Last updated:
As Oquto (the “Company”), we attach importance to the security and confidentiality of your personal data. This Privacy Notice has been prepared in order to inform you, in our capacity as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
This Notice covers persons who visit our website, complete our quotation, sample kit and contact forms or contact us through any channel, as well as the authorized representatives and employees of our customers and business partners.
1.Data Controller
Under the Law, your personal data are processed by Oquto, in its capacity as data controller, within the framework described below:
Oquto
- destek@oquto.com
- Phone
- +90 539 719 12 43
- Address
- Levent, Beşiktaş / İstanbul
- Website
- oquto.com
2.Categories of Personal Data Processed
Depending on the nature of the relationship established with the data subject, the Company processes the following categories of personal data:
| Data category | Personal data | Data subject group |
|---|---|---|
| Identity | First name, last name; Turkish national identity number where an invoice is issued | Prospective customer, customer representative, person making contact |
| Contact | Telephone number, email address, city, business and delivery address | Prospective customer, customer representative, person making contact |
| Customer transaction | Business name and type, number of tables or rooms, package preference, request and message content, order and subscription information, support records | Prospective customer, customer representative |
| Finance | Trade name, tax office and number, billing information, payment and collection records | Customer representative |
| Transaction security | IP address, browser and device information, date and time of access, Management Panel username, encrypted password and activity logs | Website visitor, customer representative and users |
| Marketing | Approval for commercial electronic messages and communication preferences | Prospective customer and customer representative who have given approval |
| Legal transaction | Correspondence, request and complaint records, correspondence conducted with competent authorities | All data subject groups |
The Company does not process special categories of personal data for the activities covered by this Privacy Notice.
3.Purposes of Processing Personal Data
Your personal data are processed for the following purposes in accordance with the general principles set out in Article 4 of the Law:
- Receiving, evaluating and finalizing quotation, demo and sample kit requests;
- Carrying out the delivery processes for sample kits and hardware products;
- Carrying out contractual processes and providing the services;
- Creating and managing customer accounts and carrying out authorization processes;
- Carrying out billing, finance and accounting activities;
- Carrying out communication activities, following up on requests and complaints, and providing customer support services;
- Carrying out information security processes and ensuring the security of the website and the Platform;
- Measuring and improving service quality;
- Conducting activities in compliance with legislation and fulfilling retention and disclosure obligations;
- Providing information to authorized persons, institutions and organizations;
- Following up and conducting legal affairs;
- Where approval has been given, carrying out promotional and campaign communications regarding products and services.
4.Method of Collection and Legal Grounds for Processing
Your personal data are collected, partly by automated and partly by non-automated means, through the quotation, sample kit, quick contact and contact forms on our website; messages sent via email, telephone, WhatsApp and our social media accounts; contract and order documents; and records generated by the Management Panel and by the website and Platform servers.
These personal data are processed on the basis of the following legal grounds set out in the second paragraph of Article 5 of the Law:
- Processing is expressly provided for by law (Article 5(2)(a)): record-keeping and retention obligations under Tax Procedure Law No. 213, Turkish Commercial Code No. 6102 and Law No. 5651;
- Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (Article 5(2)(c)): responding to quotation requests, subscription and sales processes, delivery and support services;
- Processing is necessary for the data controller to fulfil its legal obligation (Article 5(2)(ç)): billing and providing information to competent authorities;
- Processing is necessary for the establishment, exercise or protection of a right (Article 5(2)(e)): management of disputes and follow-up of legal proceedings;
- Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Article 5(2)(f)): ensuring information security, improving service quality and responding to contact requests.
The processing activity relating to the sending of commercial electronic messages is carried out solely on the basis of your explicit consent pursuant to the first paragraph of Article 5 of the Law and your approval obtained under Law No. 6563. Not giving your explicit consent does not affect your ability to benefit from the services we offer.
5.Transfer of Personal Data
Your personal data may be transferred to the following categories of recipients to the extent necessary for the achievement of the purposes set out above and in accordance with Articles 8 and 9 of the Law:
- Suppliers providing hosting, cloud infrastructure, email and software services: for the purpose of the technical provision of the services;
- Courier and logistics companies: for the purpose of delivering sample kits and hardware products;
- Banks and payment institutions: for the purpose of carrying out payment and collection transactions;
- Persons and organizations from whom financial advisory, independent audit and legal consultancy services are obtained: for the purpose of carrying out finance, accounting and legal affairs;
- Providers of POS, billing and hotel management systems with which an integration is established at the request of the Customer: for the purpose of providing the integration service;
- Public institutions and organizations and judicial authorities that are legally authorized: for the purpose of fulfilling legal obligations.
Your personal data may be transferred abroad because the servers of some of our infrastructure providers are located outside Türkiye. Such transfers are carried out pursuant to Article 9 of the Law, provided that there is an adequacy decision regarding the country of transfer or that one of the appropriate safeguards is in place, such as the execution of the standard contract published by the Personal Data Protection Board, binding corporate rules or a written undertaking with the permission of the Board. Where appropriate safeguards cannot be provided, transfers are made only in the incidental cases listed in the sixth paragraph of Article 9 of the Law.
6.Retention Periods of Personal Data
Your personal data are retained for the period prescribed by the relevant legislation or necessary for the purpose for which they are processed. The principal retention periods are shown below:
| Data and process | Retention period |
|---|---|
| Quotation, sample kit and contact requests that do not result in a contract | 2 years from the date of last contact |
| Contract, subscription and customer account records | 10 years from the termination of the contract |
| Invoices, commercial books and accounting records | 10 years from the end of the relevant calendar year |
| Website and Platform access and activity logs | 2 years |
| Commercial electronic message approval records | 3 years from the withdrawal of approval |
| Request, complaint and legal correspondence records | 10 years from the conclusion of the request |
Personal data whose retention period has expired or for which the conditions for processing no longer exist are erased, destroyed or anonymized in the first periodic destruction process and in any event within six months, pursuant to the Regulation on the Erasure, Destruction or Anonymization of Personal Data.
7.Rights of the Data Subject
Pursuant to Article 11 of the Law, you may exercise the following rights regarding your personal data by applying to the Company:
- To learn whether your personal data are processed;
- To request information if your personal data have been processed;
- To learn the purpose of processing your personal data and whether they are used in accordance with that purpose;
- To know the third parties, in Türkiye or abroad, to whom your personal data are transferred;
- To request the rectification of your personal data if they have been processed incompletely or inaccurately;
- To request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law;
- To request that the rectification, erasure or destruction operations be notified to the third parties to whom your personal data have been transferred;
- To object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by means of automated systems;
- To claim compensation for damage if you suffer damage as a result of the unlawful processing of your personal data.
8.Application Procedure
You may submit your requests concerning the rights listed above to the Company by one of the following methods, pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller:
- By applying in person with a petition bearing your wet signature at Levent, Beşiktaş / İstanbul, or by sending it through a notary public;
- By sending your application signed with a secure electronic signature or mobile signature by email to destek@oquto.com;
- By sending an email to destek@oquto.com from the email address that you have previously notified to the Company and that is registered in our systems.
Your application must clearly and comprehensibly state your first name, last name and, for written applications, your signature; for citizens of the Republic of Türkiye, your Turkish national identity number, and for foreign nationals, your nationality and passport number or, if any, your identity number; your residential or business address for notification purposes; your email address for notification purposes, if any; your telephone number; and the subject of your request. Information and documents relating to your request should be attached to your application.
Your application will be concluded free of charge as soon as possible, depending on the nature of the request, and in any event within thirty days. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If your application is rejected, if you find the response inadequate or if no response is given in due time, you have the right to lodge a complaint with the Personal Data Protection Board within thirty days from the date on which you learn of the response and, in any event, within sixty days from the date of application.
9.Changes to this Privacy Notice
The Company may update this Privacy Notice in line with changes in legislation or in its data processing activities. The current version is always published on this page, and the “Last updated” date at the top of the page is amended.