Personal Data Protection Notice

Data controller

Your personal data is processed by EUROLAB in the capacity of data controller as defined in Article 3 of the KVKK. Contact details for the data controller appear in the application section at the end of this text.

Categories of personal data processed

Our services are corporate in nature; we do not aim to collect special categories of personal data. If such data appears in documents you send us, we do not process it beyond what the service requires and we delete it as soon as the legislation permits.

• Identity data: first name, surname and, where necessary, title.
• Contact data: email address, telephone number, company address.
• Customer transaction data: quotation and service requests, sample records, report and certificate requests, correspondence content.
• Transaction security data: log records relating to use of the site and technical data obtained from strictly necessary cookies.
• Other data you provide at your own request: information contained in contracts, technical files and similar documents.

Purposes of processing

• Evaluating quotation requests and carrying out contract processes
• Providing testing, inspection, surveillance, auditing and certification services
• Issuing, recording and enabling verification of reports and certificates
• Responding to contact requests and complaints
• Carrying out invoicing and accounting processes
• Fulfilling obligations arising from legislation and accreditation requirements
• Ensuring information security and the operation of the site

Transfer

Your personal data may be transferred, limited solely to the purposes above and in accordance with the conditions in Articles 8 and 9 of the KVKK: to competent public institutions and organisations, accreditation bodies and auditors where the service requires; to suppliers from whom we receive infrastructure services such as hosting, email and accounting; and to judicial and administrative authorities where a legal obligation requires.

The content of your reports and technical files is not shared with third parties unless otherwise agreed in the contract or required by legislation. Our confidentiality obligation is explained separately on the Confidentiality Principle page in the Corporate section.

Method of collection and legal basis

Your personal data is collected through the quotation and contact forms on our website, email and telephone correspondence, contracts and records created during the service, by partly automated and non-automated means.

Our processing activity rests on the following legal bases in Article 5 of the KVKK: that it is directly related to the conclusion or performance of a contract; that it is necessary for the data controller to fulfil a legal obligation; that processing is necessary for the establishment or protection of a right; and the legitimate interest of the data controller, provided it does not harm the data subject's fundamental rights and freedoms. Where these grounds do not exist, your explicit consent is obtained.

Retention period

Personal data is retained for as long as necessary for the purpose for which it is processed and for the limitation and retention periods prescribed by the relevant legislation. Records relating to the reports and certificates issued are kept for the period required by accreditation requirements in order to ensure the verifiability of the document. On expiry of the period the data is deleted, destroyed or anonymised.

Rights of the data subject

Under Article 11 of the KVKK you have the following rights:

• To learn whether your personal data is being processed and, if so, to request information about it
• To learn the purpose of the processing and whether the data is used in accordance with that purpose
• To know the third parties to whom the data is transferred domestically or abroad
• To request rectification if the data has been processed incompletely or incorrectly
• To request erasure or destruction within the conditions set out in the law
• To request that rectification, erasure and destruction be notified to the third parties to whom the data was transferred
• To object to an outcome to your detriment arising from analysis exclusively by automated systems
• To claim compensation for damage suffered as a result of unlawful processing

Application

You may submit requests relating to your rights in writing, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, or through registered electronic mail, secure electronic signature or the email address registered in our system. Your application must clearly state your name, surname, contact details and the subject of your request.

Depending on its nature, your request is concluded free of charge within thirty days at the latest. Where the process entails a separate cost, the fee in the tariff set by the Board may be charged. If your application is refused or no response is given within the period, your right to complain to the Personal Data Protection Board is reserved.