1. Data Controller

This Privacy Policy and Website Privacy Notice has been prepared by:

Boom Makina Ticaret ve Sanayi Anonim Şirketi, acting as the data controller and hereinafter referred to as “Boom Makina”, the “Company”, “we”, “us” or “our”.

Address: Ömerli Mahallesi, Uran Caddesi, No: 30/A, 34794 Çekmeköy, Istanbul, Türkiye
Telephone: +90 216 420 16 44
Email: info@boom.com.tr
Website: www.boom.com.tr

This Notice applies to www.boom.com.tr, its language versions and related subdomains, as well as contact, quotation, service, spare parts, career and similar services provided through the website.

2. Purpose and Scope

Boom Makina respects the privacy of website visitors, customers, prospective customers, suppliers, distributors, service partners, job applicants and other individuals whose personal data may be processed through the website.

We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698, commonly referred to as the “KVKK”, and other applicable data protection legislation.

Where our processing activities fall within their territorial scope, we also take into account the EU General Data Protection Regulation, the UK GDPR and other applicable data protection laws.

3. Personal Data We Process

Depending on how you use the website and communicate with us, we may process the following categories of personal data.

3.1. Identity and contact information

Name, surname, company name, job title, country, city, telephone number, email address and preferred language.

3.2. Enquiry and customer transaction information

Products or services of interest, quotation requests, project and construction-site information, product models, spare-part and service requests, messages, complaints, suggestions and pre-sales or after-sales correspondence.

3.3. Technical and security information

IP address, browser type, device and operating-system information, session information, date and time of access, pages viewed, referring website, error logs, server logs and security records.

3.4. Cookie and online usage information

Cookie identifiers, user preferences, language selection, visited pages, clicks, browsing activity, advertising interactions, approximate location, traffic source and website analytics.

3.5. Marketing and communication preferences

Electronic marketing permissions, cookie preferences, newsletter subscriptions, preferences relating to products, campaigns and announcements, and records of withdrawal.

3.6. Job application information

Where a career or recruitment function is offered, we may process CVs, education and employment history, contact information, language skills, references and other information supplied by an applicant.

Applicants should not provide sensitive or special-category personal data that is not relevant to their application.

3.7. Legal and compliance information

Records relating to legal requests, disputes, official correspondence, notices, permissions, consent records and information retained for compliance purposes.

4. How We Collect Personal Data

Personal data may be collected electronically through:

• Contact, quotation, service, spare-parts, complaint and career forms;
• Email, telephone, WhatsApp and other communication channels;
• Cookies, pixels, tags and similar technologies;
• Server and security logs;
• Google Maps, YouTube, Google Analytics, Google reCAPTCHA, Meta, LinkedIn and similar third-party tools;
• Requests forwarded by distributors, authorised service providers and business partners;
• Activities performed by users on the website.

5. Purposes of Processing

We may process personal data to:

• Operate and secure the website;
• Respond to contact, information, catalogue, quotation and product requests;
• Recommend appropriate products or technical solutions;
• Manage sales, contracts, deliveries, service and spare-parts processes;
• Manage customer relationships and after-sales support;
• Evaluate complaints, suggestions and feedback;
• Refer an enquiry to an appropriate distributor, dealer or service partner;
• Measure and improve website performance;
• Analyse visitor behaviour;
• Remember language and display preferences;
• Provide map, video, direct communication and social-media functions;
• Conduct interest-based advertising, remarketing and conversion measurement where consent has been provided;
• Send product, event, exhibition, campaign and company news where electronic marketing consent has been provided;
• Evaluate job applications and conduct recruitment processes;
• Protect information security and prevent misuse or unauthorised access;
• Comply with legal obligations;
• Establish, exercise or defend legal claims;
• Perform audits, reporting and corporate compliance activities.

6. Legal Bases

Depending on the nature of the processing, personal data may be processed on one or more of the following legal bases:

• Processing is expressly required or permitted by law;
• Processing is necessary to comply with a legal obligation;
• Processing is directly related to the establishment or performance of a contract;
• Processing is necessary for the establishment, exercise or protection of a legal right;
• Processing is necessary for Boom Makina’s legitimate interests, provided that such interests do not prejudice your fundamental rights and freedoms;
• The information has been made public by the individual;
• You have provided consent.

Non-essential analytics, personalisation and advertising or marketing cookies will generally be activated on the basis of your consent.

Privacy information and consent requests are provided separately. Refusing non-essential cookies or withdrawing consent will not prevent access to the essential functions of the website.

Where the GDPR applies, processing will be based on an appropriate legal basis, such as contractual necessity, compliance with a legal obligation, legitimate interests or consent.

7. Disclosure of Personal Data

Where necessary and permitted by law, personal data may be disclosed to:

• Hosting, software, cloud, cybersecurity, maintenance and technical-support providers;
• Analytics, advertising, social-media and communication service providers;
• Distributors, dealers, authorised services and after-sales partners;
• Logistics, transportation or project partners where required to fulfil an enquiry;
• Accountants, auditors, lawyers and other professional advisers;
• Banks and financial institutions;
• Competent public authorities, courts and regulatory bodies;
• Other business partners where consent or another lawful basis applies.

Where your enquiry concerns products, sales or service in a particular country or region, your contact information and enquiry details may be forwarded to the relevant distributor or authorised service partner.

8. International Transfers

The use of international service providers such as Google, YouTube, Google Maps, Google Analytics, Google reCAPTCHA, Meta, WhatsApp and LinkedIn may involve the transfer of personal data to servers or recipients outside Türkiye.

International transfers will be conducted in accordance with Article 9 of the KVKK and the applicable secondary legislation, using appropriate mechanisms such as:

• An adequacy decision;
• Standard contracts;
• Binding corporate rules;
• Authorisation from the competent authority;
• Statutory exceptions for occasional transfers;
• Other legally recognised safeguards.

Where consent is relied upon, appropriate information will be provided regarding the nature of the transfer and the potential risks.

Where the GDPR applies, international transfers may be based on adequacy decisions, European Commission Standard Contractual Clauses or another recognised transfer mechanism.

9. Third-Party Services

The website may use the following third-party tools:

• Google Analytics: Website traffic and usage analysis;
• Google Maps: Displaying factory, office or service locations;
• YouTube: Displaying product, application and corporate videos;
• Google reCAPTCHA: Protecting forms against automated submissions and misuse;
• Google Ads: Conversion measurement and remarketing;
• Meta Pixel: Measuring and personalising advertising on Meta platforms;
• LinkedIn Insight Tag: Measuring LinkedIn campaigns and creating audiences;
• WhatsApp: Allowing users to communicate directly with Boom Makina.

Non-essential third-party content and tracking tools will generally be loaded according to the user’s cookie preferences. Embedded videos and maps may be placed behind a preview or “load content” function until the relevant preference has been given.

When you click a WhatsApp link or use an embedded WhatsApp tool, the separate privacy terms of WhatsApp or Meta may apply.

Where a third-party provider processes personal data for its own independent purposes, that provider may act as a separate data controller.

10. Retention

We retain personal data only for as long as necessary for the relevant processing purpose and applicable legal, limitation and evidential periods.

In general:

• Enquiry and quotation records may be retained until the enquiry has been completed and for a reasonable follow-up period;
• Customer and contract records may be retained for the duration of the contractual relationship and applicable legal retention periods;
• Technical and security records may be retained for the period required for information-security and incident-investigation purposes;
• Marketing data may be retained until consent is withdrawn or the relevant purpose ends;
• Cookie preference records may be retained as required to manage and demonstrate user preferences;
• Recruitment data may be retained for the recruitment process and any applicable retention period;
• Legal-dispute records may be retained until the relevant dispute and limitation periods have expired.

When the applicable retention period expires, personal data will be erased, destroyed or anonymised in accordance with applicable law.

11. Information Security

Boom Makina implements appropriate technical and organisational measures intended to protect personal data against unlawful processing, unauthorised access, loss, alteration or destruction.

Such measures may include access controls, password policies, firewalls, malware protection, logging and monitoring systems, secure connections, backups, employee awareness and service-provider controls.

No data transmission over the internet can be guaranteed to be entirely risk-free. Any identified personal-data security incident will be assessed and, where required, notified in accordance with applicable law.

12. Your Rights

Under Article 11 of the KVKK, you may apply to Boom Makina to:

• Learn whether your personal data is being processed;
• Request information about the processing;
• Learn the purpose of processing and whether the data is used for that purpose;
• Learn the third parties to whom the data has been transferred in Türkiye or abroad;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction where the applicable conditions are met;
• Request notification of correction, deletion or destruction to recipients;
• Object to a result arising against you through processing exclusively by automated systems;
• Request compensation where you suffer damage due to unlawful processing.

Where the GDPR applies, you may also have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

13. Exercising Your Rights

Requests may be submitted using one of the following methods:

By post or in person:
Boom Makina Ticaret ve Sanayi Anonim Şirketi
Ömerli Mahallesi, Uran Caddesi, No: 30/A, 34794 Çekmeköy, Istanbul, Türkiye

By email: info@boom.com.tr

We may request the following information:

• Name and surname;
• Signature where the request is made in writing;
• Turkish identity number for Turkish citizens or passport or identity number for other nationals;
• Notification address;
• Email address and telephone number, where available;
• The subject of the request;
• Supporting information and documents.

Additional information may be requested to verify identity and prevent unauthorised access to personal data.

Requests will be handled without charge as soon as possible and generally within the applicable statutory time limits. Where a request creates an additional cost, a fee permitted under applicable legislation may be charged.

14. Children

The website is intended primarily for commercial and professional users and is not designed to knowingly collect personal data from individuals under the age of 18.

Where we become aware that a child’s personal data has been processed without an appropriate legal basis, we will take reasonable steps to delete it.

15. Third-Party Links

The website may contain links to distributors, social-media platforms, video providers, map services and other third-party websites.

Boom Makina is not responsible for the content or privacy practices of third-party websites. Users should review the applicable third-party privacy policy before using the relevant service.

16. Changes to This Policy

This Policy may be updated to reflect changes in legislation, company activities, website functions or technologies.

The updated version becomes effective when published on the website. Material changes may also be communicated through a website notice or another appropriate method.