KÂR KATILIM ALTIN RAFİNERİSİ A.Ş.
PRIVACY POLICY
Version: 1.1 | Last updated: 5 October 2026
Effective date: 5 October 2026
General information on the corporate website
KÂR Katılım Altın Rafinerisi A.Ş. (the “Company”) provides general information in this Policy on how your personal data are processed when you visit its corporate website at www.karkatilimaltinrafinerisi.com (the “Site”) or contact us through the Site. The Site is used for corporate presentation, information about products and services, communication and the receipt of applications and requests. The “Buy” link on product pages directs visitors to the website of a separate company, KÂRGOLD Kuyumculuk Kıymetli Madenler İthalat ve İhracat A.Ş., for online shopping. When you use this link, you leave the Site; the purchase transaction is handled by KÂRGOLD Kuyumculuk Kıymetli Madenler İthalat ve İhracat A.Ş. The personal data you provide during the purchasing process are processed by KÂRGOLD Kuyumculuk Kıymetli Madenler İthalat ve İhracat A.Ş. as an independent data controller, under its own privacy policy and personal data protection notice. The Company is not responsible for the data processing activities carried out on the website of KÂRGOLD Kuyumculuk Kıymetli Madenler İthalat ve İhracat A.Ş. Information about those activities and the channels for exercising your rights is available in the privacy policy and personal data protection notice published on the website of KÂRGOLD Kuyumculuk Kıymetli Madenler İthalat ve İhracat A.Ş. Bulk purchase requests submitted through the “Purchase Request” form, together with the selected product and contact details, are sent directly to the Company by email. No payments are collected on the refinery’s Site; submitting a request does not, by itself, constitute an order or a sale.
This Policy does not replace the detailed notices concerning the obligation to inform under Law No. 6698 on the Protection of Personal Data (“KVKK”). Processing activities concerning customers, prospective customers, suppliers, business partners and their representatives are explained separately in the Personal Data Protection Notice; activities concerning job applicants are explained in the Job Applicant Personal Data Protection Notice; and cookies are explained in the relevant Cookie Personal Data Protection Notice and Cookie Policy. These notices are published on the Site and can each be accessed through the Site’s footer. At every point where personal data are collected, such as the Purchase Request form, contact form and job application tools, a direct link to the relevant personal data protection notice is provided before the data are submitted. For Site visitors who do not fall within any of these groups, this Policy serves as the notice regarding the processing of Site usage and security information.
1. Data Controller
The data controller is KÂR Katılım Altın Rafinerisi A.Ş., registered with the Istanbul Trade Registry Directorate under trade registry number 1112700 and MERSİS number 0607094460400001. Our registered office address is Yarımburgaz Mah. 1. Cumhuriyet Cad. No: 50/1 Küçükçekmece/İstanbul, Türkiye; our telephone number is +90 (212) 444 6 527; our general contact email address is [email protected]; our email address for personal data requests is [email protected]; and our registered electronic mail (KEP) address is [email protected].
Bulk purchase requests submitted through the Purchase Request form are delivered to [email protected]. Requests concerning personal data sent to this address are also recorded as requests under Article 11 of the KVKK and are handled under the same procedures and within the same time limits as requests sent to [email protected].
2. Information That May Be Processed
Site usage and security information: IP address, date and time of access, device and browser information, connection and system logs, and technical records necessary to maintain security and detect misuse.
Contact and request information: Your first name, surname, organisation and position details, email address, telephone number, the content of your request and response records, as provided when you use contact, information, quotation, job application or similar tools on the Site. In the case of the “Purchase Request” form, the product you select, your first name and surname, the name of the company you represent, if any, your email address, telephone number, requested quantity and message, together with the submission details (the date and time the form was submitted and the IP address from which it was submitted), are sent by email to the Company’s [email protected] address. The form contains no fields other than those listed above.
Business relationship and compliance information: If the communication develops into a customer or supplier relationship, quotations, contracts, transactions, representation and authorisation documents, as well as identification, ultimate beneficial ownership and risk assessment records required by applicable legislation and responsible supply chain processes. Details of these activities are set out in the Company’s Personal Data Protection Notice.
Cookie information: Information relating to cookies used for the operation and security of the Site and to remember users’ preferences. Where non-essential cookies are used, their processing is subject to the information and preference options provided separately.
Please do not submit passwords, payment card details or special categories of personal data that are not necessary for your request through the Site. If such information is sent to us, in accordance with the principle that personal data must be relevant, limited and proportionate to the purposes for which they are processed, as set out in Article 4(2)(ç) of the KVKK, it will not be processed unless a legal basis under Article 6 of the KVKK exists, and it will be deleted or destroyed without delay after it is identified.
3. Purposes of Processing and Legal Bases
Each processing activity is based on an appropriate legal basis under Article 5 and, where necessary, Article 6 of the KVKK. For personal data collected through the Site, the purposes, collection methods and legal bases are matched as follows:
(i) To assess your enquiries and purchase and bulk purchase requests, provide you with quotations and conduct pre-contractual discussions, your identity, contact and request information is collected through the Purchase Request form on the Site and by email, by partially automated means, and processed under Article 5(2)(c) of the KVKK on the legal basis that the processing is directly related to entering into a contract.
(ii) If the request develops into a customer or supplier relationship, your identity, business relationship and compliance information is collected through documents you provide and by email in order to carry out customer and supplier due diligence and supply chain checks required by applicable legislation. This information is processed under Article 5(2)(ç) of the KVKK on the legal basis that the processing is necessary for the data controller to fulfil its legal obligations.
(iii) To operate the Site and ensure its security, transaction security information and essential cookie information are collected automatically during your visit to the Site and processed under Article 5(2)(f) of the KVKK on the legal basis that the processing is necessary for the data controller’s legitimate interests, provided that your fundamental rights and freedoms are not adversely affected.
(iv) To fulfil our legal obligations and protect our rights, the information described above is processed under Articles 5(2)(ç) and 5(2)(e) of the KVKK.
Where explicit consent is required for a processing activity, it is requested separately. Visiting the Site or submitting a purchase request does not, by itself, mean that you have consented to such processing. The matching of purposes, data categories and legal bases for processing activities carried out outside the Site is set out in the relevant personal data protection notices.
4. Sharing of Information
To the extent necessary for the relevant purpose, your personal data may be shared with Site hosting, email, software and information security service providers to operate the Site and ensure its security, on the legal basis of legitimate interests under Article 5(2)(f) of the KVKK, as referred to in Article 8(2). Where required by a request or commercial transaction, your personal data may be shared with the relevant operational, banking and logistics service providers to assess the request and enter into and perform a contract, on the legal basis of entering into or performing a contract under subparagraph (c) of the same paragraph. Your personal data may also be shared with audit and advisory service providers to fulfil legal obligations and establish, exercise or protect rights, on the legal bases under subparagraphs (ç) and (e) of the same paragraph. Information may also be shared with authorised public bodies, regulatory authorities and judicial authorities pursuant to legal obligations and duly submitted requests. Information is shared with KÂRGOLD, one of our group companies, only where a bulk purchase request needs to be fulfilled through KÂRGOLD. In this case, the identity, contact and request information you provide in the request form is shared to assess the request, provide a quotation and complete the sale. The legal basis for this sharing is Article 5(2)(c) of the KVKK, as referred to in Article 8(2)(a); in other words, the sharing is directly related to entering into or performing a contract. KÂRGOLD processes the data transferred to it as an independent data controller. Other than in this situation, personal data are not transferred to group companies. Data minimisation and restrictions on access permissions are applied when information is shared.
If Site hosting, email (including purchase and bulk purchase requests submitted through the Site or to our info email address), form and analytics services are provided through service providers whose servers are located abroad, the personal data processed within those services are transferred to the country where the relevant provider’s servers are located. Personal data are transferred abroad only in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, subject to an adequacy decision covering the country, sector or international organisation to which the transfer is made; in the absence of an adequacy decision, the provision of an appropriate safeguard, such as a standard contract (provided that it is notified to the Personal Data Protection Board within five working days of signing), binding corporate rules or a written undertaking authorised by the Board; or, if none of these mechanisms can be used, the existence of one of the grounds for occasional transfers specified in the Law. The recipient groups to which data are transferred abroad, the country or region in which the recipients are located, and the mechanism under Article 9 of the KVKK relied upon for each transfer are clearly specified in the applicable personal data protection notice.
5. Cookies and Third Party Links
Essential cookies may be used for the operation and security of the Site. All non-essential cookies, including analytics, personalisation and marketing cookies, remain inactive unless your explicit consent is obtained through the cookie management tool on the Site. Information about these cookies and preference options are provided on your first visit, and you may withdraw your consent at any time through the same tool. Cookie names, purposes and durations are specified in the Cookie Personal Data Protection Notice and Cookie Policy. The Site contains links to third party websites, particularly the Buy link on product pages. Data processing activities carried out on those websites are governed by the relevant third party’s own personal data protection notice and privacy policy. The Company does not transfer personal data to KÂRGOLD through URL parameters, campaign or tracking codes, or shared cookies when redirecting you through the Buy link. Apart from referring page information that your browser may transmit to the destination website as part of its standard operation, the Company does not share any personal data during the redirection. If personal data are transferred during redirection in the future, the categories of data transferred, the purpose of the transfer and the legal basis under Article 8 of the KVKK will be disclosed in advance by updating this Policy.
6. Security and Retention
The Company implements technical and organisational measures appropriate to the nature of the processing activity to prevent unlawful processing of and access to personal data and to ensure their protection. Access to data is restricted according to duties and authorisation. Requests submitted through Site forms and general contact email addresses are managed so that only employees assigned to assess and respond to those requests can access them, and access to these data is logged. Information is retained for the period necessary for the purpose of processing and applicable statutory retention obligations. In this context, requests submitted through the Purchase Request form or by email that do not result in a sale are retained for no more than one year from the date the request is concluded; records relating to requests that result in a sale or contract are retained for ten years under the Turkish Commercial Code No. 6102 and tax legislation; Site access and security logs are retained for the period prescribed by Law No. 5651 and related legislation and, in any event, for no more than two years; and, where job applications are received through the Site, unsuccessful applications are retained for no more than one year from the application date. For data categories for which these periods have not been specified, retention periods are determined in the Data Retention and Disposal Policy by reference to fulfilment of the processing purpose, mandatory statutory retention periods and limitation periods applicable to potential legal claims. Requests held in the info email inbox are also subject to these periods. When the conditions for processing no longer exist, the information is deleted, destroyed or anonymised in accordance with the Data Retention and Disposal Policy and applicable legislation.
7. Your Rights and Requests
Under Article 11 of the KVKK, you have the right to learn whether your personal data are being processed; request information if your personal data have been processed; learn the purpose of processing and whether your personal data are being used in accordance with that purpose; know the third parties to whom your personal data have been transferred within Türkiye or abroad; request rectification of incomplete or inaccurate personal data; request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK; request that rectification, deletion or destruction be notified to third parties to whom your personal data have been transferred; object to a result arising against you through the analysis of your personal data exclusively by automated systems; and claim compensation for damage arising from the unlawful processing of your personal data.
You may submit your request in writing to Yarımburgaz Mah. 1. Cumhuriyet Cad. No: 50/1 Küçükçekmece/İstanbul; from your registered electronic mail (KEP) address to our KEP address at [email protected]; to [email protected] with a secure electronic signature or mobile signature; or to [email protected] from an email address previously provided to the Company and recorded in our system. Requests sent to the Company’s info email address from the email address you used to submit a purchase request, and which is therefore recorded in our system, are also accepted as valid. These requests are forwarded to [email protected], and the thirty-day response period begins on the date the Company receives the request.
8. Updates to the Policy
This Policy is updated when applicable legislation, Site functions or data processing procedures change. The current version takes effect on the date it is published on the Site. The version number, effective date and date of the last update are shown at the beginning of each version of the Policy. Previous versions are archived by the Company for the retention period applicable to personal data processed during the period covered by the relevant version and are provided to data subjects upon request. Material changes affecting data subjects are also announced through a prominent notice on the Site before they take effect. Before a new form, cookie or service is introduced, the relevant personal data protection notices and, where necessary, preference mechanisms are also updated.