Privacy policy.

This policy explains how we process your personal data. It is also our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Data controller

DRF İnşaat Mobilya Sanayi Ticaret Ltd. Şti. (“DRF Contract”)
Veysel Karani Mahallesi, Çolakoğlu Sokak No: 10/79, Rings Rezidans, 34885 Sancaktepe, Istanbul, Türkiye
Email: [email protected] · Phone: +90 216 510 86 13

2. Scope

This policy covers our website drf.com.tr and its project brief form, our email, telephone and WhatsApp conversations with you, and meetings.

3. Personal data we process

• Identity and contact: name, company, role, phone number, email address, WhatsApp profile name.
• Enquiry and project details: project type and location, number of rooms, products and quantities, dimensions, delivery city and terms, schedule, budget range.
• Messages: emails and WhatsApp messages; files, photos and drawings you send; the date and time of messages.
• Quotation and contract details: the details we need for quotations, contracts, invoices and delivery.
• Website use: The company that hosts our website processes your IP address and browser details to deliver pages and keep the site secure. Our website does not use cookies or advertising tracking. Our hosting provider, Cloudflare, measures aggregate visits such as page views and page speed without cookies. Your language and country choice stays in your own browser and is not sent to us.

The project brief form does not store your answers on our website. When you press send, your answers are prepared as an email in your own email app. We receive them only when you send that email.

We do not ask for special categories of personal data (for example health or religion). Please do not send them.

4. Purposes

• To answer your enquiry and prepare product and price quotations.
• To make and perform our contract with you: design, production, shipping, installation and after-sales communication.
• To inform you about the status of your project.
• To meet our accounting, tax and commercial record obligations.
• To keep our services secure and of good quality.

We do not send marketing or campaign messages on WhatsApp. If we start to do so, we will first ask for your explicit consent.

5. Legal bases

• Performance of a contract or steps before a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Our legal obligations (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• Establishing, exercising or defending legal claims (KVKK Art. 5(2)(e)).
• Our legitimate interests, for example to route your enquiry to the right person (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Your explicit consent for marketing messages.

6. How we collect data

We collect data directly from you through email, telephone, WhatsApp, the web form and meetings, by electronic means. Technical data about your visit to the website is processed automatically.

7. Recipients

We share your data only for the purposes above and only as much as necessary:

Recipient	Country	Purpose
Cloudflare, Inc.	USA	Hosting and delivery of our website, and aggregate visit measurement.
Our email service provider	Türkiye	Delivery and storage of emails.
Competent public authorities	Türkiye	When the law requires it.

When you write to us on WhatsApp, your messages travel through WhatsApp’s (Meta’s) systems. WhatsApp’s own privacy terms also apply to that service.

8. Retention

Messages about enquiries that do not lead to a contract are deleted or anonymised 2 years after the last message. Contracts, invoices and commercial records are kept for the period set by law (for example 10 years under the Turkish Commercial Code). When the period ends, we delete, destroy or anonymise the data.

9. Your rights

Under Article 11 of the KVKK you can ask us whether we process your data and for information about it, learn the purpose of processing, learn who receives it in Türkiye or abroad, ask us to correct or delete it, ask us to tell recipients about a correction or deletion, object to a result against you that comes only from automated analysis, and claim compensation for damage from unlawful processing.

If you are in the European Union or the United Kingdom, the GDPR also gives you the rights of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on your consent, you can withdraw it at any time. You can also complain to your local data protection authority.

10. Contact and requests

Send your request to [email protected] from the email address we have on record, or in writing to our address above. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

11. Deleting your data

You can ask us to delete your data:

1. Write “Delete my data” to our WhatsApp line, or
2. Email [email protected]. If you wrote to us on WhatsApp, give your WhatsApp number.

We delete your messages and contact details from our systems within 30 days of your request. Records that the law requires us to keep (for example invoices) are not included; we delete them when the legal period ends. Deleting the chat on your phone does not delete our records. Deleted data can stay longer in our backup copies.

12. Changes

We can update this policy. The current version and its effective date are on this page.