Privacy Policy
Last updated: September 21, 2026
This Privacy Policy explains how Hobiex Otomotiv A.Ş. (“Hobiex”, “we”) processes personal data on the Hobiex B2B portal at b2b.hobiex.com (the “Portal”). It is written to meet the EU General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Turkish-law specifics are also set out in our KVKK Information Notice, and cookies are covered in our Cookie Policy.
The Portal is a business-to-business service for automotive parts. The people whose data we process are mainly the contact persons and users of our business customers, people applying for a customer account, and visitors to the public catalogue.
1. Who is responsible for your data
The controller of your personal data is:
- Company
- Hobiex Otomotiv A.Ş.
- Address
- Ortaköy Mah. İlter Blv. No:25B, 34570 Silivri / İstanbul, Türkiye
- Tax office / Tax ID
- [TBD: Vergi Dairesi / Tax Office] / 4631056472
- Trade registry no.
- 444760
- MERSIS no.
- [TBD: MERSIS No]
- KEP (registered e-mail)
- [TBD: KEP adresi / KEP address]
- hobi@hobiex.com
- Privacy contact
- [TBD: e.g. kvkk@hobiex.com]
- Phone
- +90 212 734 37 31
EU representative (Art. 27 GDPR): [TBD: EU representative under Art. 27 GDPR]
2. What data we process and where it comes from
- Registration data you give us: company name, contact person name, country, city, address, postal code, tax number, e-mail address, phone number and a password (stored only as a one-way hash).
- Account and customer data: customer number, user names and e-mail addresses of your company’s users, account settings, and the commercial terms that apply to your company (price lists, customer-specific prices, visibility settings).
- Order and transaction data: carts, orders and order lines, delivery addresses, order notes, order confirmations, invoices, credit notes, shipments and account statements. Most of this comes from our ERP system, where your company is recorded as our customer.
- Documents you upload: purchase orders or lists you upload to the bulk order tool, which may contain names or other details of your staff.
- Chat assistant data: the messages you type into the chat assistant and its answers, together with a random conversation ID, your country and, if you are signed in, your customer number and company name.
- Technical and security data: IP address, browser and device information, sign-in events and error logs, processed by us and our hosting providers to deliver and protect the Portal.
- Usage data (only with your consent): products viewed, searches made and items added to the cart, recorded per day together with your country and, if you are signed in, your customer number; and anonymised page-view statistics from Vercel Web Analytics. See the Cookie Policy.
Registration fields marked as required are needed to assess your application and open an account. Without them we cannot provide the Portal to your company. We do not intentionally collect special categories of personal data and ask you not to submit any.
3. Why we process it and on what legal basis
| Purpose | GDPR legal basis | KVKK legal basis |
|---|---|---|
| Assessing registration applications, verifying your e-mail address, creating and managing user accounts | Art. 6(1)(b) steps prior to and performance of a contract | Art. 5(2)(c) establishment and performance of a contract |
| Showing your prices, stock and conditions; taking, confirming, delivering and invoicing orders; shipment tracking and account statements | Art. 6(1)(b) performance of a contract | Art. 5(2)(c) performance of a contract |
| Keeping commercial books, invoices and tax records; responding to lawful requests from authorities | Art. 6(1)(c) legal obligation | Art. 5(2)(ç) legal obligation |
| Securing the Portal: authentication, access control, fraud and abuse prevention, logging and troubleshooting | Art. 6(1)(f) legitimate interest in a secure service | Art. 5(2)(f) legitimate interest |
| Answering your questions through the chat assistant and reviewing conversations to improve its answers | Art. 6(1)(b) and (f) legitimate interest in customer support | Art. 5(2)(c) and (f) |
| Reading uploaded bulk order documents to fill in your order | Art. 6(1)(b) performance of a contract | Art. 5(2)(c) performance of a contract |
| Measuring product views, searches and traffic to improve our range and the Portal | Art. 6(1)(a) consent | Art. 5(1) explicit consent |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) legitimate interest | Art. 5(2)(e) establishment, exercise or protection of a right |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 9). We do not use your data for decisions based solely on automated processing that produce legal or similarly significant effects, and we do not sell personal data.
4. The chat assistant
The chat assistant is an AI system that answers questions about our products and your account. Its answers are generated automatically, may contain mistakes and are not binding offers or confirmations. Messages are sent to Google’s Gemini API to generate the answer and are stored by us so conversations can be reviewed. Please do not enter personal data that is not needed for your question.
5. Who receives your data
Only Hobiex staff who need it for the purposes above can access your data. We also use the following service providers, who process data on our behalf and under our instructions:
| Provider | Service | Location |
|---|---|---|
| Vercel Inc. | Hosting, content delivery, Web Analytics | USA and EU |
| Neon | Database hosting (on Amazon Web Services) | USA |
| Railway | Hosting of the order integration with our ERP system | USA |
| Resend | Sending account and order e-mails | USA |
| Google LLC | Gemini API for the chat assistant and product search | USA |
| OpenAI | Reading uploaded bulk order documents | USA |
| bunny.net (BunnyWay d.o.o.) | Delivery of product images | EU (Slovenia) |
We also share data where needed with cargo and logistics companies delivering your orders, banks, auditors and legal advisers, and with courts and public authorities when required by law.
6. International transfers
Hobiex is established in Türkiye. If you are in the EU/EEA, your data is transferred to Türkiye and, through the providers above, to the USA. Neither country has an EU adequacy decision covering all these transfers. We rely on the EU Standard Contractual Clauses or, where the recipient is certified, the EU–US Data Privacy Framework. For transfers out of Türkiye we rely on the safeguards in Article 9 of the KVKK, including the standard contracts published by the Turkish Personal Data Protection Board. You can ask us for a copy of the relevant safeguards.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Customer account, order, invoice and transaction records | For the duration of the business relationship and 10 years after it ends (Turkish Commercial Code and tax law) |
| Registration applications that are not approved or not verified | 1 year after the last action on the application |
| Chat assistant conversations | 1 year |
| Usage data collected with your consent | 2 years |
| Sign-in session | 24 hours |
| Hosting and security logs | According to our hosting providers’ retention settings, generally no more than 30 days |
When a retention period ends we delete, destroy or anonymise the data, unless a longer period is required by law or needed to defend a legal claim.
8. Security
We protect your data with encrypted connections (HTTPS), one-way hashing of passwords, e-mail verification, role-based access control and restricted staff access. No system is completely secure. If you suspect misuse of your account, contact us immediately.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw your consent at any time via “Cookie settings” at the bottom of every page, without affecting processing carried out before the withdrawal (Art. 7(3));
- lodge a complaint with the data protection supervisory authority of the EU/EEA country where you live, work or where the alleged infringement took place (Art. 77).
Your rights under Turkish law are described in the KVKK Information Notice. To exercise any of your rights, write to [TBD: e.g. kvkk@hobiex.com] or to our address above. We may ask you to confirm your identity and will reply within one month (GDPR) or 30 days (KVKK).
10. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. We will inform registered users of material changes by e-mail or on the Portal.