Privacy Policy
Last updated: July 27, 2026 — Teknodem
This Privacy Policy explains how Teknodem İç ve Dış Ticaret Limited Şirketi collects, uses, shares and protects personal data when you visit or purchase from www.powertimeepoxy.com. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and is written in clear, plain language as required by Article 12(1).
1. Who We Are (Data Controller)
Teknodem İç ve Dış Ticaret Limited Şirketi is the controller of the personal data described in this policy within the meaning of Article 4(7) GDPR.
Privacy contact: [email protected]. Where a Data Protection Officer has been appointed under Article 37 GDPR, this is also the DPO’s contact address.
Where we are not established in the European Union but offer goods to data subjects in the Union, we designate a representative in the Union in accordance with Article 27 GDPR. The representative’s details are published here once designated and may be contacted on all issues relating to processing.
2. Our Principles
We process personal data in accordance with the principles in Article 5 GDPR:
- Lawfulness, fairness and transparency — we process data only where a valid legal basis applies, and we tell you what we do.
- Purpose limitation — data is collected for specified, explicit and legitimate purposes only.
- Data minimisation — we collect only what is adequate, relevant and necessary.
- Accuracy — we keep data up to date and correct inaccuracies without delay.
- Storage limitation — data is kept no longer than necessary for the purposes concerned.
- Integrity and confidentiality — appropriate technical and organisational security measures are applied.
- Accountability — we maintain records of processing activities under Article 30 GDPR and can demonstrate compliance.
3. Personal Data We Process
- Identity data — first and last name; where legally required for invoicing, a tax or national identification number.
- Contact data — email address, telephone number, billing and delivery addresses.
- Order data — purchase history, basket contents, returns and cancellations, support tickets and correspondence.
- Payment data — invoice details, amount, payment method and, for refunds, bank account details. We never receive or store full card numbers, CVV codes or expiry dates; these are handled directly by our PCI-DSS compliant payment provider.
- Technical data — IP address, device identifiers, browser type and version, operating system, time zone, access logs.
- Usage and marketing data — pages viewed, search terms, click behaviour, campaign interactions, communication preferences.
- Account data — username, hashed password, saved addresses and wish lists.
Special categories (Art. 9 GDPR): we do not seek to collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Please do not send us such data unless we specifically ask for it.
Children: our store is not directed at children. We do not knowingly process the personal data of children below the age at which information society services may be offered on the basis of the child’s own consent under Article 8 GDPR (16 years, or a lower age between 13 and 16 set by the relevant Member State). If we learn that we hold such data without the required authorisation, we delete it promptly.
4. Purposes, Legal Bases and Retention
Legitimate interests balancing: where we rely on Article 6(1)(f) we have carried out a balancing test weighing our interests against your rights and freedoms. You may request a summary of that assessment at any time, and you have an unconditional right to object to processing for direct marketing under Article 21(2) GDPR.
5. Who We Share Data With
We disclose personal data only where necessary, and only to the following categories of recipient. Every processor acts under a written data processing agreement meeting the requirements of Article 28 GDPR.
- Carriers and logistics providers — to deliver your order and process returns.
- Payment service providers and banks — to take payment, prevent fraud and process refunds.
- E-commerce platform, hosting and cloud providers — to operate and host the store.
- Email, CRM and customer support tools — to communicate with you.
- Analytics and advertising providers — only where you have given consent.
- Accountants, auditors and legal advisers — to meet legal obligations and to defend claims.
- Public authorities and courts — where required by law, or to establish, exercise or defend legal claims.
We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.
6. International Transfers
Where personal data is transferred outside the European Economic Area, we ensure an appropriate level of protection under Chapter V GDPR (Articles 44–49) by relying on one of the following:
- an adequacy decision of the European Commission under Article 45 GDPR;
- Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 under Article 46(2)(c), supplemented where necessary by a transfer impact assessment and additional technical measures such as encryption and pseudonymisation;
- binding corporate rules approved under Article 47 GDPR; or
- one of the specific derogations in Article 49 GDPR, for example where the transfer is necessary for the performance of a contract concluded in your interest.
You may request a copy of the safeguards we rely on for a given transfer by writing to our privacy contact. Copies are provided in accordance with Article 46(1) GDPR, redacted only as necessary to protect commercial confidentiality.
7. How Long We Keep Data
- Personal data is retained only for as long as necessary for the purposes for which it was collected. Our general retention period is 36 months unless a longer period is required by law.
- Invoices, accounting records and commercial correspondence are retained for the periods prescribed by applicable tax and commercial legislation.
- Data needed to establish, exercise or defend legal claims is retained until the relevant limitation period expires.
- Consent-based data (marketing, non-essential cookies) is deleted or anonymised as soon as consent is withdrawn.
- At the end of the retention period, data is securely deleted or irreversibly anonymised.
8. Security of Processing (Art. 32 GDPR)
- Encryption of data in transit (TLS 1.2+) and, where appropriate, at rest.
- Pseudonymisation and access control on a strict need-to-know basis with role-based permissions.
- Firewalls, intrusion detection, regular vulnerability scanning and penetration testing.
- Regular backups and documented restoration procedures ensuring availability and resilience.
- Staff confidentiality undertakings and periodic data protection training.
- Vendor due diligence and Article 28 processing agreements with every processor.
Personal data breaches: we notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach (Art. 33 GDPR). Where a breach is likely to result in a high risk to your rights and freedoms, we also inform you directly without undue delay (Art. 34 GDPR).
9. Your Rights
Under Chapter III GDPR you have the following rights:
- Access (Art. 15) — obtain confirmation of whether we process your data and receive a copy of it, together with the information listed in Article 15(1).
- Rectification (Art. 16) — have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17) — have your data deleted where one of the grounds in Article 17(1) applies (“right to be forgotten”).
- Restriction (Art. 18) — require us to restrict processing in the circumstances listed in Article 18(1).
- Data portability (Art. 20) — receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
- Object (Art. 21) — object at any time to processing based on legitimate interests; objection to direct marketing is absolute and we will stop immediately.
- Automated decisions (Art. 22) — not be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you. We do not carry out such decision-making.
- Withdraw consent (Art. 7(3)) — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Notification (Art. 19) — have rectification, erasure or restriction communicated to each recipient of your data.
How to exercise your rights: write to [email protected]. We respond without undue delay and in any event within one month of receipt (Art. 12(3) GDPR); our internal target is 30 days. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we inform you within one month of the reasons. Requests are handled free of charge unless manifestly unfounded or excessive (Art. 12(5) GDPR).
10. Right to Lodge a Complaint
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, place of work, or of the alleged infringement (Article 77 GDPR). You also have the right to an effective judicial remedy against a controller or processor (Article 79 GDPR) and to compensation for material or non-material damage (Article 82 GDPR).
Competent authority for this store: Turkish Personal Data Protection Authority (KVKK).
We would be grateful for the opportunity to address your concerns before you approach a supervisory authority, so please do contact us first.
11. Cookies and Similar Technologies
Cookies and similar technologies are used in accordance with Article 5(3) of Directive 2002/58/EC (ePrivacy) as amended by Directive 2009/136/EC, and with the GDPR consent standard. Non-essential cookies are set only after you give consent. Full details — categories, purposes, providers and lifetimes — are in our separate Cookie Policy.
12. Epoxy & Resin Products — Sector-Specific Notes
- Chemical products such as epoxy resin, hardeners, and pigments must be in their unopened packaging with seals intact; returns of opened chemical products are not accepted.
- Once resin and hardener have been mixed, the product is irreversible by its nature; the right of withdrawal cannot be exercised for mixed or used products.
- Powder and liquid pigments cannot be returned if the packaging has been opened or the product has been mixed with other substances.
- Compliance with the safety warnings and usage instructions on the product label (ventilation, gloves, mask) is the consumer's responsibility.
- For chemical products with a limited shelf life, the return period may be shortened for products approaching their expiration date.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our processing activities or in applicable law. The current version is always published at www.powertimeepoxy.com with the date of the last update shown at the top. Where changes are material, we notify you directly and, where the change requires it, obtain fresh consent.
Legal Framework
- Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
- Directive 2002/58/EC (ePrivacy) as amended by Directive 2009/136/EC
- Commission Implementing Decision (EU) 2021/914 — Standard Contractual Clauses
- European Data Protection Board guidelines on transparency, consent and data subject rights
- Regulation (EU) 2022/2065 — Digital Services Act (where applicable)
Contact Details
This policy was issued on July 27, 2026. Teknodem İç ve Dış Ticaret Limited Şirketi reserves the right to update it in line with changes in applicable law.
Generated with SözleşmeGO, built by Alis Dijital.