Last updated: 1 September 2026
At Dealti Logistics we take the protection of the personal data of visitors to our website and users of our services seriously. This Privacy and Security Policy explains, primarily under the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"), the purposes for which and the legal grounds on which we process your personal data, with whom we share it, how long we retain it, and how you can exercise your rights. This document also serves to fulfil our duty to inform data subjects under the KVKK.
Your personal data is processed by the following legal entity acting as data controller:
This Policy covers personal data collected through the www.dealtilogistics.com website and its forms, together with data obtained automatically during your visit. Operational data processing relating to customers and business partners with whom we have a contractual relationship is addressed together with the relevant contracts and supplementary information notices.
a. Data you provide (contact and quote forms):
b. Data collected automatically while you use the Site:
Data such as IP addresses, online identifiers and device information are considered personal data under the KVKK and the GDPR and are subject to this Policy.
c. Cookie consent record: When you set your cookie preference, an anonymous identifier, your category choices, the date of the action, browser information (user agent), the status of the browser privacy signal (GPC) and an irreversibly encrypted (hashed) IP value are recorded to meet our legal burden of proof. This record does not directly identify you.
| Purpose of processing | Legal ground under KVKK Art. 5 | Legal ground under GDPR Art. 6 |
|---|---|---|
| Evaluating, preparing and sending quotations; responding to your request | Necessary for the conclusion or performance of a contract (Art. 5/2-c); at your request | Performance of a contract or pre-contractual steps (Art. 6/1-b) |
| Planning and carrying out international transport, customs, transit and delivery processes | Performance of a contract (Art. 5/2-c); compliance with a legal obligation (Art. 5/2-ç) | Performance of a contract (Art. 6/1-b); legal obligation (Art. 6/1-c) |
| Fulfilling accounting, invoicing, tax and commercial bookkeeping obligations | Compliance with a legal obligation (Art. 5/2-ç) | Legal obligation (Art. 6/1-c) |
| Operating the website, session management, site security, prevention of fraud and abuse, form security (Cloudflare Turnstile) | Legitimate interest (Art. 5/2-f) | Legitimate interest (Art. 6/1-f) |
| Measuring site usage on an anonymous and aggregate basis and improving content (Google Analytics cookies) | Explicit consent (Art. 5/1) | Consent (Art. 6/1-a) |
| Keeping and proving the cookie accept/reject record | Legal obligation (Art. 5/2-ç) and legitimate interest (Art. 5/2-f) | Legal obligation (Art. 6/1-c) and legitimate interest (Art. 6/1-f) |
| Handling legal claims, exercising the right of legal defence and responding to requests from competent authorities | Establishment, exercise or protection of a right (Art. 5/2-e); legal obligation (Art. 5/2-ç) | Legitimate interest (Art. 6/1-f); legal obligation (Art. 6/1-c) |
For processing based on explicit consent (analytics cookies and the related transfer abroad), if you do not give consent or you withdraw it, that processing does not take place and the core functions of the Site are not affected.
Your personal data is collected by wholly or partly automated means through the contact and quote forms on our website, e-mail correspondence, and cookies and similar technologies during your visit.
Domestic transfers. Your personal data may be shared, only for the purposes above: with carriers, agents, customs brokers and logistics partners to carry out the transport operation; with public authorities where required by a legal obligation or an official request; and with our accountants, legal advisers and IT service providers. Our website and your form data are hosted on the servers of a hosting provider established in Turkey.
Transfers abroad. Because of the following service providers, some of your data may be transferred to servers located abroad:
Transfers abroad are carried out on the basis of your explicit consent for analytics cookies (KVKK Art. 9) and, in other cases, on the basis of an adequacy decision or appropriate safeguards (undertakings / standard contractual clauses) under KVKK Art. 9. For transfers within the scope of the GDPR, the European Commission standard contractual clauses and supplementary measures are applied.
Your personal data is retained for the period required by the purpose of processing and provided for in the relevant legislation; when the period ends, the data is deleted, destroyed or anonymised.
| Data category | Retention period |
|---|---|
| Contact form messages | 2 years from resolution of the request |
| Quote records and uploaded commercial documents | Where a contract is concluded and an invoice is issued, 10 years under the applicable tax and commercial legislation; where no contract is concluded, 2 years |
| Server and access logs | 1 year |
| Cookie accept/reject record | At most 3 years |
| Google Analytics data | 14 months (Google Analytics retention setting) |
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or misuse, including encryption of transmission (TLS), access authorisation, up-to-date software and regular backups. Although no transmission of data over the internet can be guaranteed to be fully secure, we take due care to reduce the risks to a reasonable level.
Our website uses strictly necessary cookies and, only with your explicit consent, analytics cookies. If you reject analytics cookies, the Google Analytics tags are not loaded at all and no request is sent to Google. For detailed information on the types, durations and management of cookies, please review the Cookie Policy. Your consent or rejection is recorded as described above to meet our legal burden of proof.
Under KVKK Art. 11, by applying to the data controller you have the right to:
Persons within the scope of the GDPR also have the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and withdrawal of consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
You may submit requests relating to your rights, in accordance with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller: in writing to the address above, via the e-mail address registered in our system, or with a secure electronic signature to [email protected]. Your application should include your full name, the subject of your request, and details for contacting you.
Your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature; where the process entails a cost, a fee within the tariff set by the Turkish Personal Data Protection Board may be charged. If your application is rejected or you find the response insufficient, you have the right to lodge a complaint with the Turkish Personal Data Protection Board. Persons within the scope of the GDPR may also lodge a complaint with the data protection authority in their country.
No decision taken solely by automated means that produces legal effects concerning you or similarly significantly affects you is applied on the Site. Analytics measurements are carried out only at an aggregate and statistical level.
Our website and forms are not directed at persons under the age of 18. We do not knowingly collect personal data of persons under 18. If you become aware that such data has been provided to us, please contact us and we will delete it.
Where personal data is unlawfully obtained by others, the matter is notified to the Turkish Personal Data Protection Board and to the affected data subjects within the time and manner provided for in the relevant legislation. Breaches within the scope of the GDPR are notified to the competent authority within 72 hours of becoming aware of them.
This Privacy and Security Policy may be updated in response to legal or operational changes. The current version is always published on this page, with its effective date shown above.
For any questions or requests concerning your personal data: [email protected]
