Privacy and Personal Data Protection Policy

# PRIVACY AND PERSONAL DATA PROTECTION POLICY **Last Updated:** August 22, 2026 At Newstones, we attach great importance to the privacy and security of the personal data of our visitors, customers, business partners, and employees. This Privacy and Personal Data Protection Policy explains how personal data is collected, processed, stored, transferred, and protected by Newstones in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other applicable legislation. ## 1. Purpose and Scope This policy covers the principles regarding the processing of personal data obtained through the Newstones website, contact forms, quotation requests, customer communication channels, and other digital or physical communication methods. Our aim is to ensure that personal data is processed securely and in compliance with applicable legislation, while informing data subjects about their rights. ## 2. Data Controller Personal data is processed by Newstones, acting as the data controller within the scope of applicable legislation. Newstones is committed to processing personal data lawfully and fairly, accurately and, where necessary, keeping it up to date, for specific, explicit, and legitimate purposes, and in a manner that is relevant, limited, and proportionate to those purposes. ## 3. Categories of Personal Data Processed Depending on your use of our website, communication with us, or requests for information about our products and services, the following categories of personal data may be processed: **Identity Information:** Name, surname, and, where applicable, position or title within a company. **Contact Information:** Telephone number, email address, postal address, and other contact details. **Customer and Transaction Information:** Quotation requests, product requests, order and sales information, and records of requests and applications. **Transaction Security Information:** IP address, website access records, log records, browser information, and device information. **Communication Information:** Information provided through contact forms, email, telephone, or other communication channels. **Cookie and Usage Information:** Technical information collected through cookies and similar technologies when using our website, where applicable. Newstones does not routinely request or process special categories of personal data that are unrelated to its business activities. ## 4. Methods of Collecting Personal Data Personal data may be collected electronically or physically through the following methods: * Contact and quotation forms available on the website, * Email correspondence, * Telephone communications, * Product and service requests, * Quotation and ordering processes, * Contracts and commercial documents, * Communications conducted through business partners and authorized representatives, * Cookies and similar technologies used on the website. ## 5. Purposes of Processing Personal Data Collected personal data may be processed for the following purposes: * Responding to product and service requests, * Managing customer and prospective customer relationships, * Preparing and submitting quotations, * Managing order and sales processes, * Providing information about products and services, * Responding to communication requests, * Evaluating requests and complaints, * Managing contractual and commercial processes, * Carrying out invoicing and accounting activities, * Ensuring the security of business processes, * Managing website security and technical infrastructure, * Fulfilling legal and regulatory obligations, * Responding to requests from authorized public institutions and authorities, * Improving service quality and customer experience, * Sending commercial electronic communications where required and with the relevant individual's consent. ## 6. Legal Grounds for Processing Personal Data Personal data may be processed based on one or more of the legal grounds specified under applicable data protection legislation, including: * The explicit consent of the data subject, * The processing being directly related to the establishment or performance of a contract, * Compliance with a legal obligation, * The processing being necessary for the establishment, exercise, or protection of a legal right, * The legitimate interests of the data controller, provided that such interests do not prejudice the fundamental rights and freedoms of the data subject, * Circumstances expressly provided for by law. ## 7. Transfer of Personal Data Your personal data may be transferred, only to the extent necessary and in accordance with applicable legislation, to: * Authorized public institutions and organizations, * Courts and other competent judicial authorities, * Financial advisors and accounting service providers, * Legal, financial, and technical consultants, * Website, hosting, software, and IT service providers, * Cargo, logistics, and delivery service providers, * Business partners and service providers, * Other persons and organizations legally authorized to receive such data. Personal data is shared only for purposes and within the scope required by the relevant transfer. ## 8. International Transfer of Personal Data Where it is necessary to transfer your personal data outside Türkiye, Newstones complies with the requirements stipulated under KVKK and applicable legislation. Where international data transfers are carried out, the necessary legal requirements are fulfilled and appropriate technical and administrative security measures are implemented. ## 9. Retention Period of Personal Data Your personal data is retained for the period required for the purposes for which it is processed and in accordance with applicable statutory retention periods. Once the retention period expires or the legal basis for processing ceases to exist, personal data is securely deleted, destroyed, or anonymized in accordance with applicable legislation and Newstones' data retention and destruction procedures. ## 10. Cookies and Website Usage Cookies and similar technologies may be used on our website to ensure its secure, accurate, and efficient operation, improve user experience, and analyze visitor preferences. Essential cookies may be used to provide the basic functions of the website. Analytical, performance, or marketing cookies are used in accordance with applicable legislation and, where required, based on the user's preferences or explicit consent. Users may change their cookie preferences or block cookies through their browser settings. However, disabling certain cookies may affect the proper functioning of some website features. ## 11. Security of Personal Data Newstones takes appropriate technical and administrative measures to prevent unlawful processing or unauthorized access to personal data and to ensure that personal data is stored securely. Where applicable, these measures may include: * Access authorization and control mechanisms, * Secure data storage methods, * Encryption and secure communication protocols, * System and access logging, * Technical security controls, * Confidentiality obligations for authorized personnel, * Data security awareness and training, * Procedures for responding to potential data security incidents. ## 12. Rights of Data Subjects Under Article 11 of KVKK and applicable data protection legislation, data subjects may apply to the data controller and exercise the following rights: * To learn whether their personal data is being processed, * To request information regarding the processing of their personal data, * To learn the purpose of processing and whether the data is used in accordance with that purpose, * To know the third parties to whom personal data is transferred domestically or internationally, * To request correction of incomplete or inaccurately processed personal data, * To request the deletion or destruction of personal data under the conditions stipulated by KVKK, * To request notification of correction, deletion, or destruction to third parties to whom personal data has been transferred, * To object to the occurrence of a result against the data subject arising from the analysis of processed data exclusively through automated systems, * To request compensation for damages arising from unlawful processing of personal data. ## 13. Exercising Data Subject Rights To exercise your rights under KVKK, you may submit a written application to Newstones or use other application methods determined by the Turkish Personal Data Protection Authority. Your application should, where possible, include the following information: * Name and surname, * Turkish ID number for Turkish citizens or passport/identity number for foreign nationals, * Residential or business address for notification purposes, * Email address, telephone number, or fax number for notification purposes, where applicable, * Subject of the request, * Explanations and supporting documents related to the request, if any. Applications will be evaluated and concluded within the statutory periods specified under applicable data protection legislation. If responding to an application requires an additional cost, the relevant fees stipulated by KVKK and applicable regulations may apply. ## 14. Third-Party Websites Our website may contain links to third-party websites or platforms. Newstones is not responsible for the privacy practices or personal data processing activities of third-party websites accessed through such links. Users are advised to review the privacy and personal data protection policies of the relevant third parties. ## 15. Changes to This Privacy Policy Newstones reserves the right to modify or update this Privacy and Personal Data Protection Policy in response to changes in legislation, technological developments, or updates to its business processes. Any updated version of this policy will become effective upon publication on the website. ## 16. Contact For questions regarding the processing of your personal data, this Privacy Policy, or your rights under KVKK, you may contact Newstones through the communication channels provided on our website. **Newstones** **Website:** Newstones official website **Email:** Contact email address provided on the website **Telephone:** Contact telephone number provided on the website This policy has been prepared based on Newstones' activities and current data processing practices. Depending on the forms, cookies, analytics tools, e-commerce systems, CRM platforms, hosting services, or other third-party services actually used by Newstones, this policy may need to be further updated.