Data Protection Notice

This notice covers personal data collected through the website at baselinefair.com. The quote form is the only place on the site where personal data is collected; otherwise you do not need an account, a login or any information to browse the site.

If you write to us directly by email, the content of that correspondence and your email address are also processed as personal data. The sections on purpose, legal basis and rights apply to such correspondence as well.

Your personal data is processed, in the capacity of data controller, by BASELINE Dekorasyon Sanayi Ticaret Ltd. Şti., within the scope described below. The company is based in Istanbul.

Legal name

BASELINE Dekorasyon Sanayi Ticaret Ltd. Şti.

Email

[email protected] · [email protected]

Phone

+90 555 187 44 94

When you submit the quote form, the following data is processed. Which fields are required is also marked on the form itself.

Identity and contact

Full name, company name, email address and telephone number. All four are required fields, needed in order to respond to the request.

Project details

Fair name, fair date, stand area in square metres, stand type and budget range. All optional and may be left blank.

Free-text message

The field where you describe your request. Everything you write here is recorded; we recommend not putting personal data into it that is not needed.

Attachment (optional)

You may attach a file such as a hall plan, a logo or an existing design. Accepted formats are PDF, JPG, PNG, WEBP, DWG, DXF and ZIP, up to 25 MB. The file name, size and type are written to the record.

Consent record

To submit the form you must tick the box relating to this notice; the fact that the box was ticked is stored together with the request.

Technical data

A request number, the submission time, the language the form was filled in, browser information (user-agent) and which page the form was sent from (referer). A salted SHA-256 hash of your IP address is also kept — the raw IP address is never stored anywhere.

Your raw IP address is never recorded. As soon as a request arrives, the IP address is combined with a secret salt and turned into a one-way SHA-256 hash; only that hash is stored and used when investigating abuse. It is enough to answer whether two requests came from the same source, and not enough to identify a person.

The form contains a hidden field that human users never see. It exists only to distinguish automated bots; when it is filled in, the request is silently discarded and no data is recorded.

Your personal data is collected by wholly automated means, through the quote form on the website, and is entered by you. The technical data — browser information, referring page, IP hash — is generated by the server during the same request.

The site does not carry out profiling, behavioural advertising tracking, or enrichment of your data from third-party data sources.

• 01Assessing your request, asking about missing information, and sending you a proposal with a price and a schedule.
• 02Sending the automatic acknowledgement email confirming that your request has reached us.
• 03Where an enquiry turns into work: running the contract process, planning production and installation, and keeping in touch with you.
• 04Preventing abuse of the form and automated or repeated submissions, and maintaining information security.
• 05Where you have given consent, aggregate (non-individual) measurement to understand which pages of the site are useful.
• 06Meeting legal obligations and responding to lawful requests from competent public authorities.

Information received through the quote form is not added to a marketing list unless you ask for that; no bulk promotional email is sent from this site.

Processing rests on the following legal bases listed in article 5 of Law 6698.

Law 6698, art. 5/2(c)

Directly related to the conclusion or performance of a contract: the identity, contact and project data in your request are processed so that pre-contractual discussions can take place.

Law 6698, art. 5/2(f)

Legitimate interests of the controller: the IP hash, browser information and submission counter kept to prevent abuse of the form rest on this basis. They are not used for marketing.

Explicit consent (art. 5/1)

Non-essential measurement cookies run only if you accept them. Declining does not prevent you from using the site, and you may withdraw consent at any time.

Law 6698, art. 5/2(ç)

Compliance with a legal obligation: if an enquiry turns into work, the data required by invoicing and commercial bookkeeping legislation is processed on this basis and kept for the period that legislation requires.

Your personal data is not sold, rented, or given to third parties for marketing. Transfers are limited to the service providers needed to make the service work, and to competent public authorities where legislation requires it.

Email processor

The notification email and the automatic acknowledgement are sent through Resend (Plus Five Five, Inc.) where it is configured. In that case the information you entered passes through that provider’s servers as the content of the email. If the provider is not configured, no email is sent at all and the request is only written to storage.

Hosting and infrastructure

The site and the stored requests sit on the servers of a hosting provider. The identity of that provider and the location of its servers will be stated in the final version of this document.

Measurement

If you have accepted cookies, events such as page views and form interactions are sent to a measurement provider. Until you accept, the measurement script is not loaded at all and no event is sent.

Legal obligation

Where legislation requires it, data may be transferred to competent public authorities; in the event of a dispute, to the legal and accountancy advisers engaged by the company.

Transfers abroad: some of the providers above may hold servers outside Turkey. Such transfers are subject to the conditions in article 9 of Law 6698 — an adequacy decision published by the Board, appropriate safeguards, or explicit consent. Which provider sits in which country, and which safeguard is relied on, will be stated provider by provider in the final version of this document.

Your personal data is kept for as long as it is needed for the purpose it was processed for, and until any mandatory retention period required by legislation has expired. Where an enquiry does not turn into work, the request is kept as a record of commercial correspondence; where it does, it is kept for the period required by contract, invoicing and commercial bookkeeping legislation.

Once the period expires the data is deleted, destroyed or anonymised. The final version of this document will state a concrete period for each category of data; the version published today explains the criteria by which that period is set rather than stating a figure.

Site and form traffic travels over an encrypted connection (HTTPS). IP addresses are never stored in raw form, only as salted hashes. The form passes through a rate control that limits repeated submissions from the same source, and uploaded files are restricted by both size and type.

Personal data such as names, emails, phone numbers and IP addresses is not written to server logs; error records contain only technical information and a request number. Access to stored requests is limited to the people who run the quotation process.

As a person whose personal data is processed, article 11 of the Law gives you the following rights:

• 01To learn whether your personal data is being processed.
• 02If it has been processed, to request information about that processing.
• 03To learn the purpose of processing and whether the data is used in line with that purpose.
• 04To know the third parties, inside the country or abroad, to whom your data is transferred.
• 05To request correction where your data has been processed incompletely or inaccurately.
• 06To request erasure or destruction within the conditions set out in article 7 of the Law.
• 07To request that correction, erasure or destruction be notified to the third parties to whom the data was transferred.
• 08To object to an outcome against you that arises from analysis of the data solely by automated means.
• 09To claim compensation where you suffer loss because your data has been processed unlawfully.

You may submit your application in writing, in line with the Communiqué on the Principles and Procedures for Applications to the Data Controller. The quickest route is to write to one of the email addresses below; your application should state your name, information that allows your identity to be verified, the subject of your request, and how you would like to be answered.

Depending on its nature, your application is concluded as soon as possible and within thirty days at the latest, free of charge. Where the process incurs a cost, the fee set out in the Board’s tariff may be charged. If your application is refused, if you find the response inadequate, or if no response is given in time, you retain the right to complain to the Personal Data Protection Board.

This notice is updated when the way the site works, or the legislation behind it, changes. The current version is always published at this address, and where a substantive change is made the effective date is updated with it.