Understand what information is processed, how this website works and how to exercise your personal data rights.
On 11 September 2026 the business identified its hosting and email provider, stated that these services are hosted in Türkiye and reported no subprovider for those services. Exact log and backup retention, operation of the request workflow and external-platform transfer arrangements still require confirmation. This draft is not a statement that past requests were processed or legal compliance was approved.
This notice is for website visitors and people contacting us about steel supply, stock, cutting to size or quotations. The controller for these activities is Erkal Haddecilik, identified below.
The framework is Türkiye’s Personal Data Protection Law No. 6698 (KVKK). This page does not replace any separate notices required for employment, job applications, CCTV or other activities. Reading this notice or using the website is not, by itself, explicit consent or a marketing permission.
Information is collected electronically through communications and website access, and through non-automated written requests forming part of a filing system. Each basis below applies only where necessary for the relevant activity.
| Activity / information | Purpose | Legal basis under KVKK |
|---|---|---|
| Quotations and contact Name, telephone, optional company name, material request; email address and message content in direct correspondence. | Understand the request, assess materials and cutting needs, prepare a quotation and respond. | Article 5(2)(c) for an individual party to a contract, limited to data necessary and directly related to its formation or performance. Article 5(2)(f) for communication with a corporate customer’s representative, subject to balancing fundamental rights and freedoms. |
| Technical access Access data such as IP address, request time, page URL and browser details; access/error logs to the extent recorded by the hosting configuration. | Deliver pages, investigate errors and abuse, and support secure operation. Log scope and duration depend on the hosting configuration. | Legitimate interests in secure service delivery under Article 5(2)(f), subject to necessity and proportionality. |
| Rights requests and disputes Identity and contact details, the request and necessary supporting evidence. | Verify identity and authority, respond to requests, and exercise or protect a right. | Legal obligations under Article 5(2)(ç); establishment, exercise or protection of a right under Article 5(2)(e). |
The quotation form does not request identity numbers, payment card details, health data or other special categories of data. Include only necessary business information, without unnecessary personal information about third parties. The company must verify necessity and balancing assessments for legitimate-interest activities before publication.
Legal bases: KVKK — official English translation of the law.
The four form fields prepare a message in your browser. There is no website submission endpoint storing these form entries.
When you use the button, your name, telephone, optional company and request text are included in a link and passed to WhatsApp. Opening this prefilled link already transfers information to that external service.
You complete sending to Erkal inside WhatsApp. The message then becomes part of the quotation and communication process. You may instead contact us by telephone or email.
If the message-preparation script does not load, the form fields remain disabled to prevent ordinary page submission putting their contents into the URL. Your browser’s own autofill and history features are separate from website storage.
Website and email provider: Yeşil Beyaz. According to information supplied by the business, website hosting, email and server logs are held with this provider in Türkiye, without a subprovider for these services. This statement covers only those hosting and email services; it does not cover a visitor's email provider or the infrastructure of WhatsApp, Google or Meta.
Communications or platform services using overseas infrastructure may involve processing outside Türkiye. Article 9 requires consideration of the relevant processing condition and adequacy, appropriate safeguards or, only where its conditions are met, an incidental-transfer exception. Website use or clicking a link alone neither establishes these conditions nor constitutes explicit consent.
Domestic hosting does not establish the transfer conditions for external platforms. Recipients, transfer mechanisms and applicable agreements for WhatsApp, and for Google Analytics if separately considered later, require assessment. Google Analytics, Google Ads and Meta Pixel are disabled in this release. Incidental-transfer exceptions must not be assumed to cover regular form transfers. This page does not claim that an unverified standard contract or Board approval exists.
Current framework: KVKK — international transfers (Turkish).
Cookies are small pieces of information stored in your browser. This release uses a necessary first-party cookie named erkal_consent to remember your selection. Optional analytics permission starts off; advertising and remarketing permission is not requested. Visiting, scrolling or closing the preference window does not grant permission. The website remains usable if you decline.
Current status: This release is prepared for non-advertising usage statistics only. Google Ads, Meta Pixel and remarketing are disabled. Google Analytics is not loaded until account connections, data sharing and transfer checks are completed; no analytics data is sent now. Activation requires a new choice; preview consent will not carry over.
Manage my cookie preferences →
| Tool / provider | Purpose and contents | Duration / status |
|---|---|---|
| erkal_consent Erkal Haddecilik / first party / necessary preference cookie | Analytics choice; always-disabled advertising fields, last choice time and notice/connection version. No name, phone, company, message or random visitor identifier. Created after your decision. | Up to 180 days from saving. Merely revisiting does not extend this period. Uses Secure on HTTPS, SameSite=Lax and Path=/. |
| Static application cache Browser / Service Worker; not a cookie | Delivers site logos, styles and scripts efficiently. No preference-history archive or advertising profile. | Old application caches are removed when the new version activates; also removable in browser settings. |
| Google Analytics Optional analytics / verification pending | Planned use: non-advertising analysis of visits and general usage events on eligible pages. Advertising personalisation is excluded. | Not loaded and creates no cookies in this release. Actual cookie names, providers and durations must be added before activation. |
| Google Ads and Meta Pixel Advertising tracking / disabled | Not used in this release; no advertising permission or remarketing audience is collected. | Not loaded and creates no advertising cookies. Analytics permission does not enable these services. |
The first-visit banner gives equal visibility to allowing analytics, rejecting optional cookies and managing preferences. The panel has only an analytics option; advertising services cannot be enabled. Use “Cookie preferences” in the footer to reopen it. Turn analytics off and save, or reject optional cookies, to withdraw permission.
The necessary preference cookie remembers the choice you request so the service can respect it. This limited processing is assessed for necessity, proportionality and balancing under KVKK Article 5(2)(f). Optional analytics, when activated, requires purpose-specific explicit consent under Article 5(1). Declining does not disable product information, calculators or contact options.
Withdrawal stops subsequent site tracking and removes accessible related first-party tracking cookies. If a provider is running, the page may reload to stop its runtime. It does not recall previously lawfully processed data. This website cannot directly delete cookies on Google’s or Meta’s own domains; use browser settings and the providers’ privacy controls.
If Analytics is activated, Google may process IP/device information, cookie identifiers and eligible page visits. Non-advertising measurement does not mean completely anonymous processing or storage solely in Türkiye. It does not automatically tell us a visitor’s name or company. A WhatsApp click is not a confirmed message or sale. Cookie choices do not authorise email, SMS or WhatsApp marketing messages.
Names, phones, companies, requests, calculation values and PDF contents are not added to analytics events. The prepared connection does not load on pages with input fields or forms, or addresses containing a query or fragment. Raw WhatsApp URLs and prefilled messages are not transmitted as tracking events. Additional destinations, advertising data sharing and automatic event collection in the account must be checked before activation.
The preference belongs to this browser and does not automatically follow you to another device. The cookie can accompany same-site requests to the server; this release does not maintain a separate server-side consent-history archive. Clearing cookies, reaching 180 days or changing the version causes a new prompt. If storage is blocked, optional tracking stays off and you may be asked again on the next page.
Logos, styles and scripts may be stored in browser or Service Worker caches. These are not advertising profiles or form-entry databases. Old application caches are cleared when a new Service Worker successfully activates; you can also clear site data in your browser. This is not a fixed personal-data retention period.
Weight and cutting calculations run in your browser. These tools do not send list or grade information to a server for storage. Downloaded PDFs and copied clipboard content may remain on your device; you control their retention.
Grade matching uses a local data set. A search from the home page places its query in the destination URL, which may appear in browser history and server access logs. Do not enter personal or confidential information in search fields.
Before Google Analytics is activated, verify provider agreements, the actual cookie inventory, recipients, retention periods, international-transfer conditions and the company’s consent-evidence procedure. A cookie choice does not by itself satisfy international-transfer requirements under Article 9.
Official guidance: KVKK cookie guide (Turkish). Planned analytics provider: Google privacy policy.
Personal data must be kept only for periods required by applicable law or the processing purpose. When the reason for processing ends and no legal retention requirement remains, deletion, destruction or anonymisation is required under Article 7.
| Record | Period or determining criterion | Scope of implementation |
|---|---|---|
| Cookie preference | Up to 180 days from saving; a return visit does not extend it. | Necessary browser preference cookie, changeable through website preferences or browser settings. |
| Quotation and email correspondence | Determined by the request purpose, contractual relationship and applicable legal retention need. No single statutory period is assumed for every message. | Business correspondence; email hosted by Yeşil Beyaz. The definitive retention inventory and operational confirmation are pending. |
| Access/error logs and backups | Must be confirmed against actual provider logging, rotation and backup settings; the period has not yet been verified. | Server logs are held by Yeşil Beyaz. This notice does not mean automatic server deletion has been configured. |
| Deletion, destruction and anonymisation operation records | Records created when an operation occurs must be retained for at least three years, without prejudice to other legal obligations. | This period applies to evidence of the operation, not an additional three years of keeping the underlying personal data that must be erased. |
| Calculation list, downloaded PDF and clipboard | Managed by the user on their device. | These tools do not upload calculation lists or PDFs for server storage. |
A deletion request does not require unconditional destruction of a record that must lawfully be retained. If retention remains necessary, the response should identify the relevant data, reason and scope. Deletion of every copy must not be claimed without separately assessing backups and recipients.
Retention source: KVKK — deletion, destruction and anonymisation regulation, Articles 7 and 12 (Turkish).
This release includes controls limiting unnecessary external resources, file-integrity checks and form processing limited to the selected communication flow. Internal access permissions, supplier contracts, backups and disposal procedures require separate assessment. No internet service can guarantee absolute security.
Scope of rights: KVKK — data subject rights (Turkish).
The workflow prepared for business management starts by recording the receipt date, request scope and response channel. The general quotation form is not a personal-data request portal or identity-document upload area.
Identity and any representative authority are verified proportionately. Relevant correspondence and records are identified; where needed, the scope of records and available operations at Yeşil Beyaz are checked.
The conditions for correction, deletion or another request are assessed. The scope of an accepted operation and any continuing retention reason should be communicated within the statutory response period below.
Recipient notifications and backup requirements are addressed separately. Only an operation actually completed is recorded as complete; automatic deletion or past request processing is not assumed.
You may deliver a signed written request to the company address above. For the email method, use an email address previously communicated to and recorded by the company to write to satis@erkalcelik.com.tr. Other methods are governed by the Communiqué on the Principles and Procedures for Requests to the Data Controller.
Open a request email →Opens your email application; nothing is sent automatically.
Proportionate additional information may be needed to verify identity. Avoid unrelated documents or special-category data; do not put these identity details in the general quotation form.
Requests are concluded as soon as their nature permits and within 30 days at the latest. Processing is normally free; where additional costs arise, the Board’s applicable tariff may apply. A refusal must include reasons.
If there is no response, a refusal or an inadequate response, a complaint may be made to the Board after first applying to the controller: within 30 days of learning the response and, in all cases, within 60 days of the original request.
Procedure: KVKK — requests and complaints (Turkish).
Updated on 12 September 2026. The notice should be revised when website data flows or relevant company processes change. This information notice does not replace an explicit-consent statement.
