1. Data controller
BIOTAMA Global is the data controller under Turkish Personal Data Protection Law No. 6698. This notice explains processing through the website, membership, contact and quotation workflows.
2. Categories of data
We may process identity and contact data; account data such as username and password hash; company, tax, billing and delivery information; product and project requirements; uploaded quote documents; request history; session, timestamp and security records; language preference and quote-cart data. Do not submit sensitive personal data.
3. Purposes
Data is processed to create and secure accounts, communicate, evaluate quotation and private-label projects, manage customer records, plan manufacturing and export processes, complete requests, maintain information security, comply with legal duties and protect legal rights.
4. Method and legal grounds
Data is collected through electronic forms, membership actions, email, telephone/WhatsApp contact, uploaded files and server security records. Grounds include contract formation or performance, legal obligation, establishment or protection of rights and legitimate interests that do not override fundamental rights. Any activity requiring consent will use a separate optional consent.
5. Transfers and recipients
Data may be shared, only as necessary, with authorised staff; hosting, software, email and security providers; manufacturing, packaging, logistics, accounting or legal partners required for a project; and competent authorities. Clicking WhatsApp opens a third-party service. If an international transfer is required, safeguards under Article 9 will be used.
6. Retention and security
Personal data is retained only for the purpose and applicable statutory limitation periods, then deleted, destroyed or anonymised. Account data may remain while membership is active; quote and commercial records may remain for relevant legal periods. Controls include password hashing, secure sessions, access controls, upload validation and protected storage.
7. Your rights
Under Article 11 you may ask whether data is processed, request information, learn purposes and recipients, seek correction or deletion, request notification to recipients, object to solely automated results and claim compensation for unlawful processing. Use the Data Subject Application page; requests are generally answered within 30 days.