Privacy policy

About this notice

This notice explains how Xingdaotai Limited handles personal data on this website: what the request form collects, what the site stores in your browser, why, for how long, and how you can use your rights.

Xingdaotai Limited is the data controller. Its legal name, address, registration details and the e-mail for data requests are shown in the Data controller block below.

Data controller

Name

Xingdaotai Limited

Address

to be added by the site owner

MERSIS / registration no.

to be added by the site owner

Tax office and number

to be added by the site owner

E-mail for data requests

[email protected]

Data processors

Website hosting

to be added by the site owner

E-mail service

to be added by the site owner

What the request form collects

The form collects your name, e-mail address and message, plus your phone number, company and country if you fill them in. The form marks which fields are required.

With each request the site also stores the address of the page you sent it from, the brand or machine the request is about if you sent it from such a page, your browser's user agent string, the page language, the time of sending and the processing status of the request.

The application does not store your IP address. To limit repeated submissions it keeps a keyed hash (HMAC) of the address, made with a secret key that stays on the server. The hash lets the site recognize repeat submissions; it does not show the address.

If the site owner has turned this on, the site sends an automatic confirmation e-mail to the address you entered.

Why we use it and on what legal basis

We use the request data to answer you, prepare a quote and continue the conversation about the equipment or service you asked about. This is processing at your request and a step before a possible contract: article 5(2)(c) of the Turkish Personal Data Protection Law (KVKK) and article 6(1)(b) of the EU General Data Protection Regulation (GDPR).

The hashed IP address and the security and administration logs protect the forms and the admin area against abuse. This rests on our legitimate interest in keeping the site secure: KVKK article 5(2)(f) and GDPR article 6(1)(f).

The checkbox on the form confirms that you have read this notice. It is not consent, and we do not rely on consent for this processing.

We do not use the data for advertising and do not sell it.

How long we keep it

Requests are kept for 24 months from the date they were received and are then deleted automatically.

Security and administration logs contain the hashed IP address, never the address itself, and are kept for 30 days.

The hosting provider's own web server logs may contain your full IP address. They are kept under the hosting provider's policy.

If a request leads to a contract, the contract documents are kept separately for the periods that accounting and commercial law require.

Language detection on the home page

The first time you open the home address "/", the site may look up your country from your IP address to choose English or Chinese. The IP address is not stored for this. You can change the language at any time with the language switch.

Cookies and browser storage

The site stores only what it needs to work. There are no analytics, advertising or third-party trackers.

Cookie lang keeps the language you chose, for 1 year.

Cookie f1_form protects the request form against forged submissions, for 24 hours.

Cookie f1_admin is set only for site administrators after they sign in, for at most 12 hours.

The localStorage key theme keeps your choice of light or dark theme. It stays in your browser until you clear it.

A form draft in sessionStorage holds the name, e-mail and message you type into the form, so a page reload does not wipe them. It is removed when you close the tab or after the request is sent.

You can delete these items or block cookies in your browser settings. The site will still open, but it will not remember your language or theme, and the request form cannot be sent without the f1_form cookie.

External resources

Pages load no fonts, scripts or images from other servers. The one exception is the map on the Contacts page: it loads from OpenStreetMap only after you click "Show map". Your browser then connects to OpenStreetMap servers, which receive your IP address and handle it under the OpenStreetMap Foundation privacy policy.

Who receives the data

Requests are available to the Xingdaotai Limited staff who handle them. They are stored on the hosting provider's server and delivered to our mailbox through the e-mail provider. Both providers are listed with their countries in the Data processors block, and they process the data only to run the site and deliver messages for us.

We pass data to other parties only where the law requires it.

Transfers to other countries

Xingdaotai Limited is established in Türkiye. Where a provider in the Data processors block is located outside Türkiye, the transfer follows article 9 of KVKK and, for visitors in the European Union, Chapter V of the GDPR. We send only the data needed to answer your request.

Your rights

Under article 11 of KVKK you can learn whether your data is processed and request information about it; learn the purpose of processing and whether the data is used for that purpose; know the third parties in Türkiye or abroad who receive it; ask for incomplete or inaccurate data to be corrected; ask for it to be deleted or destroyed under the conditions of article 7; ask that a correction or deletion be passed on to those third parties; object to a result against you that comes only from automated analysis; and claim compensation for damage caused by unlawful processing.

Under articles 15 to 21 of the GDPR you can ask for access to your data, its correction or erasure, restriction of processing and a copy in a portable format, and you can object to processing based on our legitimate interest.

If you are in China, the Personal Information Protection Law (PIPL) lets you access and copy your personal information, have it corrected or deleted, and withdraw any consent you gave.

You can also complain to a data protection authority, for example the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or the supervisory authority in your EU country.

How to use your rights

Send your request to the e-mail for data requests, or in writing to the legal address, both shown in the Data controller block. Say which right you want to use and how we can reach you. We answer within 30 days.

Changes to this notice

If the way we handle data changes, we update this page and the date at the top.

Questions about your data: [email protected]