Privacy Notice

Your personal data is processed by Expomatik, acting as data controller, to the extent described below.

• Website: expomatik.com
• Requests and contact: info@expomatik.com
• Address: www.expomatik.com
• Telephone: 905307472777

Two separate groups of data are processed, depending on the nature of the service.

Member data: identity (full name), contact details (email address, telephone), company and invoicing details, transaction security records (IP address, session and sign-in records), customer transaction data (balance, usage history, support requests) and the content of the emails you send through the platform.

Company data on the platform: corporate contact details compiled from trade fair organisers’ publicly available exhibitor catalogues and from companies’ own websites. As a rule this data is corporate in nature (company name, corporate email address, switchboard number). To the extent that a record makes a natural person identifiable, it is treated as personal data and is covered by the safeguards in this notice.

Creating and managing your membership, providing the service, pricing and collecting payment, protecting deliverability and sending reputation, ensuring security and preventing misuse, meeting legal obligations, and handling requests and complaints.

Under Article 5 of the Turkish Personal Data Protection Law (KVKK), your data is processed on the basis of the formation and performance of a contract, compliance with a legal obligation, the establishment and protection of a right, and legitimate interest, provided your fundamental rights and freedoms are not harmed. Where the law requires explicit consent, we ask for it separately, and you may withdraw it at any time.

Your data may be transferred to the infrastructure and verification providers we use to deliver the service, and to legally authorised public bodies, in accordance with the applicable legislation. Some providers are located outside Türkiye; those transfers are made in line with the conditions of Article 9 of the KVKK.

The processors we currently use and the scope of each transfer:

This notice is updated whenever the list changes. Our agreements with providers require that the data be processed only for the stated purpose.

Data subjects located in the European Union: if the GDPR applies to you, we observe the principle of transparency in our processing activities, and you may exercise the rights the GDPR grants you (access, rectification, erasure, restriction of processing and data portability) through the contact address below.

Your personal data is kept for as long as the purpose of processing requires and for the limitation and retention periods set out in the applicable legislation. When your membership ends, account data is kept for the period required by commercial and tax legislation and is then deleted, destroyed or anonymised. Unsubscribe (opt-out) records are kept indefinitely to prevent further sending to the same address; such a record consists only of the email address and the date of opting out.

Transaction security and audit records (who performed security-critical operations such as sign-in, changes to permissions, balance or prices, data deletion requests and the start of a sending run, when and from which IP address) are kept to ensure security, to evidence transactions and to meet legal obligations (KVKK Article 5/2 (ç) and (f)). These records are generally kept for 1 year; records of financial movements, approvals and data deletions for 3 years. At the end of the period they are deleted or their personal identifiers are anonymised.

To preserve their integrity, audit records cannot be altered afterwards or deleted individually. When you request the deletion of your personal data, these records are not deleted in full; the personal identifiers within them (display name, IP address) are anonymised or truncated. This exception rests on compliance with a legal obligation and on the legitimate interest in establishing and protecting a right (KVKK Articles 28 and 5/2).

Data in transit is encrypted with TLS. Passwords are stored in an irreversible form; email account passwords and service keys are encrypted with AES-256-GCM and decrypted only at the moment of the relevant call. Access rights are role-based, administrative screens are subject to separate authorisation checks, and sensitive operations are written to the audit log. Every query is scoped to the membership; one member’s data is never visible to another member.

No decision producing effects concerning you is taken solely by automated analysis. The scores and suggestions shown on the platform serve only to rank company data and have no legal effect on any individual.

In relation to your personal data you have the right to:

• learn whether your personal data is processed and, if so, request information about it
• learn the purpose of processing and whether the data is used in line with that purpose
• know the third parties, in Türkiye or abroad, to whom the data is transferred
• request correction if the data is incomplete or inaccurate
• request erasure or destruction of the data
• request that corrections, erasures and destructions be notified to the third parties to whom the data was transferred
• object to a result that is to your detriment and arises from analysis by automated systems
• claim compensation if you suffer damage because of unlawful processing

You may send your requests to info@expomatik.com, or apply in writing to www.expomatik.com. Your request is answered within 30 days at the latest. Where we cannot verify your identity, we may ask for additional information; this is to prevent data being disclosed to an unauthorised person.

If you wish a company record on the platform to be removed, write to the same address with the company name and the relevant link.

This notice may be updated to reflect changes in legislation or in the scope of the service. The current version is always published on this page and the date at the top is updated. For more general information on how personal data is processed, see the Privacy Policy.