ACSISCO Procurement Office Personal Data Processing Notice
Document version: EN-2026-09-09-36-R2
1. Controller, scope and nature of this notice
1.1. The data controller is UK ELEKTRİK MALZEMELERİ SANAYİ TİCARET LİMİTED ŞİRKETİ (Acsisco). Address: Bahçelievler Mahallesi 5083 Sokak No:11/A Altıeylül/Balıkesir. Email: info@acsisco.com; registered electronic mail (KEP): uk.acsisco@hs09.kep.tr. The Acsisco brand is not a separate legal entity.
1.2. This notice concerns data about natural persons who are customers, company representatives, employees, supplier contacts or delivery recipients in connection with an Office application and consultancy service. Corporate information that can be linked to a natural person is also personal data. General platform activities, Office cookies and separate optional purposes are assessed together with their own activity notices; this text does not give unlimited permission in their place.
1.3. This is not a contract or explicit-consent statement. Registration, joining, opening or reading the notice, or acknowledging that information has been obtained, is not consent to processing, a service-contract signature or commercial-message approval. Not giving that acknowledgement does not by itself prevent an Office application. Fulfilling and proving the disclosure obligation is the controller's responsibility.
2. Data in the application and service process
2.1. An application uses name, username, contact details, company name and account/verification information; joining with an existing account uses the relevant existing profile and company information and any application note you submit. Using shared account data does not create a second identity or second registration contract. Authority to represent a company is not the data subject's consent to every processing activity.
2.2. Needs, proposals, party and representation details, contract versions, signed documents, review records and status records are processed when your consultancy request is received, scope and fees are agreed, the contract is prepared and signed, signed copies are reviewed and service status is managed. These data are used to respond to the application, perform the agreed service and protect the parties’ rights. Signing and service-commencement conditions appear in the separate consultancy contract.
2.3. Service delivery processes the personal-data elements of the request subject, quantity, specifications, attachments, offers and comparisons, customer decisions, orders, delivery and any sample records. Address and, where needed, location information is limited to delivery or the relevant address function; it is not permission for continuous tracking of a person's location. A consultant's preparation and follow-up do not replace a binding decision reserved to the customer.
3. Documents, financial records and third parties
3.1. Identity, representation, signature and contact information in verification and service documents is handled only to the extent needed for the relevant activity. Do not upload unnecessary identity numbers, special-category data or unrelated third-party information; redact parts that are not needed. A signature image is not automatically biometric data; if special-category data arises, the specific KVKK Article 6 condition and necessary safeguards must be assessed separately. This text is neither blanket consent for such data nor a guarantee of automatic scanning or erasure.
3.2. Invoice, bank-transfer and payment-reference information for consultancy, together with necessary parts of a payment document you submit, may be processed for accounting, payment follow-up and protection of rights. Submitting a payment document does not mean that a bank payment has been verified or that the service has started. Payment and service-commencement conditions are governed by your separate consultancy contract.
3.3. Supplier-representative, business-contact or delivery-recipient information may be obtained from that person or from a customer/ACSISCO staff member legally entitled to share it. The person must be informed of the source, purpose, recipients and rights within the applicable period; at first contact if used for communication, and no later than first transfer if transferred. A customer's statement does not remove ACSISCO's disclosure duty. The personal contact-line owner's choice and the company's sharing authority are assessed separately; the data is not automatically added to a marketing list.
4. Communication, security and evidence of actions
4.1. In-app correspondence, notifications, transactional e-mail/SMS and service-related telephone conversation notes are handled to respond to requests, coordinate service and explain the relevant transaction. This notice promises neither audio recording of telephone calls nor verbatim recording of all external communications. Service and marketing messages are different; using a service channel does not approve every commercial message.
4.2. To the extent the official Office WhatsApp channel is enabled and offered, incoming/outgoing service messages through that line, sender/recipient number, message and conversation references, time and delivery/read/error events may be processed in the Office workspace. Keeping unmatched events in an authorised operational queue is also processing. This does not cover personal WhatsApp accounts or unrelated correspondence. An event/type record for unsupported media does not mean that the entire file is imported into Office. A link button, an active API connection, message delivery and a lawful transfer condition are separate matters.
4.3. Authentication, OTP and abuse controls process account/session information, IP, user agent and relevant security events; transaction auditing records the real actor, account, action, time and authority context. Office staff work under their own identities; a context cookie gives no authority to impersonate a customer. Notice display, opening and acknowledgement are distinguished from separate consent/acceptance/withdrawal events. A client-reported time is not the same evidence as the time the server created the record.
5. Legal bases by purpose
5.1. For a natural person who is party to the contract, data directly necessary for receiving the application, setting terms and performing the agreed service is assessed under KVKK Article 5/2-c. A legal entity's representative/employee does not become a party under that provision merely by participating in the company's contract; necessary business-contact and representation data requires a specific necessity and fundamental-rights-protecting balance under Article 5/2-f. Every conceivable service activity cannot be assigned these grounds collectively.
5.2. Invoicing and lawful demands of competent authorities are addressed under Article 5/2-ç to the extent of the applicable obligation; specific disputes and preservation of evidence under Article 5/2-e. Where Article 5/2-f applies to account security, abuse prevention and necessary transaction auditing, necessity, proportionality and the person's rights must be respected. Each datum and retention purpose is linked to its relevant ground; a security label is not unlimited monitoring authority.
5.3. Analytics, marketing, commercial communications or other optional processing requiring consent must not begin before the specific data, purpose, recipient and scope are explained and a free, affirmative choice obtained. Cookie categories, communication channels and other independent purposes do not provide consent for one another. Consent may be withdrawn; refusal or withdrawal must not by itself prevent an independent core service. The same optional activity cannot be continued by opportunistically switching legal bases after withdrawal.
6. Collection methods and recipients
6.1. Data is obtained by fully or partly automated means through forms, account and service screens, document uploads, verification, in-app messages, offered official communication channels and technical records; and by non-automated means through incorporating service paperwork and conversation notes into a filing system. Cookies and browser storage are explained separately in the Office Cookie Policy. Listing these methods does not establish that an unused channel is active or that every channel collects the same data.
6.2. Information needed for requests and delivery may be shared with the relevant supplier/transaction party; with authorised ACSISCO staff to perform the service; with financial/legal advisers within their duties for accounting or protecting rights; and with public authorities within their lawful powers. Unnecessary customer identity, commercial strategy and other suppliers' offers are not shared. Staff access depends on duty and account scope; it is not general access for all staff or all platform users. Personal data is not sold or commercially transferred to data brokers.
6.3. Hosting, authentication/database, file storage, e-mail/SMS, security and actually used communication/map/measurement services may process relevant data limited to the service purpose. The actual provider, role, fields transmitted and onward recipients must be identified in the activity inventory; not every provider is assumed to be a processor acting solely on instructions. Measurement under the same domain can also process data. A provider name or a link in code is not proof of enabled use or a particular country/protection mechanism.
7. International transfers and retention
7.1. An international transfer requires the applicable KVKK Article 9 condition in addition to the domestic processing ground. Contract performance, an ordinary provider contract or a checked box does not automatically satisfy it. For the actual transfer, recipient and purpose, adequacy or an appropriate safeguard route must be assessed, or, in their absence, only an occasional-transfer possibility within statutory limits. Regular/continuous infrastructure and measurement transfers cannot be collectively legitimised through occasional-transfer consent.
7.2. Account, contract, verification, request/quotation/order, financial, correspondence, WhatsApp-event, transaction-evidence and technical records are retained for their respective purposes and applicable obligations. Statutory financial and commercial document periods and the events starting them are distinguished in section 6.1 of the general KVKK Information Notice; these rules also apply to Office documents within their scope. A general limitation period does not automatically authorise ten years of retention for all data, and cookie lifetime is not server retention. Necessary evidence and acquired-rights records are preserved without keeping unnecessary personal data indefinitely. Disposal when legally required does not depend on a further request from the individual.
7.3. Where purpose or lawful retention need ends, applicable erasure, destruction, anonymisation and recipient-notification duties apply. Closing an account, clearing a local record and ending the service are different actions. Necessary earlier signed copies, acceptance/withdrawal evidence and rights records are not retrospectively changed by a new text; retaining them gives no new marketing or unrelated-use authority.
8. Rights, security and versions
8.1. All rights under KVKK Article 11 are preserved, including obtaining processing information and learning recipients, requesting correction, qualifying erasure/destruction and recipient notification, objecting to an adverse result of solely automated analysis, and seeking compensation for damage from unlawful processing. This summary is not exhaustive. A human-prepared offer comparison does not prove the absence of other automated analysis; the customer's final binding decision remains separate.
8.2. Applications may be sent to the stated controller channels in writing or through the Communiqué's KEP, secure electronic/mobile signature, previously supplied and recorded e-mail, or designated software method. Necessary identity/application information is requested only to resolve the application securely; no new mandatory KEP field is added to Office registration. A reasoned written/electronic response is given within thirty days; resolution is normally free, subject to the Board's cost tariff exception. Rejection, an inadequate answer or no answer engages the Board complaint periods of thirty days from learning the response and in any event sixty days from applying.
8.3. The controller is responsible for necessary administrative and technical measures against unlawful processing/access and for safeguarding data; this text guarantees neither perfect security, immutable recording of every action nor one-click erasure of all data. New purposes and scope are explained before processing and separate new consent obtained where required. The Turkish and English texts explain the same scope; records relating to earlier versions are preserved. This notice changes neither the Office service contract, existing acquired rights nor the service-end payment period.