Privacy Notice and Privacy Policy

Data Controller

The data controller for personal data processed through this website (tmstechnic.com) is TMS Tren Bakım Onarım A.Ş. (TMS Technic). In this notice, "TMS Technic", "we" and "our company" refer to TMS Tren Bakım Onarım A.Ş. Our company is registered with the Ankara Trade Registry under number 357817; our MERSİS number is 0845032003854899. Our head office address is Beştepe Mahallesi 32. Cadde No: 1/61 Moment Beştepe Plaza, Yenimahalle / Ankara - TÜRKİYE. This notice has been prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Principles and Procedures for Fulfilling the Obligation to Inform.

Personal Data Collected and Method of Collection

Your personal data is collected electronically through our website, via the forms you fill in and partly by automated means:

• Contact form: full name, e-mail address, the relevant department and the content of your message.
• Job application: full name, e-mail address, phone number, the position or internship type you apply for and the CV file you upload; for applications without a CV, your profession, experience, city and any note you add.
• Supplier portal: company name, tax and registry details, company e-mail address, phone and address, activity, capacity and certificate information and the documents you upload; contact details of the company representative contained in this information.
• Transaction security data: the IP address kept briefly to protect the forms against abuse; the IP address, browser information and time of visit automatically logged by the hosting service when you visit the site.
• Usage data: only if you consent to analytics, anonymous statistics on which pages are visited.

Purposes of Processing

We process your personal data for the following purposes:

• Evaluating and responding to requests, questions and quotation requests submitted through the contact form
• Evaluating job and internship applications, running recruitment processes and contacting candidates
• Evaluating supplier applications and running supplier registration and procurement processes
• Managing quotation and contract processes for our maintenance, repair and engineering services
• Keeping the website secure and available and running information security processes
• If you consent, improving the website using visit statistics
• Fulfilling legal obligations and responding to requests from competent authorities

Legal Grounds

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:

• Contact and quotation requests: processing is directly related to the conclusion or performance of a contract (Art. 5/2-c) and our legitimate interest in responding to your request (Art. 5/2-f).
• Job applications: processing is directly related to the conclusion of an employment contract (Art. 5/2-c) and our legitimate interest in evaluating your application (Art. 5/2-f). Please do not include special categories of personal data such as health, religion or association membership in your CV.
• Supplier applications: conclusion and performance of a contract (Art. 5/2-c), our legal obligations (Art. 5/2-ç) and our legitimate interest (Art. 5/2-f).
• Website security and hosting logs: our legitimate interest (Art. 5/2-f) and our legal obligations (Art. 5/2-ç).
• Analytics: your explicit consent (Art. 5/1). Measurement only runs if you accept, and you can withdraw your consent at any time.
• Location maps: our legitimate interest in showing the locations of our facilities (Art. 5/2-f).

Transfer of Personal Data

We do not sell or rent your personal data. Within the framework of Articles 8 and 9 of the KVKK, your data is shared only with the following recipients and only for the stated purposes:

• Form data: the information and documents you submit through the contact, job application and supplier forms are forwarded to servers rented on behalf of our company in Turkcell's data centre in Türkiye and managed by our company, stored on these servers and accessed only by the relevant departments (human resources, procurement, administrative affairs).
• Hosting service: the website is published through Vercel Inc., a hosting service provider headquartered in the United States of America. Our servers that process the forms run in a data centre in Frankfurt, Germany (Vercel region: fra1 / eu-central-1); the pages themselves are delivered from the point closest to the visitor through Vercel's global content delivery network. The data transferred abroad in this context are: when you visit the site, your IP address, browser and device information, the page you visit and the time of your visit; when you submit a form, the information in the form and the documents you upload. Form contents are not stored on the server in Frankfurt; after validation they are forwarded directly to our company's servers in Türkiye. The purpose of the transfer is to publish the website, forward the forms to our company and keep the site secure.
• Visit statistics: only if you consent, measured anonymously and without cookies using Vercel Inc.'s Web Analytics tool. For this measurement, the page visited, the page that referred you to the site, the browser and device type and the country are sent to Vercel.
• Maps: the facility maps on the contact page are displayed through Google Maps (Google LLC, USA). When the page is opened, your IP address and browser information are transferred to Google and Google's privacy policy applies.
• Competent authorities: upon request and to the extent required by law, legally authorised public institutions and judicial authorities.
• Legal basis for transfers abroad: under Article 9 of the KVKK, personal data may be transferred abroad to countries with an adequacy decision, by providing one of the appropriate safeguards such as the standard contract announced by the Personal Data Protection Board, or in the exceptional cases listed in the law. The transfer to Vercel Inc. is technically necessary to publish the website and forward the forms to our company; the data is processed on servers in Germany, which is subject to the EU General Data Protection Regulation (GDPR). Vercel's commitments on the protection of personal data are set out in the Data Processing Addendum published by Vercel. The KVKK-specific standard contract process for this transfer will be carried out with Vercel Inc. where necessary. For the transfer in connection with Google Maps, Google LLC's own privacy policy and data processing terms apply; if you do not open the Contact page containing the maps, no data is transferred to Google.
• You can direct your questions and complaints about transfers abroad to our company through the channels listed in the Application Procedure section.

Cookies and Similar Technologies

Our website only uses the cookies and similar technologies listed below. The necessary ones are required for the site to work; analytics only runs if you consent. The maps on the contact page load when the page is opened. You can change your choice at any time via the "Cookie Preferences" link at the bottom of the page and delete cookies in your browser settings.

• NEXT_LOCALE (cookie)

  Type

  First party · Necessary

  Purpose

  Remembers the language you selected (Turkish, English, German).

  Duration

  For the browser session

• cookie_consent (cookie)

  Type

  First party · Necessary

  Purpose

  Remembers your cookie choice (accept or reject).

  Duration

  1 year

• cookie_consent (local storage)

  Type

  First party · Necessary

  Purpose

  Keeps a backup of your cookie choice in your browser.

  Duration

  Until you delete it

• supplier_portal_draft (local storage) and tms-supplier-draft (IndexedDB)

  Type

  First party · Functional

  Purpose

  Keeps the supplier portal form you fill in, your current step and the documents you upload only in your own browser so they are not lost if the page is reloaded; nothing is sent to a server. Deleted once the application is submitted.

  Duration

  Until the application is submitted or you delete it

• Anonymous visit statistics

  Type

  First party · Analytics, consent-based

  Purpose

  Measures anonymously which pages are visited; does not use cookies.

  Duration

  Sets no cookies

• Google Maps

  Type

  Third party · Functional

  Purpose

  Shows the facility maps on the contact page and loads when the page is opened. Google may use its own cookies.

  Duration

  According to Google's cookie policy, between 6 months (e.g. NID, from last use) and 13 months depending on the cookie

Data Security

Data Accuracy and Form Security

To keep the data collected through our forms accurate and up to date and to prevent misuse of the forms, we apply the following technical and administrative measures:

• A form cannot be submitted unless the e-mail address is entered in a valid format (name@domain.extension); in forms that ask for a phone number, the number format is checked. These checks are performed both in your browser and on our server.
• A form cannot be submitted unless the required fields are filled in and you confirm that you have read the privacy notice.
• To prevent automated and bulk submissions, the contact and career forms use a verification code, and at most 5 submissions within 10 minutes are accepted from the same IP address.
• Please only enter information about yourself or the company you are authorised to represent; do not enter third parties' personal data without their knowledge.
• Data that is reported to us or found to be inaccurate or to belong to a third party is corrected or deleted. You can submit such requests through the channels in the Application Procedure section.

Your Rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its erasure or destruction under the conditions of Article 7 of the KVKK; to request that correction, erasure and destruction be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing. How to exercise these rights is explained in the Application section below.

How to Apply

You can submit requests regarding your rights under Article 11 of the KVKK by sending a signed petition including your name, surname, contact details and the subject of your request to our head office address (Beştepe Mahallesi 32. Cadde No: 1/61 Moment Beştepe Plaza, Yenimahalle / Ankara - TÜRKİYE), to our registered e-mail (KEP) address tmstren@hs01.kep.tr, or by e-mail to info@tmstechnic.com. In accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller, your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request; if the process requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board.

Data Retention

We keep personal data only for as long as necessary for the purpose for which it is processed and for the periods required by law; once this period ends, it is erased, destroyed or anonymised.

• Contact form data: 3 years.
• Job applications: 3 years from the date of application.
• Supplier portal applications: 3 years from the date of application.
• Visit and access logs kept by the hosting provider Vercel Inc. (IP address, browser information, time of visit): 1 day.
• Anonymous visit statistics (Vercel Web Analytics): 12 months, the reporting window Vercel specifies for the Pro plan.
• IP address kept to protect the forms: 10 minutes at most.
• Your cookie choice: 1 year.

Contact

For questions about this notice or the processing of your personal data, you can reach us at: