Privacy Notice

Personal Data Protection and Privacy Notice

1. Controller

This Privacy Notice has been prepared in accordance with the Personal Data Protection Law No. 89/2007 and the Regulation on the Procedures and Principles to be Followed in Fulfilling the Obligation to Provide Information, issued under that Law.

The controller responsible for the processing of your personal data:

METALÜX ALÜMİNYUM LTD.

10. Sokak, Güvercinlik Industrial Estate, Güvercinlik, Famagusta, TRNC

Email: info@metaluxaluminyum.com

2. Personal Data Processed

The following personal data may be processed in connection with your enquiries, quotation, site survey and service requests:

Name and surname

Telephone number

Email address

Details of the product, system or service requested

Project location or district

Message and request content

Other information shared by you during communication

Technical data such as IP address, access logs, and device and browser information may also be processed in order to ensure that the website operates securely and properly.

If you apply through the job application form, the position you are applying for, your message and your CV are also processed. Please do not include sensitive personal data such as health, religion, ethnic origin or political opinions in your CV.

3. Method of Collection of Personal Data

Your personal data may be obtained through:

the contact and quotation forms on the website,

email correspondence,

telephone calls,

WhatsApp and other communication channels,

direct communications.

wholly or partly by automated or non-automated means.

Technical data may be collected by electronic means in connection with the use and security of the website.

4. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

To respond to your quotation and site survey requests

To communicate with you

To plan site survey and project meetings

To provide information about the products and services you have requested

To carry out quotation, contract and service processes

To manage customer relations

To fulfil legal obligations

To ensure the security and proper operation of the website

Your personal data is processed for specific, explicit and legitimate purposes and is not used in ways unrelated to those purposes.

5. Legal Basis for Processing Personal Data

Depending on the nature of the specific processing activity, your personal data is processed on the basis of the conditions set out in Article 6 of the Personal Data Protection Law No. 89/2007.

These may be:

Consent given unambiguously and explicitly,

Processing being necessary for compliance with a legal obligation,

Processing being necessary for the performance of a contract to which you are a party, or for taking steps at your request prior to entering into a contract,

Processing being necessary for the protection of vital interests,

Processing being necessary for the performance of a task carried out in the public interest or in the exercise of official authority,

Processing being necessary for the legitimate interests pursued by the controller or by the third party to whom the data are disclosed, except where such interests are overridden by your rights, interests and fundamental freedoms.

as the case may be.

Sensitive personal data is not processed except under the conditions set out in Article 7 of Law No. 89/2007.

6. Circumstances in Which the Provision of Data Is Mandatory

You may be required to provide the information necessary for the service or transaction you have requested to be carried out.

If the necessary information is not provided, it may not be possible to carry out the quotation, site survey, communication or the service you have requested as required.

7. Transfer of Personal Data

Your personal data, to the extent necessary for the purposes of processing, may be transferred to;

Competent public bodies and institutions,

Competent persons or organisations,

Hosting, email, IT and technical service providers,

Other service providers necessary for the performance of the service

where applicable.

Transfers are carried out only within the limits of the relevant purpose and legal conditions.

Your personal data is not sold for commercial purposes.

8. Transfer of Data Abroad

Where your personal data needs to be transferred to a country outside the Turkish Republic of Northern Cyprus, the conditions set out in Article 11 of the Personal Data Protection Law No. 89/2007 and the relevant legislation apply.

Transfers of data abroad are carried out within the framework of the conditions laid down in the relevant legislation and the necessary permissions or licences.

Our website and your personal data may be stored and processed on servers outside the Turkish Republic of Northern Cyprus. Companies providing hosting and email services, as well as website analytics (Google Analytics, Google Tag Manager), advertising measurement (Meta Pixel) and map (Google Maps) services that operate only with your consent, may process data on servers located in European Union countries, the United States or other countries. Such transfers are made only for the purposes described in this notice and to the extent required by the service.

By ticking the consent box on our forms, you consent to your data being stored and processed abroad for the purposes described in this notice. You may withdraw your consent at any time using the contact details in section 13; in that case we can continue with your request only to the extent that we can respond without using services located abroad.

9. Retention Period of Personal Data

Your personal data is retained for the period required by the purposes of processing and within the periods prescribed under the relevant legislation.

Where the purpose of processing has ended and there is no other legal reason requiring the retention of the data, your personal data is deleted, destroyed or anonymised in accordance with the legislation.

Requests submitted through the forms on our website and their attachments (drawings, photos, CVs) are kept for up to 2 years; after that they are deleted from the system automatically. If you become our customer, contract and invoice records are kept for the period required by the relevant legislation.

10. Security of Personal Data

Technical and organisational security measures appropriate to the nature of the data and the associated risks are applied to protect your personal data against unauthorised access, loss, alteration, disclosure, transfer or unlawful processing.

Persons who have access to personal data are subject to confidentiality obligations under the relevant legislation.

11. Your Rights

Under the Personal Data Protection Law No. 89/2007, you have the right to:

Learn whether your personal data is being processed,

Request information about your personal data being processed and its source,

Learn the purpose of processing of personal data,

Learn the persons or categories of persons to whom the data is disclosed,

Request information about the categories of personal data being processed,

Request the correction of inaccurate or incomplete personal data,

Request the erasure or blocking of personal data where the legal conditions are met,

Object to the processing of personal data under certain conditions.

These are your rights.

12. Direct or Indirect Marketing

Your personal data is not used for the direct or indirect marketing of goods or services without your written consent as required under Article 17 of Law No. 89/2007.

13. Application

In order to exercise your rights set out above, you may apply to the controller in writing using the contact details below:

METALÜX ALÜMİNYUM LTD.

10. Sokak, Güvercinlik Industrial Estate, Güvercinlik, Famagusta, TRNC

Email: info@metaluxaluminyum.com

If no response is given within 30 days of the submission of your access request, or if the response given is unsatisfactory, you have the right to apply to the Personal Data Protection Authority.

If you object to the processing of personal data, the controller shall respond in writing within 15 working days following the objection. If no response is given or the response is found unsatisfactory, you may apply to the Personal Data Protection Authority.

14. Cookies and Similar Technologies

A cookie is a small text file that a website you visit stores in your browser. Cookies and similar technologies are used on our website as follows:

Essential: Our website does not place its own cookies in visitors’ browsers. Your cookie preference (accept or decline) is kept in your browser’s local storage under the name “metalux-cerez” and is not sent to our server.

Administration panel: Session and security cookies (payload-token, mx-panel) are used only when authorised staff sign in; they are not placed for visitors.

Website analytics and advertising measurement: Google Analytics, Google Tag Manager and Meta Pixel run only after you click “Accept” in the cookie banner and place cookies such as _ga, _ga_<ID> and _fbp. These services are operated abroad by Google and Meta. If you choose “Essential only”, these services do not run.

Map: Google Maps on the contact page opens only when you click the “Show map” button; from that point Google may use its own cookies.

You can change your preference at any time via the “Cookie preferences” link in the page footer. You can also delete or block cookies in your browser settings; this does not affect the basic functions of the website.

15. Other Matters

Linked services: Information you send through WhatsApp, social media or other websites we link to is also subject to those services’ own privacy rules.

Automated decisions: No decision about you is made based solely on automated processing; your requests and applications are reviewed by our staff.

16. Updating of the Privacy Notice

This Privacy Notice may be updated in line with changes that may occur in the purposes of processing personal data, in the services used or in the relevant legislation.

The current Privacy Notice is published on our website.

Last updated: 4 October 2026