Notice on the processing of personal data

The legal entity below is the data controller for the processing described here.

• Individual customers, owners of an object, or the person delivering it.
• Sole traders, and representatives, employees or contact persons acting for a legal entity.
• People submitting documents or information in the provenance chain, only to the extent necessary.
• Customer portal users.

• Identity: name, surname, representative name, sole trader details.
• Contact: telephone, e-mail, delivery and notification address.
• Customer transaction: TES number, service scope, intake and release records, declarations.
• Provenance: source of acquisition, date, submitted documents and statements.
• Visual and technical: object photographs, microscope images, measurements and test results.
• Consent and signature: scope consents, contract version, signature and one-time code records.
• Transaction security: IP address, session, device, timestamp and audit log.

Object images count as personal data to the extent that they can be linked to an identified person. The service is not designed to process special categories of data, and we do not take unnecessary copies of identity documents.

• Formation and performance of the contract: intake, examination, report, release — necessary for performance of the contract.
• Invoicing and statutory records — legal obligation.
• Chain of custody and disputes — establishment, exercise or defence of a legal claim.
• Portal and system security, audit logging — legitimate interest and data security obligations.
• Public verification record — a separate choice and an appropriate legal basis depending on the nature of the data.
• Reference archive and method development — explicit consent where the data remains personal data.

Refusing consent for purposes that require it does not prevent you from receiving the core examination service. Consent scopes are ticked separately on the examination instruction.

• External laboratory: wherever possible only the TES or sample number; identity data is not shared unless required.
• Shipping and insurance: only the necessary name, address, telephone and object details.
• Financial service providers: data required for invoicing and statutory records.
• Legal counsel or competent authorities: on a lawful request or to protect legal claims.
• IT processors: hosting, backup, security and e-mail services.

Your data is not shared with third parties for marketing purposes and is not sold.

Hosting outside Türkiye

If production infrastructure is hosted abroad, this constitutes a regular international transfer. No personal data is transferred from the production environment before an appropriate transfer mechanism is in place; where there is no adequacy decision the standard contract is used and the authority is notified within the statutory period.

Through physical intake and the intake record, the customer portal, e-mail and telephone, the invoicing system, the examination station, electronic consent records and security logs; in written and electronic form.

Each category is kept for as long as its purpose and legal basis require; we do not assume a single retention period for everything.

• Contracts, intake and release records, critical consents: for the limitation and dispute period, in a restricted archive.
• Invoices and financial records: the mandatory period set by tax legislation.
• Operational correspondence and security logs: a shorter period once the purpose ends.

Deleting the name alone is not anonymisation. It requires irreversibly severing the link so that the person cannot be re-identified, including by matching against other records held by us or by recipients. As long as a source link remains, the data is pseudonymous.

You may withdraw at any time the explicit consent given for the reference archive and method development. From the moment it reaches us, withdrawal stops future processing based on that consent; unless another legal basis applies, source and identifiable derived data are erased, destroyed or anonymised. Consent and image licence are recorded separately; withdrawing one does not automatically end the other.

Examination results may be prepared with AI-assisted analysis; the final published conclusion is reviewed by an expert. Conclusions concern the object and contain no profiling decision about a person.

• To learn whether your personal data is processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether it is used accordingly.
• To know the third parties to whom it is transferred at home or abroad.
• To request rectification where it is incomplete or inaccurate.
• To request erasure or destruction under the statutory conditions, and notification of recipients.
• To object to a decision against you produced solely by automated analysis.
• To claim compensation for damage caused by unlawful processing.

You may submit a request in the statutory form: in writing to the company address, to our registered e-mail address, or from the e-mail address registered in our system to the address below. Requests are answered within the statutory period.

kvkk@tesbihkar.com

This site uses no advertising or tracking cookies. Only the cookies needed to keep your session and remember your language and theme are set. Server logs keep IP address, timestamp and request data for a limited period, for security and troubleshooting.

• Recording and analysis of third-party auction broadcasts.
• Public profiles of living master craftsmen; a master may object via the addresses on this page and the profile is withdrawn on request.
• Future sales, consignment and marketplace activities.