PRIVACY POLICY — BESTEK MAKINA
Last Updated: February 25, 2026
1. Who We Are (Data Controller)
Bestek Makina (“we”, “us”, “our”) is the data controller responsible for your personal data. We are a manufacturing and engineering company registered in Turkey, operating the website www.bestekmakina.com and conducting business globally, including sales and technical consultations with customers in Europe and the EU.
Legal Address:
Orta Mah. İshakpaşa Cad. B Blok Dış K: 3 Dükkan 21-22
Modsan San.Sit. Tuzla, İstanbul, Türkiye
For privacy-related enquiries, please contact us at:
📧 info@bestekmakina.com
📞 +90 542 895 35 75
💬 Telegram / WhatsApp: Available upon request
2. Legal Basis for Processing Personal Data
We process your personal data based on the following lawful bases under GDPR and UK GDPR:
⦁ Consent – You have given clear consent for a specific purpose (e.g., marketing communications, newsletter subscriptions).
⦁ Contractual Necessity – Processing is necessary to perform a contract with you (e.g., responding to inquiries, fulfilling orders, providing technical consultations).
⦁ Legal Obligation – Processing is necessary for compliance with legal obligations (e.g., tax reporting, invoice storage, payment records).
⦁ Legitimate Interests – Processing is necessary for our legitimate interests (e.g., fraud prevention, security monitoring, service improvement, website optimization), provided your rights do not override those interests.
3. What Personal Data We Collect
We collect specific categories of personal data depending on your interaction with us:
Via Contact Forms & Inquiries:
⦁ Name, email address, phone number, company name, job title
⦁ Message content and technical requirements
⦁ IP address and device information
Via Email Communications:
⦁ Email address and contact history
⦁ Communication preferences and replies
⦁ Subscription status to newsletters or product updates
Via Website Analytics & Tracking:
⦁ Technical data: IP address, browser type, device type, operating system
⦁ Usage data: pages visited, time spent on site, referring URLs
⦁ Cookie identifiers and tracking pixels
Via Payment & Order Processing:
⦁ Name, billing address, payment method details
⦁ Invoice and transaction records
⦁ Delivery address (if applicable)
Via Live Chat & Support:
⦁ Name, email, chat messages and support tickets
⦁ Technical issues described and solutions provided
4. How We Use Your Personal Data
We use the personal data we collect for the following specific purposes:
Purpose Data Category Lawful Basis
Respond to inquiries and provide technical consultations Contact details, inquiry content Contract / Legitimate Interests
Process orders and deliver services Name, address, payment info Contract
Send order confirmations and updates Email, order details Contract
Send marketing emails and newsletters (if opted in) Email address Consent
Improve website functionality and user experience Technical data, usage data Legitimate Interests
Prevent fraud and ensure security All personal data Legitimate Interests
Comply with tax and legal obligations Transaction data, contact info Legal Obligation
Generate analytics reports (anonymized) Technical data, usage patterns Legitimate Interests
Send product updates and special offers (if opted in) Email address Consent
5. Who We Share Your Personal Data With
We do not sell your personal data. However, we may share it with the following categories of third parties:
Service Providers & Data Processors:
⦁ Hosting & Infrastructure: Hosting providers (server location may be in EU or internationally)
⦁ Email & Communications: Email service providers (e.g., Gmail, Mailchimp alternatives)
⦁ Payment Processing: Payment gateways and processors (Stripe, PayPal, bank partners)
⦁ Analytics: Google Analytics, Hotjar, or similar web analytics tools
⦁ Live Chat & Support: Support ticket platforms or chatbot services
⦁ CRM Tools: Customer relationship management platforms for managing inquiries
Legal & Professional Advisors:
⦁ Accountants and tax authorities (for legal compliance)
⦁ Legal counsel (if required for dispute resolution)
Government & Regulatory Authorities:
⦁ Competent authorities if required by law or court order
All third parties are bound by confidentiality agreements and Data Processing Agreements (DPAs) where required by GDPR.
6. International Data Transfers
Some of our service providers are based outside the UK and EU/EEA, including the United States. Where we transfer personal data internationally, we ensure appropriate safeguards are in place:
⦁ Standard Contractual Clauses (SCCs) – Approved by the European Commission for EU to non-EU transfers
⦁ UK International Data Transfer Agreement (IDTA) – Approved by the ICO for UK to non-UK transfers
⦁ Adequacy Decisions – Where countries have EU or UK adequacy status
Transfers to the United States (e.g., via Google Analytics, Mailchimp, AWS) are safeguarded by Standard Contractual Clauses or Binding Corporate Rules.
A copy of the relevant safeguard documentation is available on request by contacting info@bestekmakina.com.
7. Data Retention Periods
We retain personal data only for as long as necessary for its stated purpose. Specific retention periods are outlined below:
Data Category Retention Period Reason for Retention
Account / Contact Data Until account deletion + 30 days Service delivery and record-keeping
Transaction & Payment Records 7 years Tax and legal compliance (invoice retention)
Marketing Opt-ins / Newsletter Subscriptions Until consent withdrawn Consent-based communication
Support Tickets & Correspondence 3 years Service improvement and dispute resolution
Server Logs & IP Data 90 days Security monitoring and fraud prevention
Website Analytics Data 26 months (Google Analytics default) Website performance analysis
Cookie Data Varies by cookie type (see Cookie Policy) Functionality, analytics, marketing
Inquiry Forms & Quotation Requests 2 years Business record and follow-up
After the retention period expires, data is securely deleted or anonymized. You may request early deletion by contacting us at info@bestekmakina.com.
8. Your Rights Under GDPR & UK GDPR
Under the General Data Protection Regulation (GDPR) and UK GDPR, you have the following rights:
8.1 Right of Access (Subject Access Request)
You have the right to request a copy of all personal data we hold about you. We will provide this in a clear, structured format within 30 days of your request.
8.2 Right to Rectification
You have the right to request correction of inaccurate, incomplete, or out-of-date personal data.
8.3 Right to Erasure (“Right to Be Forgotten”)
You have the right to request deletion of your personal data, subject to legal or contractual grounds for retention. For example, we may need to retain transaction data for tax purposes.
8.4 Right to Restrict Processing
You have the right to request that we limit how we use your personal data in certain circumstances (e.g., while you contest its accuracy).
8.5 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV) and have it transferred to another data controller.
8.6 Right to Object
You have the right to object to processing of your personal data based on:
⦁ Legitimate interests (we must then justify continued processing)
⦁ Direct marketing (including profiling for marketing purposes)
⦁ Processing for statistical or research purposes
8.7 Rights Related to Automated Decision-Making & Profiling
You have the right not to be subject to a decision based solely on automated processing that produces significant effects on you. We do not currently use fully automated decision-making for marketing or service decisions.
8.8 Right to Withdraw Consent
Where we rely on consent as the lawful basis, you have the right to withdraw that consent at any time. Withdrawal does not affect the legality of processing before withdrawal.
How to Exercise Your Rights
To exercise any of the above rights, please contact us at:
📧 info@bestekmakina.com
📞 +90 542 895 35 75
💬 WhatsApp / Telegram available upon request
Response Timeframe: We will respond to your request within 30 days. In complex cases, we may extend this by a further 60 days, and we will inform you of any extension.
No Charge: Requests are free of charge, unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee.
9. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to enhance your experience and gather usage information. Cookies are small files stored on your device that identify you and your preferences.
Cookie Categories:
Essential Cookies – Required for core website functionality (login, form submission, security). These are used without consent.
Functional Cookies – Remember your preferences (language, display settings) to improve usability.
Analytics Cookies – Track how visitors use the site (pages visited, time spent). We use Google Analytics for this purpose. These require your consent.
Marketing / Advertising Cookies – Used to display targeted ads or measure ad performance. These require explicit opt-in consent.
Consent & Opt-Out:
Your browser will display a cookie consent banner on first visit. You can:
⦁ Accept all cookies – Grant consent to all cookie categories
⦁ Customize – Choose which cookie types to accept
⦁ Reject – Decline non-essential cookies
You can also control or delete cookies through your browser settings. Learn more: aboutcookies.org
For a detailed breakdown of cookies used, please see our Cookie Policy (available on request).
10. Data Security Measures
We are committed to protecting your personal data through appropriate technical and organizational security measures:
⦁ Encryption: Data in transit is protected using SSL/TLS encryption (HTTPS protocol). Sensitive data at rest is encrypted.
⦁ Access Controls: Personal data is accessible only to authorized staff on a need-to-know basis.
⦁ Secure Infrastructure: Hosting and servers are maintained by reputable providers with security certifications.
⦁ Regular Assessments: We conduct periodic security reviews and updates to address emerging threats.
⦁ Staff Training: Our team receives regular data protection and security awareness training.
⦁ Incident Response: We have procedures in place to detect, investigate, and respond to security incidents.
No system is 100% secure. We cannot guarantee absolute security, but we maintain industry-standard protections proportionate to the sensitivity of the data we hold.
11. Data Breach Notification
In the event of a personal data breach, we have procedures in place to:
1. Detect & Investigate – Identify and assess the scope and impact of the breach within 72 hours of becoming aware.
2. Notify Authorities – Report the breach to the relevant supervisory authority (ICO in the UK; national DPA in the EU) if there is a risk to your rights and freedoms.
3. Notify You – Inform you directly without undue delay if the breach poses a high risk to your rights and freedoms (e.g., risk of fraud, identity theft).
Your Supervisory Authorities:
⦁ UK: Information Commissioner’s Office (ICO) — ⦁ ico.org.uk
⦁ Poland: President of the Office for Personal Data Protection (PUODO) — ⦁ uodo.gov.pl
⦁ Other EU Countries: Your national data protection authority
You will receive breach notification in plain language with information about the likely consequences and measures we are taking to mitigate harm.
12. Your Right to Lodge a Complaint
If you believe we have violated your rights under GDPR or UK GDPR, you have the right to lodge a complaint with the supervisory authority in your country:
United Kingdom:
Information Commissioner’s Office (ICO)
📧 casework@ico.org.uk
🌐 ico.org.uk
Poland:
President of the Office for Personal Data Protection (PUODO)
📧 kancelaria@uodo.gov.pl
🌐 uodo.gov.pl
European Union (other countries):
Contact your national data protection authority through edpb.europa.eu
You may lodge a complaint at any time. You do not need to contact us first, but we welcome the opportunity to resolve any concerns before formal escalation.
13. Third-Party Links & External Websites
Our website may contain links to external websites operated by third parties. This Privacy Policy applies only to www.bestekmakina.com. We are not responsible for the privacy practices of external websites. Please review the privacy policies of any third-party sites before providing your personal data.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, new technologies, or legal requirements. We will:
⦁ Post the updated policy on this page with a new “Last Updated” date
⦁ Notify you of material changes via email (if you have provided your email address)
⦁ Request your consent for material changes where required by law
Your continued use of our website following publication of updates constitutes your acceptance of the revised Privacy Policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
Bestek Makina
📧 info@bestekmakina.com
📞 +90 542 895 35 75
💬 WhatsApp / Telegram (available upon request)
🌐 www.bestekmakina.com
Mailing Address:
Orta Mah. İshakpaşa Cad. B Blok Dış K: 3 Dükkan 21-22
Modsan San.Sit. Tuzla, İstanbul, Türkiye
We aim to resolve any concerns within 7 business days. If you are not satisfied with our response, you have the right to lodge a complaint with your supervisory authority (see Section 12 above).
16. Legal Compliance & Governing Law
This Privacy Policy is governed by:
⦁ General Data Protection Regulation (GDPR) – EU Regulation 2016/679
⦁ UK GDPR – Data Protection Act 2018 (for UK users)
⦁ Turkish Data Protection Law – Law No. 6698 (for our business operations in Turkey)
Where there is any conflict between these frameworks, the more protective standard applies to you.
Last Updated: February 25, 2026
This Privacy Policy is not legal advice. For specific legal concerns or complex data processing scenarios, we recommend consulting with a data protection professional or lawyer.
