Privacy Notice (KVKK)

Data Controller: Nova Orman Ürünleri San. Tic. A.Ş. ("the Company" / "Novawood") Last Updated: 05.06.2026

This Privacy Notice is prepared under Article 10 ("The Data Controller's Obligation to Inform") of the Turkish Personal Data Protection Law No. 6698 (the "Law" / "KVKK") and the related Communiqué, to inform you about the personal data processed by us.

Article 1. Identity of the Data Controller

The Company acts as the Data Controller under the Law in respect of personal data obtained from our employees, job applicants, customers, potential customers, visitors, supplier/consultant/service-provider representatives, and the shareholders and employees/representatives of our affiliates.

You can reach us through the following contact details:

Headquarters: Küçükçamlıca Mah. Bulgurlu Cad. No: 32, 34696 Üsküdar / İstanbul / Türkiye — Phone: +90 (216) 545 66 82
Factory: Gerede Organize Sanayi Bölgesi No: 101-2, Gerede / Bolu / Türkiye — Phone: +90 (374) 311 59 20
E-mail: info@novawood.com
Website: novawood.com

Article 2. Purposes of Processing

Within the scope of your relationship with the Company; your identity data (name, surname, etc.), contact data (e-mail, phone, address, etc.), request/transaction data (message content, requested product/sample, company information), premises-security data (CCTV and visitor records) and cyber-security data (IP address, access logs, etc.) are processed for the following purposes:

Evaluating and resolving your requests, questions, suggestions, complaints and applications,
Conducting sample, quotation and pre/post-sales processes,
Performing our contractual and legal obligations fully and properly,
Planning and executing information-security processes and managing the IT infrastructure,
Following up finance and accounting matters,
Ensuring facility and personnel security,
Conducting domestic and international purchasing, supply, transport, logistics, import and customs operations,
Carrying out human-resources processes and evaluating job applications,
Backing up data to ensure data security.

Article 3. Transfer of Personal Data

Your personal data may be shared, limited to the purposes above and pursuant to Articles 8 and 9 of the Law, with authorized public institutions, courts and enforcement offices, relevant tax offices and banks, our business partners and suppliers, and service providers (e.g. hosting and e-mail service providers).

Our website hosting infrastructure is located within the European Union (Germany); any such cross-border transfers are carried out in accordance with the conditions set out in Article 9 of the Law.

Article 4. Collection Method and Legal Basis

Your personal data is collected during the establishment and continuation of your legal relationship with the Company, through the forms on our website, by phone and e-mail, and in physical, verbal, written or electronic form.

Your data is processed on the basis of one or more of the following lawful grounds set out in Article 5 of the Law:

Being directly related to the conclusion or performance of a contract; enabling the provision of the requested products and services,
Being mandatory for the fulfilment of our legal obligations,
Being mandatory for the establishment, exercise or protection of a right,
Being mandatory for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms,
Your explicit consent in other cases (e.g. commercial electronic messages/marketing).

For processing based on explicit consent, you may withdraw your consent at any time. Withdrawal applies only prospectively and does not affect the lawfulness of prior processing.

Article 5. Your Rights as a Data Subject

Under Article 11 of the Law, you have the right to:

Learn whether your personal data is processed,
Request information if it has been processed,
Learn the purpose of processing and whether it is used in line with that purpose,
Know the third parties to whom it is transferred at home or abroad,
Request correction if it is incomplete or incorrectly processed,
Request erasure or destruction within the framework of Article 7,
Request that correction, erasure or destruction be notified to third parties to whom the data was transferred,
Object to a result against you arising solely from automated analysis,
Claim compensation if you suffer damage due to unlawful processing.

Article 6. How to Apply

You may submit requests regarding the rights above, in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller", by written petition (wet-signed) to our headquarters address stated in Article 1, via a notary, or by e-mail to info@novawood.com from the address you have previously registered with us.

Your application must include your name and surname (and signature, if written), your Turkish ID number (for foreigners, nationality and passport/ID number), your address for notification, your e-mail/phone if any, and the subject of your request.

Your requests will be resolved as soon as possible and within 30 days at the latest. Where a fee tariff is set by the Authority, a fee may be charged at the determined amount.

It is important that the personal data we hold about you is accurate and up to date; please notify us of any changes to your data.