Privacy Policy
Last updated: 20 October 2026
istexbul is a B2B platform that connects wholesale buyers with Turkish textile manufacturers. This policy explains what personal data we collect, why, who can see it, where it is stored and what rights you have under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
1. What we collect
Buyers (request for quotation): what you are looking for, quantity, destination country, your name, your e-mail address or WhatsApp number, optionally your company, and a record of your consent (text version and time).
Manufacturers: account e-mail, company profile (name, address, contact person, phone, website, description, logo), product listings and membership status.
Technical data: standard server logs of our hosting provider (IP address, browser, time of request) for security. We currently use no analytics or advertising cookies.
2. Why we use it and on what legal basis
- To publish your request and pass it to manufacturers who make your product — to take steps at your request (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To share your contact details with manufacturers holding a paid membership — your consent, given with the checkbox on the form (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent). You can withdraw it at any time.
- To run manufacturer accounts and memberships — contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To keep the platform secure and prevent abuse — legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
4. Where your data is stored — transfers outside the EU and Türkiye
Our database and file storage run on Google Firebase servers in the United States (us-central region). Your data is therefore transferred outside the European Union and Türkiye.
For the EU we rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses offered by Google. Under KVKK Art. 9, the transfer abroad is based on your explicit consent given on the form and on the applicable safeguards.
5. How long we keep it
- Requests and buyer contact details: 3 years from the date of the request, then deleted or anonymised. Earlier if you withdraw your consent or ask us to delete them.
- Consent records: as long as the data they relate to is kept.
- Manufacturer accounts: while the account exists; deleted within 6 months after it is closed.
- Membership contracts and invoices: 10 years, as required by Turkish commercial and tax law.
- Server logs: up to 30 days.
6. Your rights
Under the GDPR (Art. 15–22) and KVKK (Art. 11) you can ask to access, correct or delete your data, restrict or object to its use, receive it in a portable format, and withdraw your consent at any time — without affecting earlier processing.
You may also complain to your local data protection authority (EU) or to the Turkish Personal Data Protection Authority (KVKK Kurumu).
7. Changes
We will update this page when the policy changes. Requests sent with an earlier consent version keep that version on record.