KVKK Information Notice

This notice does not ask for your explicit consent

This notice only informs you. There are three places where explicit consent is required — attaching a file to a service request, non-essential cookies, and keeping a Human Resources application in the candidate pool once the assessment has ended — and explicit consent is asked at those points separately, each one on its own. Article 5/1-(f) of the Communiqué prohibits combining the information notice and explicit consent in the same box; on this site they are not combined.

The full list of cookies, their lifetimes and how to change your preference are set out in a separate document: the Privacy and Cookie Policy. The Human Resources application form is covered by a further separate document: the Candidate Information Notice. The three documents do not replace one another; they are read together. Decision No. 2022/1358 of the Personal Data Protection Board (Kurul) established that a single, complex privacy statement covering every subject does not satisfy the obligation to inform; that is why they have been kept apart.

Version: 2026-09-03

1. Identity of the data controller

Under Article 10 of the KVKK and Article 4/1-(a) of the Communiqué, the data controller is the following legal entity.

• Trade name: ÖZKOÇ HİDROLİK MAKİNA SAN. VE TİC. A.Ş.
• Address: Ömerli Mah. Hadımköy-İstanbul Cad. No:196, 34555 Arnavutköy / İstanbul
• Telephone: +90 212 550 48 06
• E-mail: ozkoc@ozkoc.com.tr — satis@ozkoc.com.tr — export@ozkoc.com.tr — ik@ozkoc.com.tr (Human Resources applications)
• Working hours: 07:00–17:00 (UTC+3)

2. The route your data takes

When you submit a form, the data follows this route: your browser sends the record to the server that hosts the site. The application on that server writes the record to a queue table in the same hosting account. Our in-house portal pulls this queue at set intervals, takes the record into its own database and sends a notification e-mail to the sales or service officer.

The queue is not an archive; the permanent home of the record is the in-house portal. The portal sits inside the company network and is closed to the internet. Moving data to the portal is NOT a transfer to a third party: it is movement between the systems of one and the same data controller.

Alongside the notification e-mail, a channel has been set up so that the same notification also arrives on ÖZKOÇ's own telephone as a WhatsApp message. The message goes to ÖZKOÇ's own number, not to you; no WhatsApp message is sent to a visitor. THIS CHANNEL IS CLOSED TODAY: not a single message is being sent. The channel will be opened when the company's WhatsApp Business Platform setup is complete and the condition for transfer abroad shown in Section 11 has been met; when it is opened, this notice will be updated and the version number will change.

When the channel is opened, the information the message carries has been kept to a minimum: the type of request (quotation, service or job application), the company name, the record number and, for service requests only, an indication of whether production has stopped. Full name, telephone number, e-mail address, address, fault description, quotation text and CV DO NOT GO INTO THE MESSAGE; these stay in the notification e-mail, in the in-house portal and in the Human Resources mailbox. In a Human Resources application a fixed dash (-) is written into the company field and no information about the candidate is carried.

There is no membership, account or password on the site. No payment is taken and no card details are requested. The Human Resources application form follows a different route from these two: the application is delivered to the corporate Human Resources mailbox at ik@ozkoc.com.tr, while the CV is not attached to the form but sent by e-mail to the same address; the details are in the Candidate Information Notice.

3. Telephone calls and AI-assisted call answering

All calls to ÖZKOÇ's published switchboard number are answered through Netgsm. At the start of the call, before any processing begins, you are told verbally that you are speaking to an AI-assisted system and that the call will be transcribed and summarised.

The audio of the call is processed only temporarily, while it is being transcribed; no permanent audio file is kept. The calling telephone number, the date and duration of the call, the identity and contact details you give during the call, the content of your request, the transcript, the automatic summary and the call identifier are processed.

This data is processed in order to understand your request correctly, to route it to the sales or service team, to get back to you, to monitor service quality and, where necessary, to examine disputes concerning the call. Operations directly related to the establishment or performance of the request rely on Article 5/2-c of the KVKK; quality monitoring, routing and the examination of disputes rely on the legitimate interest in Article 5/2-f, provided that no harm is caused to your fundamental rights and freedoms.

The transcript, the automatic summary and the call details are kept for 90 days at most; at the end of that period they are deleted, including from the provider's systems, the automation run history and e-mail copies. If a separate quotation or service record is opened as a result of the call, only the verified business information becomes subject to the retention period of that file; the raw transcript and the automatic summary do not exceed 90 days.

If you would rather not use the telephone channel, you can send your request through the web form or to ozkoc@ozkoc.com.tr. We kindly ask you not to share special categories of personal data such as health, religion or biometrics during a telephone call.

4. Personal data processed in the quotation form

When you fill in the quotation form, the following fields are processed. If you leave the non-mandatory fields blank, that data is never created.

• Company name and full name — to establish who we are dealing with
• E-mail address — to send you the quotation prepared and the technical reply
• Telephone number — to discuss the technical detail of the quotation
• Country — to determine the delivery, shipping and price terms
• Press type, tonnage and message text — to understand the request technically and to price it
• The language of the page on which the form was filled in — to reply to you in the same language
• Time of submission and record number (UUID) — to make the request unique and to measure the response time
• The images of the part that you attach to the form — to assess the request technically and to be able to recommend the right press; entirely optional, processed only WITH YOUR EXPLICIT CONSENT, and if you attach none your request is handled in exactly the same way
• Confirmation of the file attachment and the version of the information notice you have read — recorded only if you attach a file; to prove when and on the basis of which text the explicit consent was given

5. Personal data processed in the service request form

The service form is filled in so that a team can be sent to a machine in the field. It therefore contains more fields than the quotation form, and the telephone number is mandatory here.

• Type of request (fault, maintenance, spare part, overhaul, commissioning) — to route the request to the right team
• Company name and full name — to establish who we are dealing with
• Telephone number and e-mail address — to get back to you about the service plan
• Address — the facility where the machine is located; the place the service team will travel to
• Fault description — to understand the problem and to bring the necessary part with us
• Production stopped / still running — to determine the order of work
• Machine serial number, press type, commissioning date, error code — to identify the machine and to choose the right spare part; none of these is mandatory
• Confirmation of the file attachment and the version of the information notice you have read — recorded only if you attach a file; to prove when and on the basis of which text the explicit consent was given
• Country code, time of submission and record number (UUID)

6. The images you attach to the forms

You can attach images to both the quotation form and the service form: a photograph of the part to be worked on the quotation form, and of the fault on the service form. This is entirely optional; if you attach none, your request is handled in exactly the same way. If you do attach a file, your explicit consent is asked separately — because a photograph can also show the people and the facility that fall within its frame.

When taking the photograph we kindly ask you to make sure that no employee's face, vehicle number plate or identity document enters the frame.

Files are held temporarily on the hosting server, in a directory closed to the web; the portal downloads them and adds them to the request file concerned. The operations we carry out on the files are as follows:

• The EXIF and XMP metadata of JPEG, PNG and WebP files is DELETED on the server. GPS coordinates, device model and time of capture never reach us.
• ONLY IMAGES ARE ACCEPTED: JPEG, PNG and WebP. No other file type (PDF, Word, video) can be selected in the form or processed on the server.
• The type of a file is determined from the bytes of the file itself, not from its extension.
• The ORIGINAL NAME of the file you upload is not kept. A file name often carries a person's name and leaks into a directory listing, a log or an e-mail subject line. The storage key is built entirely from values we generate ourselves.
• If you withdraw your explicit consent, the attachment you uploaded is deleted; the rest of your request stays in process. The attachment is not kept permanently in any case: once the portal has downloaded the file and added it to the request file, the temporary copy on the server is deleted.

7. Cookies and site trackers

The site uses two kinds of cookie. There is a single strictly necessary cookie: the consent cookie that remembers your preference (ozkoc_riza); this one does not require explicit consent. All the others depend on your explicit consent.

On your first visit a banner with three buttons appears: Accept All, Strictly Necessary Only, Cookie Settings. All three sit on the same layer, carry the same visual weight and take effect with a single click. If you refuse, none of the scripts below is loaded into the page — their code is not embedded in the page, it is added only at the moment of explicit consent.

Trackers that depend on your explicit consent:

• Analytics — Google Analytics 4 (G-WEX6MQQLFD and G-12DMEMBZW8) and the Yandex Metrica click map (counter 90374848). Measures which pages are read and where the visit breaks off.
• Advertising — Meta Pixel (1275956870560725). Carries out advertising measurement and retargeting.
• Session recording — Microsoft Clarity (n9p9j5j4ma) and Yandex Metrica Session Replay (Webvisor). Records your mouse movements, your scrolling and your clicks as a session replay. This category is a separate explicit consent box; you can accept analytics and refuse session recording.
• Consent cookie — ozkoc_riza. Holds only which categories you have permitted, the moment of the choice and the version of the text you approved.
• Your explicit consent is valid for 12 months. When that period expires, or when the version of this notice changes, the banner asks again. You can change your choice at any moment through the Cookie Settings link at the foot of the page, or withdraw it altogether; when you withdraw it, the provider cookies are deleted from your browser as well.

8. Data we do not collect

The following is deliberately not collected or requested. We write it here because you may assume it is collected, as it is on most sites. Where an item says 'not requested', it means that we ask for that data in no field but accept that it may still reach us through free text or through a file you attach; in that case what is done with it is written in the item itself.

• THE VISITOR'S IP ADDRESS ITSELF IS NOT KEPT. The IP is used to apply the rate limit on form submissions; the only thing recorded is its one-way digest salted with a secret key (HMAC-SHA256). This digest is held only for the duration of the rate-limit window, is deleted when the window closes, and the IP address cannot be recovered from it. Our hosting provider, GNET İnternet Telekomünikasyon A.Ş. (Güzel Hosting), processes the IP address in its server access logs for its own periods; that is not data we record.
• The EXIF / GPS metadata of your image files is not kept; it is deleted at the moment of upload.
• The original names of the files you upload are not kept.
• THERE IS NO FIELD IN THE FORMS THAT ASKS FOR special categories of personal data such as health, religion, membership or biometrics, and such data is requested in no form; we kindly ask you not to put information of that kind into free-text fields, into the photograph you attach to a service request or into the CV you attach to a Human Resources application. If such data reaches us although we have not requested it — a CV in particular may, at the choice of the person who prepared it, carry health status, disability information, a criminal record, or association or trade union membership — that data is not deemed to have been requested by us, the fact that you sent it does not take the place of explicit consent, it is used in no assessment and in no decision, and it is not transferred to a separate record or list; the moment it is noticed, the part concerned is permanently redacted or the whole document is deleted. The details are in the Candidate Information Notice.
• Your personal data is not bought from third parties and is not gathered from social media profiles. The only exception is what you tell us yourself: the Human Resources application form has an optional profile link field; if you fill it in, only the address you write is recorded and no data is pulled automatically from your profile.

9. Data — purpose — legal basis — retention table

Article 5 of the Communiqué requires the legal basis to be written out clearly for each processing activity. In the table below, the legal basis and the retention period are stated one by one for each field.

Abbreviations: Art. 5/2-c = directly related to the establishment or performance of a contract (including the pre-contractual quotation stage), Art. 5/2-ç = compliance with a legal obligation of the data controller, Art. 5/2-f = the legitimate interest of the data controller, Art. 5/1 = explicit consent.

10. Method by which personal data is collected

Under Articles 4/1-(ç) and 5 of the Communiqué, your personal data is collected automatically by electronic means: through the quotation, service and Human Resources application forms on ozkoc.com.tr, the file upload area, cookies, and the transcription and summarisation by ElevenLabs of telephone calls arriving through Netgsm. The CV that accompanies a Human Resources application is not uploaded through the form; you send it by e-mail to ik@ozkoc.com.tr yourself.

You write all of the information in the forms yourself. There is no field that you do not write: the country your browser connects from, your device and your location are not recorded.

The information you give during a telephone call is turned into a transcript and a summary by the AI-assisted system. This output is not used on its own to take a decision about you; quotation and service requests are assessed by a human being. Neither on the site nor in the call system is an automated decision produced that has legal or similarly significant consequences to your detriment.

11. Parties to whom personal data is transferred and the purpose of transfer

Under Article 4/1-(c) of the Communiqué, the parties to whom transfers are made and the purpose of transfer for each of them are set out below. Moving data to the in-house portal is not on this list: because the portal is a system of the same data controller, it does not count in law as a transfer.

The personal data you send through the quotation and service forms passes only through our hosting provider's infrastructure in Türkiye. This data is not transferred to Google, Yandex or Microsoft; the only thing that goes to those providers is the visit data generated by the cookies you have given explicit consent to. Form data never goes to the Meta Pixel either; as far as Meta is concerned the only exception is the WhatsApp notification channel, shown as a separate row in the table below and closed today. A Human Resources application follows a different route from these two: the application notification and the CV you send by e-mail pass through the corporate e-mail provider that operates the ik@ozkoc.com.tr mailbox; the name and country of that provider and the basis of the transfer are shown in the table below, and the details are in the Candidate Information Notice. When a notification e-mail is sent, the record concerned also arrives in our corporate mailbox, and the Microsoft row below applies at that moment. Telephone call data passes through the Netgsm and ElevenLabs systems in order to carry the call and to transcribe it.

Separately from these, a WhatsApp channel has been set up to deliver the notification of quotation, service and Human Resources forms to ÖZKOÇ's own telephone. The recipient of the message is not the visitor but ÖZKOÇ's own number; in that respect it is an internal notification. However, because the message travels over the WhatsApp Business Platform, Meta is a new recipient and the transfer is made abroad — which is why it is shown as a separate row in the table below. THE CHANNEL IS CLOSED TODAY, and the message carries no full name, telephone, e-mail, address, fault description, quotation text or CV; all the fields it does carry are listed in Section 2.

12. What you should know about transfers abroad

Of the recipients above, Google, Meta, Yandex, Microsoft and ElevenLabs are abroad. Hosting of the site and holding of form records take place at a provider established in Türkiye; that transfer is domestic. Under Article 9 of the KVKK, a continuous transfer to countries for which the Personal Data Protection Board has issued no adequacy decision is made only once one of the appropriate safeguards set out in the Law has actually been put in place.

Explicit consent cannot be relied on for transfers of a continuous nature; transfer on the basis of explicit consent (Art. 9/6) is meant for incidental cases. For that reason a provider abroad is activated only after the transfer mechanism compliant with Article 9 of the KVKK has been completed. If a standard contract is used, it is notified to the Personal Data Protection Authority within five business days of the signatures being completed. Where this condition is not met, the form, tracker or call routing concerned stays closed.

The WhatsApp channel that carries form notifications to ÖZKOÇ's own telephone is also a transfer abroad and is subject to the same rule: the channel is not opened before the transfer mechanism compliant with Article 9 of the KVKK is completed. It is closed today; for as long as it is closed, this transfer does not arise at all.

Do not confuse these two things: your cookie consent is the legal basis for PLACING THE COOKIE; the standard contract is the legal basis for TRANSFERRING THE DATA ABROAD. They are two separate obligations and both are required. If you do not give explicit consent to a category, no data goes to that provider and no transfer arises at all.

13. Your rights under Article 11 of the KVKK

By applying to the data controller you can exercise all of the following rights.

• To learn whether your personal data is being processed (Art. 11/1-a)
• To request information about it if it has been processed (Art. 11/1-b)
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose (Art. 11/1-c)
• To know the third parties in Türkiye or abroad to whom your personal data has been transferred (Art. 11/1-ç)
• To request correction if your personal data has been processed incompletely or incorrectly (Art. 11/1-d)
• To request the erasure or destruction of your personal data within the conditions laid down in Article 7 of the KVKK (Art. 11/1-e)
• To request that correction, erasure or destruction operations be notified to the third parties to whom your personal data has been transferred (Art. 11/1-f)
• To object to a result arising to your detriment from the analysis of your processed data exclusively by automated systems (Art. 11/1-g)
• To claim compensation for the damage if you suffer damage because your personal data has been processed unlawfully (Art. 11/1-ğ)

14. How you exercise your rights

Under Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your application by one of the routes below. In your application you must state your name, your surname, your Turkish identity number (or, if you are a foreign national, your nationality and passport number), the address to be used for notification, and the subject of your request.

• In writing, by a wet-signed petition: in person or through a notary, to Ömerli Mah. Hadımköy-İstanbul Cad. No:196, 34555 Arnavutköy / İstanbul
• To our registered electronic mail (KEP) address using KEP — you can ask for our current KEP address through ozkoc@ozkoc.com.tr
• By an e-mail signed with a secure electronic signature or a mobile signature
• By writing to ozkoc@ozkoc.com.tr from the e-mail address you have previously notified to us and which is registered in our system
• You do not need to make an application in order to change your cookie preferences or to withdraw your explicit consent; the Cookie Settings link at the foot of the page is enough.
• Your application is concluded free of charge within THIRTY DAYS at the latest from the date it reaches us (Art. 13/2 of the KVKK). If the operation also entails a cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
• If your application is refused, if you find our reply insufficient or if no reply is given within thirty days, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the reply and in any event within sixty days of the date of the application (Art. 14 of the KVKK).

15. Entry into force and version

The version of this notice is 2026-09-03 and it entered into force on the date of publication. The current version is always published on this page.

When the notice is updated, the version number changes. Your cookie consent runs separately from this: your consent is treated as invalid when the cookie list or the cookie categories change, and the banner asks again. The version of the cookie schema in force is 2026-08-26. A spelling correction or the addition of a new section does not on its own reset your consent; the criterion for making sure that an arrangement of cookies you have not approved is not treated as approved is the list of cookies, not the text itself.

When you attach a file to a service request, or allow your Human Resources application to be kept in the candidate pool, the version number of the text in force at that moment is stored together with your consent record. In this way it stays clear afterwards which text your explicit consent was based on.