) and partly by non-automated means: email, telephone, WhatsApp, video calls, meetings, trade fairs and business events, business cards and LinkedIn messages. When we check a potential supplier or buyer for your project, we also use public sources such as company websites, trade registers and published directories.

4. Purposes and legal bases

• Answering your enquiry and preparing a proposal: necessary to take steps before a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
• Providing our services (market and sector research, identifying and checking suppliers or buyers, sourcing support, contract manufacturing coordination, trade strategy): performance of a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
• Checking counterparties on your behalf using public sources: data made public by the person concerned (KVKK Art. 5/2(d)) and our legitimate interest in protecting our clients from fraud (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
• Legal obligations such as tax, accounting and commercial record keeping and requests from authorities (KVKK Art. 5/2(ç); GDPR Art. 6(1)(c)).
• Establishing, exercising or defending legal claims (KVKK Art. 5/2(e); GDPR Art. 6(1)(f)).
• Website security, keeping records of notices and choices, and improving our services: our legitimate interests, which do not override your rights (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
• Assessing internship applications: steps before a contract and our legitimate interest (KVKK Art. 5/2(c) and (f)).
• Analytics cookies and commercial electronic messages (newsletters, offers): only with your explicit consent, which you can withdraw at any time without affecting earlier processing (KVKK Art. 5/1; Law No. 6563; GDPR Art. 6(1)(a)).

We do not make decisions about you by automated means that produce legal effects, and we do not sell personal data.

5. Recipients

Only the data each recipient needs, for the purposes above:

• Counterparties for your project, at your request: Turkish manufacturers and suppliers, or African buyers and distributors, so that an introduction, quotation or negotiation can take place;
• Service providers your project requires, at your request: inspection companies, freight forwarders and logistics firms, customs brokers, translators and banks;
• Our IT providers: website hosting and delivery of contact-form emails (Amazon Web Services, servers in Frankfurt, Germany), our email provider and, only with your consent, Google (Google Analytics and Google Tag Manager);
• Google, only if you choose to load an embedded map or video, and Meta (WhatsApp), if you choose to contact us on WhatsApp;
• our accountant and legal advisers, and courts or authorities where the law requires.

6. Transfers abroad

Our work is international by nature: your counterparties may be in Türkiye or in an African country, our hosting provider is in Germany, and Google and Meta are in the United States. Personal data is transferred abroad only in line with KVKK Article 9 (as amended by Law No. 7499): on the basis of an adequacy decision, appropriate safeguards such as the Board's standard contracts (notified to the Personal Data Protection Authority within five business days of signature), or, for incidental transfers, one of the exceptions in Article 9/6, in particular where the transfer is necessary to perform a contract with you or a contract concluded in your interest (for example sending your enquiry to a supplier you asked us to approach), or with your explicit consent. Transfers out of the EEA follow Chapter V of the GDPR.

7. Retention

• Enquiries that do not lead to an engagement: 2 years after our last contact.
• Client files, contracts and project correspondence: the duration of the engagement and then the statutory limitation and record-keeping periods (generally 10 years under the Turkish Commercial Code and the Turkish Code of Obligations).
• Accounting and tax records: the periods set by commercial and tax law.
• Internship applications: 1 year after the application.
• Website server logs: 14 days, unless needed to investigate a security incident.
• Records of notices acknowledged and consents given: as long as the related processing continues, then for the limitation period.
• Your cookie choice: stored in your own browser until you clear it.

When a period ends, or the reason for processing no longer exists, we delete, destroy or anonymise the data under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, at the latest in the next periodic destruction cycle.

8. Security

Encrypted connections (HTTPS with HSTS), access limited to the people who need it and who are bound by confidentiality, reputable providers bound by data protection terms, and secure storage. If personal data is obtained by others unlawfully, we notify the Personal Data Protection Board within 72 hours and the persons concerned as soon as possible.

9. Your rights

Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that third parties to whom data was transferred are notified of a correction or deletion; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your supervisory authority.

10. How to apply

Use our data subject application form and send it in writing to the address in section 1, or by email to info@istanbulafrica.com from the email address registered with us, or with a secure electronic or mobile signature, or by registered electronic mail (KEP). We reply free of charge within 30 days at the latest (a fee under the Board's tariff may apply only if the reply involves an extra cost). If you are not satisfied with the reply, or receive none in time, you may complain to the Personal Data Protection Board (www.kvkk.gov.tr) within the periods in KVKK Article 14.

11. Children

Our services are for businesses and professionals. We do not knowingly collect personal data from anyone under 18 through this website.

12. Versions and changes

We may update this notice; the date of the current version is shown at the top. Translations are provided for convenience; if they differ, the Turkish version prevails: KVKK Aydınlatma Metni.