Last updated: November 2026

This notice has been prepared by Altınboğa Makina San. ve Tic. A.Ş. ("Altınboğa") in its capacity as data controller, pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "PDPL", known in Türkiye as "KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data Controller

Altınboğa Makina San. ve Tic. A.Ş.
Maltepe Mah. Hastane Yolu Sok. 1. Baltaş San. Sit. No:10/37 34010 Zeytinburnu / Istanbul, Türkiye
Phone: +90 212 612 25 00
E-mail: [email protected]

2. Personal Data Processed

• Identity data: first name, last name.
• Contact data: e-mail address, phone number, country, city, company name.
• Customer transaction data: the product or service you request, the content of your message, request history.
• Transaction security data: IP address, browser and device information, visit logs, cookie data.
• Marketing data: your newsletter subscription and communication preferences.

3. Method of Collection

Your personal data is collected by automated and non-automated means through the request, contact and newsletter forms on www.altinboga.com, through e-mail, telephone and WhatsApp communication channels, and through cookies and server logs.

4. Purposes of Processing

• Receiving, evaluating and responding to your requests and questions regarding Kubota industrial engines, spare parts, Albo Marine products and service,
• Carrying out quotation, sales, delivery, service and after-sales support processes,
• Managing customer relations and conducting satisfaction activities,
• Sending newsletters, campaign and information messages, where you have given explicit consent,
• Carrying out information security processes and ensuring the security and operation of the website,
• Conducting activities in compliance with legislation and providing information to authorised institutions,
• Following up legal processes and using data as evidence in potential disputes.

5. Legal Bases

Your personal data is processed on the following legal bases set out in Article 5 of the PDPL:

• Processing is necessary for the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract (request, quotation and sales processes),
• Processing is mandatory for the data controller to fulfil its legal obligations (commercial book-keeping and record obligations, requests from competent authorities),
• Processing is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject (site security, improvement of service quality),
• Processing is mandatory for the establishment, exercise or protection of a right,
• Your explicit consent (newsletters and non-essential cookies).

6. Transfer of Personal Data

Limited to the purposes listed above and subject to the conditions in Articles 8 and 9 of the PDPL, your personal data may be transferred to:

• Our domestic and foreign suppliers from which we receive hosting, e-mail infrastructure, security verification and analytics services,
• Our authorised service points and business partners where this is necessary to fulfil your request,
• Public institutions, authorities and judicial bodies within the scope of our legal obligations.

Transfers abroad are carried out under Article 9 of the PDPL only where adequate protection exists, a standard contract has been signed, or your explicit consent has been obtained.

7. Retention and Destruction

Your personal data is retained for as long as required by the purpose of processing, taking into account the retention and limitation periods prescribed by applicable legislation. When the period expires or the purpose of processing ceases to exist, your data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8. Your Rights as a Data Subject

Under Article 11 of the PDPL, you have the right to apply to the data controller to:

• Learn whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in line with that purpose,
• Know the third parties to whom your personal data is transferred, in Türkiye or abroad,
• Request correction of your personal data if it is incomplete or inaccurate,
• Request erasure or destruction of your personal data under the conditions set out in Article 7 of the PDPL,
• Request that corrections, erasure and destruction be notified to the third parties to whom your personal data has been transferred,
• Object to a result that is to your detriment arising from analysis of your data exclusively by automated systems,
• Claim compensation for damage suffered due to unlawful processing of your personal data.

9. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:

• In writing, together with documents verifying your identity, to Maltepe Mah. Hastane Yolu Sok. 1. Baltaş San. Sit. No:10/37 34010 Zeytinburnu / Istanbul, Türkiye,
• By e-mail to [email protected] from the e-mail address registered in our systems.

Your application will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be applied.