Global B2B Marketplace for Industrial & Construction Spare Parts
Register

Personal Data Protection Notice (KVKK)

Version 2 · Effective 22 October 2026

This Personal Data Protection Notice (“Notice”) explains how Ayda Cavuldar (SubmitParts Business), operating SubmitParts (“SubmitParts”, “we”, “us”, or “our”), processes personal data in connection with submitparts.com, associated SubmitParts digital services and, where made available, official SubmitParts mobile applications.

This Notice is intended primarily to provide information concerning personal-data processing under Türkiye's Law on the Protection of Personal Data No. 6698 (“KVKK”) and related applicable legislation.

Where other data-protection legislation applies, including the General Data Protection Regulation (“GDPR”), additional information concerning SubmitParts' processing activities and privacy rights is provided in the Privacy Policy.

This Notice should therefore be read together with the SubmitParts Privacy Policy and Cookie Policy.

1. DATA CONTROLLER

For personal-data processing subject to KVKK, the data controller is:

Ayda Cavuldar (SubmitParts Business)
Operating as: SubmitParts
Website: submitparts.com
Privacy enquiries: privacy@submitparts.com
General enquiries: info@submitparts.com

2. CATEGORIES OF PERSONAL DATA

Depending on how you interact with SubmitParts and which Platform functionality you use, the following categories of personal data may be processed.

2.1 Identity and Contact Information

This may include:

  • name and surname;
  • business email address;
  • telephone number;
  • job title or business role;
  • account identifiers; and
  • other contact information provided to SubmitParts.

2.2 Business and Organisation Information

This may include:

  • company or trading name;
  • business address;
  • country of operation;
  • company registration information;
  • tax or VAT information;
  • business type;
  • business website; and
  • other information provided for business or account administration.

2.3 Account and Authentication Information

This may include:

  • account email address;
  • securely stored authentication credentials;
  • account role and capabilities;
  • account status;
  • email-verification information;
  • session information;
  • login records;
  • password-reset activity; and
  • account-security information.

2.4 Technical and Security Information

This may include:

  • IP address;
  • browser information;
  • device or operating-system information;
  • User-Agent information;
  • session and access information;
  • login timestamps;
  • failed authentication attempts;
  • security events;
  • fraud-prevention information; and
  • administrative or security audit records.

2.5 RFQ Information

Information submitted in connection with a Request for Quotation (“RFQ”) may include:

  • equipment or vehicle information;
  • manufacturer or brand;
  • model;
  • serial or identification information;
  • part numbers;
  • part descriptions;
  • quantities;
  • preferred condition;
  • destination information;
  • photographs;
  • drawings;
  • attachments; and
  • other information provided with the RFQ.

2.6 Quotation Information

Supplier quotations may contain:

  • quoted parts;
  • quantities;
  • prices;
  • currencies;
  • part condition;
  • availability;
  • lead or dispatch information;
  • shipping information;
  • quotation validity;
  • commercial terms; and
  • other Supplier-provided information.

2.7 Deal and Communication Information

Where Platform functionality is used to create or administer a Deal, SubmitParts may process:

  • Buyer and Supplier information;
  • accepted quotation information;
  • parts and quantities;
  • quoted prices;
  • Deal status;
  • relevant timestamps;
  • Deal Room communications; and
  • other information associated with the Platform transaction record.

2.8 Ratings, Reviews and Support Information

This may include:

  • ratings;
  • reviews;
  • reports;
  • feedback;
  • support requests;
  • complaints; and
  • communications with SubmitParts.

2.9 Membership and Extra Credit Information

Where paid SubmitParts digital services are used, information may include:

  • Membership Plan;
  • membership status;
  • activation and expiry dates;
  • Platform allowances;
  • Extra Credit purchases and usage;
  • transaction references;
  • payment status;
  • amount;
  • currency; and
  • related account records.

2.10 Payment-Related Information

Depending on the payment method used, SubmitParts may process information such as:

  • payment status;
  • payment-provider transaction identifier;
  • bank or payment reference;
  • payment amount;
  • currency;
  • transaction date; and
  • information required to reconcile a payment with a SubmitParts account or purchase.

Where card payments are processed directly by an external payment provider, SubmitParts does not intend to store complete payment-card numbers or card security codes.

2.11 Uploaded Content

Information contained in files voluntarily submitted through Platform functionality may also be processed.

This may include:

  • photographs;
  • documents;
  • drawings;
  • technical files;
  • RFQ attachments;
  • quotation attachments; and
  • other uploaded content.

Users should avoid including unnecessary personal data or sensitive information in uploaded material.

3. PURPOSES OF PROCESSING PERSONAL DATA

Personal data may be processed for purposes including:

  • creating and administering User accounts;
  • verifying accounts;
  • authenticating Users;
  • providing RFQ functionality;
  • providing quotation functionality;
  • creating and administering Deal records;
  • enabling Platform communications;
  • providing Membership services;
  • administering Extra Credits;
  • processing and verifying payments made to SubmitParts for digital Platform services;
  • sending service notifications and alerts;
  • providing customer and account support;
  • maintaining Platform security;
  • preventing fraud, spam and abuse;
  • detecting unauthorised account access;
  • maintaining security and audit records;
  • resolving technical problems;
  • administering ratings, reviews and reports;
  • enforcing applicable Platform agreements;
  • resolving disputes;
  • establishing, exercising or defending legal rights;
  • fulfilling accounting and tax obligations;
  • complying with legal and regulatory requirements; and
  • improving and administering Platform functionality where lawfully permitted.

4. METHODS OF COLLECTION

Personal data may be collected electronically through channels including:

  • account registration and account-management forms;
  • RFQ forms;
  • quotation forms;
  • Deal and communication functionality;
  • Membership and Extra Credit purchase processes;
  • payment providers or banks;
  • support communications;
  • ratings, reviews and reports;
  • cookies and similar technologies;
  • security and authentication systems;
  • server and application logs; and
  • official SubmitParts mobile applications where made available.

Personal data may be provided directly by the relevant person, generated through use of the Platform, received from another Platform User as part of an RFQ or Deal interaction, or received from an authorised service provider where necessary to provide the relevant service.

5. LEGAL GROUNDS FOR PROCESSING

Personal data is processed in accordance with the legal grounds available under KVKK and other applicable legislation.

Depending on the relevant processing activity, personal data may be processed where:

  • processing is expressly provided for by law;
  • processing is necessary for the establishment or performance of a contract;
  • processing is necessary for SubmitParts to fulfil a legal obligation;
  • processing is necessary for the establishment, exercise or protection of a right;
  • processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the relevant person are not harmed;
  • the relevant data has been made public by the data subject in circumstances recognised by applicable law;
  • explicit consent has been obtained where required; or
  • another lawful processing condition available under applicable legislation applies.

SubmitParts does not rely on explicit consent where another appropriate legal ground applies merely for the purpose of presenting all processing as consent-based.

Where explicit consent is legally required, it will be requested separately or through an appropriate consent mechanism.

6. TRANSFER AND DISCLOSURE OF PERSONAL DATA

Personal data may be transferred or disclosed where necessary for the purposes described in this Notice and where permitted by applicable law.

Recipients may include the categories described below.

6.1 Other Platform Users

Certain information may be shared between Requesters, Buyers and Suppliers where necessary to provide Platform functionality.

For example:

  • RFQ information may be made available to eligible Suppliers;
  • Supplier quotation information may be made available to the relevant Requester; and
  • relevant Buyer and Supplier information may become available following quotation acceptance or at another stage permitted by Platform functionality.

6.2 Service Providers

Personal data may be processed by providers supporting services such as:

  • hosting and infrastructure;
  • cybersecurity;
  • bot and fraud prevention;
  • email and communications;
  • payment processing;
  • banking;
  • technical support; and
  • other Platform infrastructure.

6.3 Professional Advisers

Where reasonably necessary, information may be disclosed to professional advisers such as:

  • lawyers;
  • accountants;
  • auditors;
  • insurers; or
  • consultants.

6.4 Public Authorities

Personal data may be disclosed to courts, regulatory bodies, law-enforcement authorities or other competent public authorities where required or permitted by applicable law.

7. INTERNATIONAL TRANSFERS

Because SubmitParts operates an international B2B Platform and may use international service providers or infrastructure, personal data may in certain circumstances be transferred outside Türkiye.

Where KVKK or other applicable law imposes requirements on an international transfer, SubmitParts will use an applicable lawful transfer basis, safeguard, agreement, consent mechanism where legally appropriate, or other transfer method recognised by the relevant legislation.

The appropriate mechanism may depend on:

  • the destination country;
  • the recipient;
  • the nature of the information;
  • the service involved; and
  • the law applicable at the time of transfer.

Further information concerning international processing is provided in the Privacy Policy.

8. COOKIES AND SIMILAR TECHNOLOGIES

SubmitParts may use cookies, local storage and similar technologies for purposes such as:

  • authentication;
  • session management;
  • Platform security;
  • fraud prevention;
  • User preferences;
  • privacy preferences; and
  • where enabled and lawfully permitted, analytics or advertising.

Non-essential technologies will be subject to applicable consent or privacy requirements.

Further information is provided in the Cookie Policy.

9. MOBILE APPLICATIONS

SubmitParts services may be made available through official mobile applications.

Where a mobile application is offered, the personal data processed will depend on the functionality actually provided by that application.

Mobile applications may process information necessary for:

  • authentication;
  • account functionality;
  • security;
  • Platform communications; and
  • functionality selected by the User.

Additional device features or technologies may be used where supported by the relevant application.

Where device permission, explicit consent or another privacy mechanism is required by applicable law or the applicable mobile operating system, the appropriate mechanism will be used.

SubmitParts will update applicable privacy disclosures where materially different mobile data-processing functionality is introduced.

10. DATA RETENTION

Personal data is retained for no longer than reasonably necessary for the purposes for which it was collected, subject to applicable:

  • legal requirements;
  • accounting requirements;
  • tax obligations;
  • security requirements;
  • fraud-prevention requirements;
  • contractual obligations;
  • limitation periods; and
  • dispute or legal-claim requirements.

Different categories of personal data may therefore have different retention periods.

Where information is no longer required, it may be deleted, anonymised, restricted or otherwise handled in accordance with applicable law and the technical and legal requirements applicable to the relevant record.

Account closure does not necessarily require immediate deletion of RFQ, quotation, Deal, payment, tax, security or other records that SubmitParts is legally entitled or required to retain.

11. DATA SECURITY

SubmitParts uses reasonable technical and organisational measures designed to protect personal data against:

  • unauthorised access;
  • unlawful disclosure;
  • accidental loss;
  • alteration;
  • misuse; and
  • destruction.

Measures may include, where appropriate:

  • authentication controls;
  • access restrictions;
  • password protection;
  • security logging;
  • encrypted network communications;
  • account verification;
  • bot and abuse prevention; and
  • administrative access controls.

No internet-based system can guarantee absolute security.

Users are also responsible for protecting their account credentials and for notifying SubmitParts if unauthorised account activity is suspected.

12. RIGHTS OF RELEVANT PERSONS

Subject to the conditions and limitations of applicable law, persons whose personal data is processed may have rights concerning their personal data.

Under KVKK, applicable rights may include rights concerning:

  • learning whether personal data is being processed;
  • requesting information where personal data has been processed;
  • learning the purpose of processing and whether data is used in accordance with that purpose;
  • learning the third parties to whom personal data is transferred domestically or internationally;
  • requesting correction where personal data is incomplete or inaccurate;
  • requesting deletion or destruction where the applicable legal conditions are satisfied;
  • requesting notification of applicable correction, deletion or destruction operations to relevant third parties where required;
  • objecting to a result arising against the person through analysis of processed data exclusively by automated systems; and
  • requesting compensation where damage is suffered because personal data has been processed unlawfully.

Additional rights may apply under other data-protection laws where applicable.

13. EXERCISING PRIVACY RIGHTS

Requests concerning personal data may be submitted to:

privacy@submitparts.com

or through another request method made available by SubmitParts in accordance with applicable law.

A request should provide sufficient information to identify:

  • the person making the request;
  • the relevant SubmitParts account or records; and
  • the right or request being exercised.

SubmitParts may request additional information where reasonably necessary to verify identity, authority or the scope of the request.

Requests will be handled in accordance with applicable legal procedures and time limits.

For security reasons, Users should not send passwords, complete payment-card numbers or unnecessary sensitive credentials when submitting a privacy request.

14. AUTOMATED DECISION-MAKING

SubmitParts may use automated tools for operational purposes such as:

  • security;
  • fraud detection;
  • spam prevention;
  • bot mitigation;
  • account protection; or
  • Platform administration.

SubmitParts does not intend to rely solely on automated processing to make decisions producing legal or similarly significant effects on Users unless such processing is lawfully implemented and the disclosures and safeguards required by applicable law are provided.

15. CHILDREN

SubmitParts is a B2B Platform intended for adults and business users.

The Platform is not directed to children, and Users must satisfy the eligibility requirements specified in the Terms & Conditions.

SubmitParts does not knowingly provide Requester or Supplier accounts to children.

Where SubmitParts becomes aware that personal data has been processed contrary to applicable age requirements, appropriate steps may be taken in accordance with applicable law.

16. RELATIONSHIP WITH THE PRIVACY POLICY

This Notice provides information particularly relevant to processing subject to KVKK.

The broader SubmitParts Privacy Policy provides additional information concerning:

  • categories of personal data;
  • processing purposes;
  • service providers;
  • payment information;
  • cookies;
  • advertising;
  • international transfers;
  • data retention;
  • security;
  • privacy rights; and
  • other international data-protection requirements.

This Notice and the Privacy Policy should be read together.

If a mandatory provision of applicable data-protection law conflicts with either document, the mandatory legal requirement will apply.

17. CHANGES TO THIS NOTICE

SubmitParts may update this Notice from time to time to reflect changes in:

  • Platform functionality;
  • personal-data processing;
  • service providers;
  • legal requirements;
  • mobile applications; or
  • business operations.

Each published version may have a version identifier and effective date.

Where applicable law requires additional notice, consent or another action because of a material change, SubmitParts will take the appropriate steps before the relevant processing occurs.

18. CONTACT INFORMATION

For questions or requests concerning personal-data processing:

SubmitParts
Ayda Cavuldar (SubmitParts Business)
Website: submitparts.com
Privacy enquiries: info@submitparts.com
General enquiries: info@submitparts.com