Privacy Policy

1. Who we are

KOG Strategic Partners Limited ("KOG Group", "we", "us") is a procurement and sourcing company in Istanbul. We are the data controller under the EU and UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

• Address: Nejat Eczacıbaşı Binası, Sadi Konuralp Caddesi, Şişhane Sk. No:5 Kat:2, 34433 Beyoğlu, İstanbul, Türkiye
• Email: info@kog-group.com
• Phone: +90 545 606 7377
• Tax office and number: Beyoğlu, 2111329332

This policy is also our information notice under KVKK Article 10. It covers website visitors and anyone who contacts us, requests a proposal, books a call or subscribes to our newsletter.

2. What data we collect and how

We collect personal data directly from you, through our website and communication channels, partly by automated means. Most of it is business contact data.

• Contact form: name, company, business email, optional phone number and your message.
• Procurement request (RFQ) form: contact details, company, country, products, quantities, budget range, timeline, delivery location and uploaded files such as specifications, drawings and bills of quantities (BOQs).
• Call booking: name, email, company, chosen time, time zone and topic.
• Newsletter: email address and a record of your consent.
• Live chat, WhatsApp, Messenger, email and phone: your messages and the contact details you use.
• Technical data: IP address, browser, device, pages visited, time of visit and referring page, kept in our hosting provider's server logs.
• Analytics data: only if we add analytics tools and you accept them.

Sometimes a colleague or project partner gives us your business contact details.

Uploaded files may contain other people's personal data, such as names or signatures on drawings. Please remove what we do not need, and do not send special categories of data such as health information. Without the required form fields we may not be able to answer you.

3. Why we use your data and our legal bases

We use personal data only for these purposes and on these legal bases (GDPR Article 6, KVKK Article 5):

• Answering enquiries, booking calls, reviewing RFQs and preparing proposals, including asking suppliers for quotes: pre-contract steps and legitimate interest (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Delivering our services and managing client and supplier relationships, including invoicing: contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Sending our newsletter: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) and your approval under Turkish Law No. 6563 on commercial electronic messages. Every email has an unsubscribe link.
• Running and protecting the website, including preventing spam and misuse: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Website analytics, if introduced: your consent only (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Legal obligations, such as tax and commercial records: KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c) where EU or UK law applies, otherwise our legitimate interest in complying with Turkish law.
• Legal claims: GDPR Art. 6(1)(f); KVKK Art. 5(2)(e).

You can object to processing based on legitimate interests at any time. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share data with

We do not sell personal data. We share it only with:

• Our team, as far as their work requires.
• Service providers acting for us: our hosting provider, our form and scheduling service providers, our live chat and newsletter service providers, Google (Google Workspace for email, calendar and documents) and, with your consent, analytics providers. They act only on our instructions and under contract.
• Suppliers, manufacturers, logistics and inspection companies on your project. For quotes we share the technical content of your request, and contact details only when the project needs them.
• Professional advisers bound by confidentiality, such as lawyers and accountants.
• Authorities and courts, when the law requires it or to protect our rights.
• A buyer or successor in a merger, acquisition, reorganisation or sale of assets.

On WhatsApp and Messenger, Meta processes your data as a separate controller under its own terms. Linked third-party websites follow their own privacy policies.

5. International transfers

We are based in Türkiye, so the data you send us is handled in Türkiye. Some service providers, including Google, store data in other countries, such as EU member states and the United States, and project data may go to suppliers abroad.

KVKK Article 9, as amended in 2024: we transfer data abroad only with a legal basis under Article 5 and either an adequacy decision of the Personal Data Protection Board, an appropriate safeguard such as the Board's standard contract notified to the Authority within five business days of signing, or, for occasional transfers, an exception in Article 9(6), for example when the transfer is necessary for a contract with you.

GDPR and UK GDPR: for providers outside the EU or UK we rely on adequacy decisions, such as the EU-US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses with the UK addendum. You can ask us which safeguard applies to a transfer.

6. How long we keep data

We keep personal data only as long as its purpose or the law requires:

• Enquiries, RFQs and call bookings that do not lead to a project: up to 2 years after our last contact.
• Contracts, invoices and project records: 10 years from the end of the year in which they were created, as Turkish commercial and tax law requires.
• Live chat transcripts: up to 12 months, unless they become part of a project.
• Newsletter: until you unsubscribe, then a record of your consent and opt out for 3 years, as Turkish rules on commercial electronic messages require.
• Server and security logs: normally up to 12 months.
• Analytics data, if used: up to 14 months.

After that we delete, destroy or anonymise the data in line with KVKK Article 7.

7. Your rights

Under the GDPR, the UK GDPR and KVKK Article 11 you have the right to:

• learn whether we process your data and get information about it and a copy, including its purpose and recipients in Türkiye or abroad;
• have inaccurate or incomplete data corrected, and have data erased or destroyed under the conditions of the law, including KVKK Article 7;
• have those corrections or erasures passed on to third parties who received your data;
• restrict processing and receive your data in a portable format (GDPR);
• object to processing based on legitimate interests, and to direct marketing at any time;
• object to a result against you that arises only from automated analysis of your data (KVKK);
• withdraw consent at any time, without affecting earlier processing;
• claim compensation for damage caused by unlawful processing;
• complain to a supervisory authority: in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Board (see section 8).

Visitors in the United States: we do not sell your personal information.

8. How to exercise your rights

Email info@kog-group.com or write to our address in section 1, saying who you are and what you are asking for. We may need to confirm your identity.

KVKK applications can be made in writing, from an email address you have already used with us, or by the other methods in the Communiqué on the Principles and Procedures for the Request to Data Controller, such as registered electronic mail (KEP) or a secure electronic or mobile signature.

We reply free of charge: under the KVKK within 30 days (the Board's fee may apply if a request involves extra cost), and under the GDPR within one month, extendable by two months for complex requests.

If we reject your KVKK application, you are not satisfied with our reply, or you receive no reply in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our reply, and in any case within 60 days of your application.

9. Cookies

By default we use only strictly necessary cookies. Optional analytics or advertising tools run only after you accept them, and you can change your choice through the "Cookie settings" link in the footer. See our Cookie Policy.

10. Children

Our website and services are for businesses, not children. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn we have.

11. Security

We use measures suited to the risk, such as encrypted connections (HTTPS), access limited to staff who need it, two-step verification on business accounts and confidentiality duties for our team and providers. Documents sent with a request are treated as confidential business information.

No internet transmission or electronic storage is completely secure. If a data breach is likely to affect you, we will inform you and the competent authorities as the law requires.

12. Changes to this policy

We may update this policy when our services, tools or the law change. The date at the top shows the current version, and we will highlight significant changes on this page.

13. Contact us

Questions about this policy or your data: email info@kog-group.com, call +90 545 606 7377 or use our contact page.