PRIVACY AND PERSONAL DATA PROTECTION POLICY

Last Updated: 16 August 2026

1. PURPOSE AND SCOPE

This Privacy and Personal Data Protection Policy (“Policy”) explains how Nevistanbul Textile & Promotion Industry and Trade Limited Company (“NEVİSTANBUL”, “Company”, “we”, “us” or “our”) collects, uses, stores, protects and, where applicable, transfers personal data of visitors, customers, prospective customers, business partners and other individuals who use our B2B website, digital platforms, communication channels and related services.

NEVİSTANBUL respects the privacy of individuals and attaches great importance to the protection and security of personal data.

This Policy has been prepared with reference to applicable data protection legislation, including, where applicable:

Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”),

the European Union General Data Protection Regulation (“GDPR” – Regulation (EU) 2016/679), and

other applicable national and international data protection laws and regulations.

This Policy explains the general principles governing the processing of personal data through the NEVİSTANBUL B2B website and related business activities.

2. DATA CONTROLLER

The data controller responsible for the processing of your personal data is:

Nevistanbul Textile & Promotion Industry and Trade Limited Company

Address: 15 Temmuz Mahallesi 1432 Sokak No:26-30, Bağcılar / Istanbul, Türkiye

Tax Office: Güneşli Tax Office

Tax Number: 6310675047

General E-mail: info@nevistanbul.com.tr

Privacy / Data Protection E-mail: privacy@nevistanbul.com.tr

Website: www.nevistanbul.com.tr

If you have any questions regarding the processing of your personal data, this Policy, or your data protection rights, you may contact us through the communication channels above.

3. PERSONAL DATA WE MAY COLLECT

Depending on how you use our website and B2B services, we may collect the following categories of personal data.

3.1. Identification and Contact Information

This may include:
First and last name,
Company name,
Job title or position,
E-mail address,
Telephone number,
Business address,
Country,
City,
Communication preferences.

3.2. B2B and Commercial Information

In connection with our B2B services, we may process:
Company information,
Company website,
Product inquiries,
Requests for quotations,
Sample requests,
Order information,
Product specifications,
Custom manufacturing requirements,
Printing, embroidery and labelling requirements,
Delivery information,
Billing information,
Business correspondence and communication records.

3.3. Technical Information

When you visit our website, certain technical information may be collected automatically or through similar technologies, including:

IP address,
Browser type,
Device type,
Operating system,
Language and regional settings,
Pages visited,
Date and time of visit,
Website interactions,
Referral information,
Cookie information,
Similar technical and usage information.

3.4. Communications

When you contact us through:
Contact forms,
Request for quotation forms,
Sample request forms,
E-mail,
Telephone,
B2B communication channels,

we may process the information you provide and the content of your communication.

4. HOW WE COLLECT PERSONAL DATA

Personal data may be collected through one or more of the following methods:
Website forms,
B2B registration or account forms,
Requests for quotations,
Sample requests,
Orders and commercial transactions,
E-mail communications,
Telephone communications,
Cookies and similar technologies,
Website analytics tools,
Trade fairs and B2B events,
Business partners,
Publicly available commercial sources.

5. PURPOSES OF PROCESSING PERSONAL DATA

We may use personal data for the following purposes:
Evaluating B2B inquiries,
Preparing quotations,
Processing sample requests,
Evaluating custom manufacturing requirements,
Managing orders,
Managing customer and business partner relationships,
Communicating regarding our products and services,
Operating and maintaining our website,
Maintaining website security,
Analysing website performance,
Improving user experience,
Providing technical support,
Managing accounting and invoicing processes,
Managing logistics and delivery processes,
Complying with legal and regulatory obligations,
Preventing fraud, misuse and security incidents,
Conducting our commercial activities,
Conducting B2B marketing activities,
Providing information about our products and services,

Sending marketing communications where consent or another valid legal basis is required.

NEVİSTANBUL seeks to ensure that personal data is not used for purposes that are incompatible with the purposes for which it was collected.

6. LEGAL BASES FOR PROCESSING PERSONAL DATA

Depending on the circumstances and applicable legislation, we may process personal data on one or more of the following legal bases:

Your consent,
The necessity to enter into or perform a contract,
Compliance with a legal obligation,
Our legitimate interests, where applicable,
The establishment, exercise or defence of legal claims,

Other legal grounds permitted under applicable data protection legislation, provided that the rights and freedoms of the individual are appropriately protected.

The applicable legal basis will be determined according to the nature of the relevant processing activity and the applicable legislation.

7. B2B COMMERCIAL COMMUNICATIONS

As part of our B2B activities, NEVİSTANBUL may communicate with:
Company representatives,
Purchasing managers,
Distributors,
Importers,
Commercial customers,
Prospective customers,
Business partners and other professional contacts.
Such communications may relate to:
Products,
Quotations,
Samples,
Pricing,
Custom manufacturing,
Orders,
Delivery,
Business cooperation,
B2B products and services.

Where applicable law requires consent or another specific legal basis for marketing communications, NEVİSTANBUL will comply with the applicable requirements.

Recipients may opt out of marketing communications at any time.

8. SHARING OF PERSONAL DATA WITH THIRD PARTIES

Your personal data may be shared, where necessary and in accordance with applicable law, with:

Authorised NEVİSTANBUL employees,
Information technology service providers,
Hosting and server providers,
E-mail service providers,
CRM and B2B software providers,
Website analytics providers,
Payment service providers,
Courier and logistics companies,
Accounting and financial service providers,
Legal and professional advisers,
Competent public authorities and governmental institutions.

Access to personal data by third-party service providers will be limited to what is necessary for the provision of the relevant services.

Where required by applicable law, appropriate contractual and organisational safeguards will be implemented.

9. INTERNATIONAL DATA TRANSFERS

Due to the international nature of NEVİSTANBUL’s B2B activities, personal data may be transferred to service providers, technology providers or business partners located outside Türkiye.

Where personal data is transferred outside the European Economic Area (“EEA”), NEVİSTANBUL will take into account the applicable requirements of the GDPR and applicable international data transfer rules.

Where required, appropriate safeguards may include:
Adequacy decisions,
Standard Contractual Clauses (“SCCs”) adopted by the European Commission,
Binding Corporate Rules,
Other legally recognised data transfer mechanisms.

International transfers will only be carried out where permitted under applicable data protection legislation and subject to appropriate safeguards where required.

10. PROCESSING OF PERSONAL DATA IN TÜRKİYE

NEVİSTANBUL is a company established and operating in Türkiye. Accordingly, personal data may be processed and stored in Türkiye or through service providers located in Türkiye where necessary for the provision of our B2B services.

Where personal data is transferred from the European Economic Area to Türkiye, NEVİSTANBUL will apply the relevant requirements and appropriate international data transfer mechanisms required by applicable law.

11. DATA RETENTION

Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected or for the period required by applicable law.

When determining the appropriate retention period, we may consider:
The duration of the business relationship,
Legal and regulatory obligations,

Tax and accounting requirements,

Contractual obligations,
The period necessary to establish, exercise or defend legal claims,
Legitimate business requirements,
Data security requirements.

When the applicable retention period expires, personal data will be securely deleted, destroyed or anonymised in accordance with applicable law.

12. DATA SECURITY

NEVİSTANBUL takes reasonable technical and organisational measures to protect personal data against:

Unauthorised access,
Unauthorised use,
Loss,
Alteration,
Unauthorised disclosure,
Misuse.
Depending on the circumstances, such measures may include:
Access controls,
Authorisation procedures,
Encryption,
Secure server infrastructure,
Security updates,
Backups,
Employee access controls,
Data minimisation,
Security monitoring.

However, no method of transmitting or storing information over the Internet can be guaranteed to be completely secure.

13. DATA SECURITY INCIDENTS

If a personal data breach or other security incident occurs that may affect personal data, NEVİSTANBUL will assess the incident in accordance with applicable law.

Where legally required, notifications will be made to the relevant regulatory authorities and affected individuals within the applicable statutory time limits.

14. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies for purposes including:
Enabling essential website functions,
Maintaining website security,
Improving user experience,
Measuring website performance,
Statistical analysis,
Marketing activities where applicable.

Further information regarding our use of cookies will be provided in our separate Cookie Policy.

Where applicable, users may manage their cookie preferences through the cookie preference centre provided on our website or through their browser settings.

15. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, social media platforms or other digital services.

These third parties have their own privacy policies and data processing practices.

NEVİSTANBUL is not responsible for the privacy practices or data processing activities of third-party websites or services.

We recommend that users review the relevant privacy policies before using third-party services.

16. YOUR DATA PROTECTION RIGHTS

Depending on applicable law and your location, you may have the following rights regarding your personal data:

The right to know whether your personal data is being processed,
The right to request access to your personal data,
The right to request correction of inaccurate or incomplete personal data,
The right to request deletion of personal data under certain circumstances,
The right to request restriction of processing under certain circumstances,
The right to object to certain processing activities,
The right to request data portability where applicable,
The right to withdraw consent where processing is based on consent,
Rights relating to automated decision-making where applicable,
The right to lodge a complaint with a competent data protection authority.

The scope and availability of these rights may vary depending on the applicable legislation and the individual’s location.

17. APPLICATIONS UNDER KVKK

Individuals located in Türkiye may submit requests concerning their rights under the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) through the following contact details:

Nevistanbul Textile & Promotion Industry and Trade Limited Company

Address: 15 Temmuz Mahallesi 1432 Sokak No:26-30, Bağcılar / Istanbul, Türkiye

E-mail: privacy@nevistanbul.com.tr

Requests will be assessed and responded to in accordance with KVKK and applicable legislation.

18. RIGHTS UNDER THE GDPR

Where the GDPR applies, individuals may exercise their applicable GDPR rights by contacting NEVİSTANBUL in writing or electronically.

E-mail: privacy@nevistanbul.com.tr

Requests will be handled in accordance with the applicable provisions of the GDPR.

Where reasonably necessary, we may request additional information to verify the identity of the person making the request.

19. RIGHT TO LODGE A COMPLAINT WITH A DATA PROTECTION AUTHORITY

If you believe that your personal data has been processed unlawfully, you may have the right to lodge a complaint with the competent data protection authority under applicable law.

Individuals located in the European Union or European Economic Area may generally contact the competent data protection authority in their country of residence, workplace or place of the alleged infringement, subject to the applicable rules.

Individuals in Türkiye may exercise their rights to lodge complaints with the relevant authorities under KVKK.

20. CHILDREN’S PERSONAL DATA

The NEVİSTANBUL B2B website is primarily intended for businesses, company representatives, commercial customers, distributors, importers and other professional users.

NEVİSTANBUL does not knowingly seek to collect unnecessary personal data from children.

Where the processing of children’s personal data becomes relevant, NEVİSTANBUL will apply the additional safeguards and consent requirements required by applicable law.

21. AUTOMATED DECISION-MAKING AND PROFILING

NEVİSTANBUL does not intend to use automated decision-making processes that produce legal effects or similarly significant effects on individuals.

If such processing is introduced in the future, the relevant information and safeguards required under applicable law will be provided.

22. CHANGES TO THIS PRIVACY POLICY

NEVİSTANBUL may update this Privacy and Personal Data Protection Policy from time to time.

Changes may be made due to:
Changes in applicable legislation,
Technological developments,
Introduction of new services,
Changes in our business activities,
Changes in our data processing practices.
The updated Policy will become effective when published on our website.

Where required by applicable law, users will be separately informed of material changes.

23. CONTACT INFORMATION

If you have any questions regarding this Privacy and Personal Data Protection Policy or the processing of your personal data, you may contact us using the information below.

Nevistanbul Textile & Promotion Industry and Trade Limited Company

Address: 15 Temmuz Mahallesi 1432 Sokak No:26-30, Bağcılar / Istanbul, Türkiye

Tax Office: Güneşli Tax Office

Tax Number: 6310675047

General E-mail: info@nevistanbul.com.tr

Privacy / Data Protection E-mail: privacy@nevistanbul.com.tr

Website: www.nevistanbul.com.tr

24. EFFECTIVE DATE

This Privacy and Personal Data Protection Policy entered into force on 16 August 2026.

Last Updated: 16 August 2026

Nevistanbul Textile & Promotion Industry and Trade Limited Company