Gepako

Privacy Notice

Gepako (Mirza Matbaa) is the controller of the personal data you share with us through gepako.com and in your correspondence with us. This notice explains how we process it in line with the EU General Data Protection Regulation (GDPR), where the GDPR applies to you. As a company established in Türkiye, we also comply with Turkish data protection law (KVKK).

Personal data we process

  • Identity and contact details: name and surname, company name, phone number, e-mail address.
  • Delivery details: country, city and delivery address.
  • Request details: product group, approximate quantity, your notes and any logo or design file you upload.
  • Quotation and order details: the name, option and note you enter when accepting a quotation; your name, decision and comment when approving a design; the date and time of these actions.
  • Invoicing and payment details: tax office and tax number when you place an order; the deposit amount and payment status.
  • Security details: IP address and browser information when you accept a quotation or approve a design; an irreversible hash of your IP address to prevent misuse of logo uploads; technical server logs of the website.

Why we process it and on what legal basis

  • To receive your quotation request, prepare the quotation and send it to you, and to handle your order, design approval, production, shipping, invoicing and payment: necessary to take steps at your request before entering into a contract and to perform the contract (Art. 6(1)(b) GDPR).
  • To contact you by phone, WhatsApp or e-mail about your request or order: performance of the contract and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR).
  • To keep invoices and commercial records: compliance with our legal obligations (Art. 6(1)(c) GDPR).
  • To keep records of your quotation and design approvals, protect our rights in case of a dispute, keep the website secure and prevent misuse: our legitimate interests (Art. 6(1)(f) GDPR).

We may send our customers information about our products before the season, based on our legitimate interest. You can object at any time and we will not send you such messages again. We do not make decisions about you based solely on automated processing.

How we collect it

Your personal data is collected electronically through the quotation form, the quotation acceptance page and the order tracking page on the website, and through WhatsApp, phone and e-mail correspondence. Contact details of companies that are not yet our customers may also be obtained from publicly available sources such as trade fairs and industry directories for our export work.

Who we share it with

  • the IT service providers we use (website hosting, database and file storage, document reading services), which process data on our behalf,
  • the production, printing, shipping and logistics companies we work with, to the extent necessary to produce and deliver your order,
  • public authorities, when required by law.

Our service providers' servers are located outside Türkiye and may be outside the European Economic Area. Where the GDPR requires it, such transfers are made with appropriate safeguards, such as the standard contractual clauses approved by the European Commission. When you message us on WhatsApp, WhatsApp's own privacy terms also apply.

How long we keep it

We keep personal data only for as long as necessary for the purposes above and for the periods required by law (for example, commercial and tax record-keeping obligations). After that, it is deleted or anonymised.

Your rights

Depending on the law that applies to you, you have the right to:

  • access your personal data and receive a copy of it,
  • have inaccurate or incomplete data corrected,
  • have your data erased,
  • restrict the processing of your data,
  • receive your data in a structured, commonly used format (data portability),
  • object to processing based on our legitimate interests, including the season messages,
  • withdraw your consent at any time where processing is based on consent,
  • lodge a complaint with the data protection supervisory authority in the country where you live or work.

How to contact us

To exercise your rights or ask a question about your data, contact us through the channels at the bottom of this page. We will respond free of charge within one month. For complex requests this period may be extended by two further months; we will let you know if so.

Last updated: 25 September 2026Cookie Policy