Privacy Notice

As Mirza Matbaa Sanayi Ticaret Limited Şirketi (“Gepako”, the “Business”), we inform you about the processing of the personal data of our customers, prospective customers, and the authorised representatives and employees of our corporate customers under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies to you, the EU General Data Protection Regulation (“GDPR”).

Address of the data controller, Mirza Matbaa Sanayi Ticaret Limited Şirketi: Maltepe Mah. Litros Yolu Sk. C Blok No: 2-4C İç Kapı No: 304 Zeytinburnu/İstanbul, Türkiye.

This notice covers product information, quotation, sample, design, printing, order, payment, delivery and after-sales communication processes.

Depending on your relationship with us and the transaction you carry out, the following personal data is processed to the extent necessary:

• Identity and representation details: name, surname, position, title, signature and information on the authority to represent.
• Contact details: phone number, e-mail address, billing and delivery addresses.
• Customer transaction details: product and quotation requests, order details, sample requests, correspondence, design and print approvals, delivery, return and complaint records.
• Financial details: invoice and tax details that can be linked to individuals, bank account details, payment, collection and current account records.
• Information in print files: names, contact details and other personal data of individuals, if contained in the designs, images and print content sent to us.
• Legal transaction details: information relating to disputes, official requests and applications concerning personal data.

Please do not add personal data that is not necessary for the transaction — in particular special categories of personal data such as health information or criminal records — to your quotation requests or print files.

Your personal data is collected through the contact and quotation forms on our website, e-mail correspondence, phone calls and face-to-face meetings, design files sent to us, quotation and order documents, contracts, invoices and delivery documents.

The information may be provided directly by you or by the authorised representatives of the business you represent.

Your data is processed by fully or partly automated means in electronic environments and, for physical documents, by non-automated means provided that they form part of a data filing system.

We process your personal data for the following purposes:

• Preparing quotations, handling sample requests, taking orders, carrying out design and print approvals, and completing production and delivery: the data of individuals who are party to the contract is processed because it is necessary for the conclusion or performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Communicating with the authorised representatives and employees of corporate customers and coordinating orders: the necessary identity, position and contact details are processed based on our legitimate interest in conducting the business relationship, provided that this does not harm your fundamental rights and freedoms (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Issuing invoices, accounting, keeping statutory records and making official notifications: based on explicit provision by law and compliance with legal obligations (KVKK Art. 5/2-a and ç; GDPR Art. 6(1)(c)).
• Handling payments and collections: depending on the nature of the transaction, based on the performance of the contract, compliance with legal obligations or the protection of a right (KVKK Art. 5/2-c, ç and e; GDPR Art. 6(1)(b), (c) and (f)).
• Assessing returns and complaints, resolving disputes and protecting legal rights: the relevant transaction and correspondence records are processed because this is necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2-e; GDPR Art. 6(1)(f)).
• Responding to data protection applications and requests from competent authorities: based on compliance with legal obligations (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).

For activities that require explicit consent, you are informed separately and your explicit consent is obtained. This notice does not replace consent to receive advertising or campaign messages.

Your personal data may be transferred, limited to what the relevant transaction requires and in accordance with the conditions in Article 8 of the KVKK:

• to cargo and logistics companies, to deliver samples and orders;
• to the relevant suppliers, limited to the information needed to complete the work, if production or printing services for an order are outsourced;
• to banks and the payment service providers used in the transaction, for payment, collection and refund transactions;
• to financial advisers and the relevant service providers, for accounting and statutory record-keeping;
• to the relevant service providers, for the operation, hosting, security and technical support of the information systems we use;
• to legal advisers and lawyers, to protect legal rights;
• to competent public authorities and courts, under legal obligations or lawful requests.

For services and transactions that require the transfer of personal data abroad, the conditions in Article 9 of the KVKK apply. You are informed separately, within the relevant transaction, about the purpose of the transfer, the data categories concerned, the recipient groups and the legal transfer mechanism applied.

This notice does not by itself constitute explicit consent or a legal basis for transferring data abroad.

Where the GDPR applies, transfers of your data from the European Economic Area are made with appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

Your personal data is kept for the periods set out in the relevant legislation or for as long as the purpose of processing requires. When determining retention periods, statutory record-keeping obligations, the nature of the business relationship and the periods needed to protect legal rights are taken into account.

When all the reasons requiring the processing of personal data no longer exist, the data is deleted, destroyed or anonymised in accordance with the relevant legislation.

We take technical and administrative measures appropriate to the nature of the processing to prevent unlawful processing of personal data and unlawful access to it, and to ensure that it is kept securely.

Under Article 11 of the KVKK, you can:

• find out whether your personal data is processed and, if so, request information about it;
• find out the purposes of processing and whether your data is used in line with those purposes;
• request information about the third parties in Türkiye or abroad to whom your data is transferred;
• request the correction of incomplete or inaccurate data;
• request the deletion or destruction of your data when the conditions in Article 7 of the KVKK are met;
• request that the correction, deletion and destruction be notified to the third parties to whom your data was transferred;
• object to a result against you arising from the analysis of your data exclusively by automated systems;
• claim compensation for damage you suffer due to unlawful processing.

Where the GDPR applies to you, you also have the right to restrict processing, to data portability, to object to processing based on our legitimate interests, to withdraw your consent at any time where processing is based on consent, and to lodge a complaint with the data protection supervisory authority in the country where you live or work.

You can send your requests regarding your rights as a signed written application marked “KVKK Başvurusu” (KVKK application), by hand or by post, to the following address:

Your rights regarding other application methods accepted under the relevant legislation are reserved. Where the GDPR applies to you, you may also send your request by e-mail through the contact details at the bottom of this page.

Your application should include your name, surname, your signature for written applications, your Turkish ID number or, if you are a foreign national, your nationality and passport number or ID number if any, your address for notifications, your e-mail address for notifications if any, your phone and fax numbers, and the subject of your request. You may attach related information and documents to your application.

Using a specific application form is not mandatory. Necessary and proportionate additional information may be requested to verify that the application is yours.

Your application is concluded free of charge as soon as possible, depending on its nature, and within 30 days at the latest (under the GDPR, within one month, which may be extended by two further months for complex requests). If the transaction requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If the application results from an error by the Business, the fee charged is refunded.

• Partner programme application: company name, full name, phone, city, the products you sell and your note; processed to assess your application and contact you (legal basis: steps prior to a contract, KVKK Art. 5/2-c, GDPR Art. 6(1)(b)). For a quotation request that arrives through a partner’s link, only that partner’s short code is added to the request.
• Quotation form: product, quantity, delivery details, your contact details and, if you choose, the logo or design file you upload; when you accept a quotation or approve a design: your name, decision, IP address and browser information.
• Review section: the rating you give and, if you choose, your comments, name or company name and contact details. Your comments are passed on only to our management; only the average rating (without comments or names) is published on the website.
• To prevent misuse and repeated submissions, we process an irreversible hash of your IP address and the technical server logs of the website.
• To understand how the website is used, we run a cookie-free, anonymous usage measurement (pages opened, steps of the quotation form, buttons used, which website or ad you arrived from — only the site’s name, e.g. Google — and the approximate location (country, province / city); with a random visit identifier that is deleted when the tab closes). This measurement does not process your IP address, name or contact details; details are in our Cookie Policy.
• The logo preview in the quotation form and on the See Your Logo page runs on your device: your logo is sent to us only if you request a quotation.
• The servers of the providers of our website hosting, database and its encrypted backup, file storage, e-mail and artificial intelligence services (document reading, pre-press checks of design files and order-tracking summaries) are located outside Türkiye; the information you send through the website and your order details (company name, job title, quantity, dates and stage) are processed abroad to the extent these services require. Design and proof files may be sent to the AI service for pre-press checks together with the information they contain; your phone number, e-mail address and contact person's name are not sent to the AI service for order-tracking summaries.
• For our export work, contact details of companies that are not yet our customers may be obtained from publicly available sources such as trade fairs and industry directories.
• The personal showroom link our sales team sends you shows your company name, contact name and logo; we record when and how many times the link is opened (without your IP address). You can ask us to disable the link at any time.
• When you decide on each product of a set proof, we record your name, your decision, your IP address and browser information. For the products you approve, a product image is prepared with your logo and shown on your order tracking page and in your personal showroom link. The image is shared on our social media accounts only if you tick the permission box on the tracking page (your explicit consent; KVKK Art. 5/1, GDPR Art. 6(1)(a)); we record when the permission was given and from which IP address, and you can withdraw it at any time on the same page.
• We may send our existing customers information about our products before the season; if you tell us you do not want these messages, we will not send them to you again.
• When we send a quotation you requested via WhatsApp Business (Meta), your phone number, your name or company name, the quotation number and the quotation link are transferred to Meta; the sent / delivered / read status of the message and your replies to us are recorded. At most one reminder is sent for an unread quotation; if you reply “STOP”, no further automatic messages are sent to you.
• The text you type into the website’s AI assistant (Gepako AI) is sent to our AI provider abroad (Anthropic) to generate the answer and is not stored by us; only the number of calls and the length of the processed text are recorded. We recommend that you do not enter your name, phone number or other personal data in the assistant; the assistant does not ask you for personal data.
• Messages you send us on WhatsApp are translated into Turkish so that our team can read them, and our team’s Turkish reply is translated into your language. For the translation only the message text (without your name or number) is sent to our AI provider abroad (Anthropic) and is not stored there; your message, its translation and our reply are kept in our WhatsApp correspondence record. We recommend that you do not include personal data in your messages.
• To measure the results of our Google Ads campaigns, Google’s conversion cookie runs only if you consent in the cookie banner; submitting the quotation form, opening WhatsApp, starting a GepaGO plan and requesting a quotation from the calculator are then reported to Google as a “conversion”. When you submit the quotation form, your e-mail address and phone number are one-way hashed in your browser (SHA-256; the plain values are not sent) and passed to Google (enhanced conversions); if you arrived by clicking a Google ad, Google’s click identifier (GCLID) is stored with your request and reported to Google Ads with that identifier and the amount of the quotation you accepted if the request becomes a sale; your request code is also passed on so the same request is not counted twice. Your name and the request content are not sent. With your consent Google records that you visited our site and may show you our ads again on Google (remarketing) (legal basis: your explicit consent, KVKK Art. 5/1 and Art. 9 for the transfer abroad, GDPR Art. 6(1)(a)). Without consent no Google script is loaded; you can withdraw consent by clearing your browser data for this site.
• When you message us on WhatsApp, WhatsApp’s own privacy terms also apply. Cookies and similar technologies used on the website are explained in our Cookie Policy.