Skip to Content
KVKK · Privacy Policy

Personal Data Protection and Privacy Policy

Explains how personal data is processed and protected across the NOX Professional website, customer, quotation and digital contact processes, and sets out your rights.

Effective / Updated: 2 October 2026 Data Controller: NOX Endüstriyel Mutfak
Contents
Important note: This Policy sets out the general framework for the protection of personal data. The duty to inform under Article 10 of Law No. 6698 is fulfilled separately through privacy notices specific to the channel through which the personal data is collected and to the relevant processing activity. This Policy does not by itself replace a transaction- or channel-specific privacy notice. For the website forms, please see the Privacy Notice.

1Purpose and Scope

This Personal Data Protection and Privacy Policy (the “Policy”) sets out the core principles and practices applied to the personal data processing activities carried out by NOX ENDÜSTRİYEL MUTFAK PROJE ÜRETİM VE PAZARLAMA LTD. ŞTİ. (“NOX” or the “Company”) through the website www.noxprofessional.com and the Company’s digital contact channels.

The Policy applies to website visitors, persons submitting quotation or information requests, representatives and employees of customers and prospective customers, representatives of suppliers and business partners, persons contacted in the course of order, delivery and service processes, and other relevant natural persons.

2Data Controller and Contact Details

Data Controller
NOX ENDÜSTRİYEL MUTFAK PROJE ÜRETİM VE PAZARLAMA LTD. ŞTİ.
Address
İOSB, Giyim Sanatkarları Sosyal Tesis Sk. No: 1/1, İç Kapı No: B002, Başakşehir / İstanbul, Türkiye
Email
info@noxprofessional.com
Telephone
+90 541 181 35 35
Website
www.noxprofessional.com

3Core Principles

NOX processes personal data in accordance with the Personal Data Protection Law No. 6698 (“KVKK”) and the related legislation, and in line with the following principles:

Lawfulness and fairnessData is processed in accordance with the applicable legislation and the principles of good faith.
Accuracy and, where necessary, currencyRecords are kept accurate and updated where necessary.
Specific, explicit and legitimate purposesEvery processing activity is based on a legitimate purpose determined in advance.
Relevance, limitation and proportionality to the purposeNo more data is processed than is necessary for the purpose.
Retention for no longer than necessaryData is retained for the period required by the legislation or necessary for the purpose.

4Categories of Personal Data That May Be Processed

Category
Examples
Identity
Examples
Name, surname and any other identity details shared by the individual.
Contact
Examples
Email address, telephone number, delivery/invoice address (where required for the relevant process).
Customer / transaction
Examples
Company/organisation details, subject of the request, and information relating to quotation, project, order, delivery, service and after-sales processes.
Finance
Examples
Payment/invoice-related information; where a payment service is used, transaction status and accounting records. Full card data, where not stored directly by the Company, is processed within the payment institution’s own systems.
Marketing / preferences
Examples
Commercial electronic message preferences, campaign source and marketing consent records; only where the applicable legal conditions are met.
Transaction security / technical
Examples
IP address, date and time records, browser/device information, error and security logs, session and cookie data.
Legal proceedings
Examples
Records required for disputes, requests/complaints, correspondence with official authorities and the establishment/exercise of legal rights.
You are advised not to enter special categories of personal data (such as health, biometric or criminal conviction data) that are not necessary for the purpose of processing into the free-text fields on the website. Should such data be submitted to the Company, its processing will be assessed separately in accordance with Article 6 of the KVKK and the conditions set out in the related legislation.

5Methods of Collecting Personal Data

Personal data may be obtained through website forms, email, telephone, online order/quotation flows, cookies and similar technologies, customer/supplier communications and the data subject’s own direct statements, by fully or partly automated means, or by non-automated means provided that the data forms part of a data filing system.

6Processing Purposes and Legal Bases

Processing purpose
Principal legal basis (KVKK)
Receiving and responding to information, contact and quotation requests
Principal legal basis (KVKK)
Art. 5/2(c) necessity for the conclusion/performance of a contract; depending on the circumstances, Art. 5/2(f) legitimate interest.
Carrying out project, order, sales, delivery, installation, service and after-sales processes
Principal legal basis (KVKK)
Art. 5/2(c) conclusion/performance of a contract; Art. 5/2(ç) legal obligation; Art. 5/2(f) legitimate interest.
Invoicing, accounting, finance and statutory record-keeping processes
Principal legal basis (KVKK)
Art. 5/2(a) express provision in the laws and/or Art. 5/2(ç) legal obligation.
Information security, system security, error analysis and the prevention of misuse
Principal legal basis (KVKK)
Art. 5/2(f) legitimate interest of the data controller; where required, Art. 5/2(ç) legal obligation.
Managing disputes and establishing, exercising or protecting legal rights
Principal legal basis (KVKK)
Art. 5/2(e) necessity for the establishment, exercise or protection of a right.
Non-essential analytics, personalisation or advertising/remarketing activities
Principal legal basis (KVKK)
Art. 5/1 explicit consent, to the extent required; cookie preferences are managed separately.
Sending commercial electronic messages
Principal legal basis (KVKK)
The consent/exemption conditions required under Law No. 6563 and the related regulations; in terms of personal data processing, the applicable processing condition under the KVKK.

7Transfer of Personal Data

Provided that the transfer is limited and proportionate to the relevant processing purpose, and where permitted or required by the legislation, personal data may be transferred to the following categories of recipients:

  • Competent public institutions and bodies, and judicial/administrative authorities.
  • Accounting, financial advisory, legal, audit and similar professional service providers.
  • Hosting, software, information technology, email, cyber security, backup and technical support providers.
  • Suppliers, manufacturers, logistics/courier, installation and service partners, to the extent necessary for the performance of an order/project.
  • The relevant banks/payment service providers, where a payment infrastructure is used.
  • Analytics/advertising technology providers, where explicit consent or another appropriate legal basis exists.

Where personal data is transferred abroad, the applicable condition among an adequacy decision, appropriate safeguards (for example, the standard contracts published by the Board) or the incidental circumstances set out in the law is relied upon, within the framework of the current version of Article 9 of the KVKK, which entered into force on 1 June 2024. The scope of any transfer abroad is assessed separately according to the configuration of the service provider used.

8Retention and Disposal

Data / process
Retention approach
Contact and quotation requests
Retention approach
For the reasonable period necessary to conclude the request and to address any potential dispute or business development need; thereafter deletion, destruction or anonymisation.
Contracts, orders, invoices and commercial records
Retention approach
Taking into account the retention periods and limitation periods laid down in the Turkish Commercial Code, tax legislation and other applicable legislation.
Marketing consent/opt-out records
Retention approach
For as long as the consent remains in force and for the period required by the legislation to evidence the consent/opt-out status.
Technical logs and security records
Retention approach
For the period necessary and proportionate for information security and system operation.
Cookies
Retention approach
For the periods specified in the relevant Cookie Policy and the Cookie Preference Centre, according to the type of cookie.

9Data Security

NOX implements the technical and organisational measures appropriate to the nature of its business in order to prevent the unlawful processing of and access to personal data and to ensure its safekeeping. These measures may include restricting access rights, authorisation, record/log management, secure communications, backups, updates and service provider controls. In the event of a personal data breach, the notification and response procedures laid down in the legislation are followed.

10Rights of the Data Subject and Applications

Under Article 11 of the KVKK, data subjects have the following rights:

1To learn whether your personal data is being processed.
2If it has been processed, to request information in that regard.
3To learn the purpose of the processing and whether the data is being used in accordance with that purpose.
4To know the third parties to whom the data has been transferred, within Türkiye or abroad.
5To request the rectification of incomplete or inaccurately processed data.
6To request the deletion or destruction of the data where the relevant conditions are met.
7To request that rectification, deletion and destruction operations be notified to the third parties to whom the data has been transferred.
8To object to any outcome to your detriment arising from analysis carried out exclusively by automated systems.
9To claim compensation for damage suffered as a result of unlawful processing.

Applications

Applications may be submitted through the channels below, including the identity and request details required under the Communiqué on the Procedures and Principles for Applications to the Data Controller. Additional identity verification information may be requested depending on the application channel. Applications are concluded within the period and in the manner prescribed by the legislation.

Email
info@noxprofessional.com
Postal address
İOSB, Giyim Sanatkarları Sosyal Tesis Sk. No: 1/1, İç Kapı No: B002, Başakşehir / İstanbul, Türkiye

11Children’s Data

The website and NOX’s services are primarily directed at commercial/professional customers, and no personal data is knowingly collected from children. Should it become apparent that a child’s personal data has been submitted without authorisation, the data in question will be deleted or its processing restricted as appropriate, without prejudice to any legal obligations.

12Cookies and Similar Technologies

The website may use strictly necessary cookies and, only where the required legal conditions are met, analytics, functional or marketing cookies. For non-essential cookies, explicit consent based on an active user action is obtained to the extent required. Further details are set out in the Cookie Policy and the Cookie Preference Centre.

13Commercial Electronic Messages

With regard to marketing emails, SMS or similar commercial electronic messages, the Law No. 6563 on the Regulation of Electronic Commerce, the related Regulation and the Message Management System (İYS) procedures are taken into account. Data subjects may change their messaging preferences or exercise their right to opt out to the extent permitted by the legislation.

14Third-Party Links

The website may contain links to third-party websites or platforms. The personal data processing activities of these third parties are subject to their own privacy notices. NOX is not responsible for the data processing practices of third parties outside its control.

15Changes to this Policy

This Policy may be updated in line with changes in the legislation, decisions of the Board, the technologies used or business processes. The current version applies from the date on which it is published on the website. In the case of material changes, additional information or renewed consent procedures are carried out to the extent required.

16Legal Basis and References

  • Personal Data Protection Law No. 6698.
  • Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Duty to Inform.
  • Communiqué on the Procedures and Principles for Applications to the Data Controller.
  • Personal Data Protection Authority – Guidelines on Cookie Practices (July 2025).
  • The amendments to Article 9 of the KVKK on transfers abroad made by Law No. 7499, which entered into force on 1 June 2024.
  • Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communications and Commercial Electronic Messages.
NOX ENDÜSTRİYEL MUTFAK PROJE ÜRETİM VE PAZARLAMA LTD. ŞTİ.www.noxprofessional.cominfo@noxprofessional.comEffective: 2 October 2026