Privacy
Privacy Notice
This privacy notice has been prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform, in order to inform visitors of the multitransport.com.tr website and users of the forms available on it.
Our website has no membership system, no user accounts, no e-commerce functionality and no database in which visitor data is stored. We do not use advertising or marketing cookies and we do not carry out profiling. Google Analytics 4, which we use for visitor statistics, runs only if you give your explicit consent in the cookie preferences. As described below, personal data is processed through the contact form and the quote request form that you complete voluntarily, when you write to us on WhatsApp, for the purpose of securing the forms and — subject to your consent — for visitor statistics and the embedded map.
1. Identity of the Data Controller
Your personal data is processed by the company identified below, acting as data controller ("Multitransport" or the "Company").
- Registered trade name: Multi Transport Anonim Şirketi
- MERSIS number: 0623205008900001
- Tax office / tax number: 6232050089 / Bornova
- Address: Mansuroglu Mah. Ankara Cad. Yan Yolu No: 47 D: 201, Mavi Plaza, Bayrakli / Izmir, Türkiye
- Telephone: +90 554 580 55 75
- E-mail: sales@multitransport.com.tr
- Website: multitransport.com.tr
2. Categories of Personal Data Processed
2.1. Data collected through the contact form
- Full name (mandatory field)
- E-mail address (mandatory field)
- Company name (optional)
- Telephone number (optional)
- Message content (up to 4,000 characters)
2.2. Data collected through the quote request form
- Company name, full name and e-mail address (mandatory fields)
- Telephone number (optional)
- Shipment details: transport mode (road, sea, air, intermodal), origin, destination, number of packages/pallets, weight, dimensions and cargo type
2.3. Technical data collected automatically upon form submission
- Your IP address and browser information (User-Agent) at the moment of submission. Both are written into the "Submission details" section of the notification e-mail that reaches our team, so that the source of the submission can be identified and any misuse can be investigated.
- Date and time of submission (UTC).
- For rate-limiting purposes, a salted SHA-1 hash of the IP address and, for the automatic acknowledgement counter, of the e-mail address. The temporary counter files kept on the server contain only these hash values and submission timestamps; neither the IP address nor the e-mail address itself is written to them.
- The bot-protection verification token generated in your browser and its verification result. The token is not stored on our server; it is only forwarded for verification.
- The time taken to complete the form and the state of the hidden honeypot field — used solely to assess whether a submission is automated.
- Where the server log is enabled, the IP address and the reason for rejection may be written to the application log file for rejected submissions.
2.4. Data collected through Google Analytics 4 (only with your explicit consent)
- Online identifiers: the random client and session IDs held in the _ga and _ga_XSPKMGE8T4 cookies placed in your browser.
- Usage data: the pages visited, where you came from (referring site), the date and duration of the visit and interactions on the page — for example submitting the quote or contact form, or clicking the telephone, e-mail and WhatsApp links. The information you type into the forms (name, e-mail, telephone, message) is not included in this measurement.
- Device and browser information: device type, operating system, browser, screen resolution and language.
- Approximate location (country and city level): derived from your IP address. Your IP address is sent to Google for this purpose; Google Analytics 4 does not log or store IP addresses.
Google signals and ad personalisation features are switched off; this data is not used for advertising or profiling.
2.5. Data processed when you write to us on WhatsApp
- Your telephone number, WhatsApp profile name and (where visible) profile photo.
- The content of your messages and any files, locations or documents you share.
The WhatsApp button on the site is simply a link; no data is sent to WhatsApp unless you click it. When you click it, the WhatsApp app or WhatsApp Web opens with a pre-filled draft message; sending that message is your choice.
Neither the forms nor our WhatsApp line request any special categories of personal data such as health, biometric or genetic data, data relating to criminal convictions and security measures, religious belief, sect, philosophical belief, political opinion, or membership of an association, foundation or trade union. Please do not include such information in the message or request fields.
3. Purposes of Processing and Legal Bases
Your personal data is processed for the purposes set out below, relying on the legal bases under the KVKK indicated against each category.
| Data | Purpose | Legal basis |
|---|---|---|
| Identity data: full name | Identifying the person submitting the request, responding to the request, conducting pre-contractual negotiations and preparing quotations | Necessary for the establishment or performance of a contract (Art. 5/2-c); for individuals submitting a request on behalf of a legal entity who are not themselves party to the contract, the legitimate interests of the data controller (Art. 5/2-f) |
| Contact data: e-mail address, telephone number | Responding to your request, delivering the quotation, sending the automatic acknowledgement confirming receipt of your request, and communicating with you throughout the transport process | Necessary for the establishment or performance of a contract (Art. 5/2-c); for contact persons acting on behalf of a legal entity, legitimate interests (Art. 5/2-f) |
| Customer transaction / request data: company name, transport mode, origin and destination, number of packages, weight, dimensions, cargo type, message content | Calculating freight and service charges, preparing quotations, planning transport and customs clearance operations, providing logistics services | Necessary for the establishment or performance of a contract (Art. 5/2-c) |
| Transaction security data: IP address, browser information (User-Agent), submission time, salted hashes of IP and e-mail address, bot verification token and result, form completion time | Protecting the forms against automated (bot) submissions, spam and abuse; limiting repeated submissions from the same source; preventing third parties' mailboxes from being flooded with automatic acknowledgement messages; investigating security incidents and ensuring the security of our systems | Legitimate interests of the data controller (Art. 5/2-f) |
| Contact and request data (WhatsApp): telephone number, profile name, message content and shared files | Responding to the request you send on WhatsApp, preparing quotations and communicating with you throughout the transport process | Necessary for the establishment or performance of a contract (Art. 5/2-c); for contact persons acting on behalf of a legal entity, legitimate interests (Art. 5/2-f) |
| Online identifiers and usage data (only if you consent to Google Analytics 4): cookie IDs, pages visited, interactions, device and browser information, approximate location | Measuring statistically how the site is used, improving our content and services, assessing the effectiveness of our contact channels and forms | Explicit consent (Art. 5/1) |
| Connection data: IP address and basic connection information relating to your browser (only if you choose to load the embedded Google Maps frame) | Showing our office location on a map on the Contact page | Explicit consent (Art. 5/1) |
| All of the above (where a request results in a commercial relationship) | Fulfilling record-keeping and documentation obligations arising from tax, commercial, transport and customs legislation; responding to requests from competent public authorities | Necessary for compliance with a legal obligation of the data controller (Art. 5/2-ç); expressly provided for by law (Art. 5/2-a) |
| All of the above (in case of a dispute) | Establishment, exercise or protection of a right; defending against legal claims and disputes | Necessary for the establishment, exercise or protection of a right (Art. 5/2-e) |
Your personal data is not processed for the purpose of sending you marketing or promotional messages, and no commercial electronic message consent is collected through the forms. Our reply to your request and the automatic e-mail confirming that your request has reached us are not commercial electronic messages; they are the direct response to your own enquiry. The content of the automatic acknowledgement is fixed; no text you entered into the form is reflected back in that message.
4. Method of Collection
Your personal data is collected electronically and by partly automated means through the contact and quote request forms on multitransport.com.tr, through our WhatsApp contact channel and — only if you give your explicit consent — through Google Analytics 4 cookies. Form data is transmitted from your browser to our server over an encrypted connection (HTTPS/TLS), validated server-side, composed into an e-mail message and delivered to the Company's corporate mailbox. The legal bases for collection are the provisions indicated for each data category in the table above.
Your cookie preference is stored in your browser's localStorage under the key "mt.consent". This is not a cookie and is never transmitted to our server; it serves only to apply the decision you made. The language of the site is determined by the address of the page you visit (English pages start with /en/); no separate record is kept for this.
5. Recipients of Personal Data and Purposes of Disclosure
Your personal data may be transferred, within the framework of Articles 8 and 9 of the KVKK and strictly limited to the purposes stated below, to:
- Microsoft Corporation / Microsoft Ireland Operations Ltd. (Microsoft 365 and Microsoft Graph API): the content of your form submission, including your IP address and browser information, is transmitted through and stored within the Company's corporate e-mail infrastructure. Purpose: provision of the corporate e-mail service.
- Cloudflare, Inc. (Turnstile bot protection): when you submit a form, your IP address and the verification token generated in your browser are sent to challenges.cloudflare.com for verification. Purpose: prevention of automated and malicious form submissions.
- Google Ireland Ltd. / Google LLC (Google Analytics 4 and Google Maps): Google Analytics 4 runs only if you give your explicit consent in the cookie preferences; in that case the data listed in section 2.4 is sent to Google to measure how the site is used. The embedded Google Maps frame (iframe) on the contact page likewise loads only if you give your explicit consent; if you consent, your IP address is disclosed to Google and Google may place cookies on your device. Unless you consent, these services are not loaded and no connection to Google is established for these purposes. The site's typefaces are served from our own server, so no request is sent to Google for them. You may withdraw your consent at any time.
- WhatsApp (Meta Platforms group): if you choose to write to us on WhatsApp, the conversation takes place on WhatsApp's infrastructure; your telephone number and message content reach us through it and are also subject to WhatsApp's own privacy policy. Purpose: responding to your request through the contact channel you chose.
- Our hosting provider: Dukasoft Bilgi Teknolojileri / Türkiye — data is processed on the server infrastructure on which the website and the form application run.
- Competent public authorities and judicial bodies: in response to requests for information and documents arising from legislation, limited to the data requested.
- Our legal and financial advisers: only where a dispute or legal obligation arises, for the exercise of the right of defence and the fulfilment of obligations.
Beyond the above, your personal data is never sold, rented out or shared with any third party for marketing purposes.
6. Cross-Border Transfer of Personal Data (KVKK Art. 9)
Because the Microsoft, Cloudflare, Google and WhatsApp services listed above operate on global infrastructures whose servers are also located outside Türkiye, your personal data is transferred abroad. The data transferred per service is as follows:
- Microsoft: the full content of your form submission (full name, company, e-mail, telephone, message and request details), together with your IP address and browser information.
- Cloudflare: your IP address and the bot verification token.
- Google: only if you have given explicit consent — for Google Analytics 4, the data listed in section 2.4; for the map frame, your IP address and basic connection information relating to your browser.
- WhatsApp: if you write to us on WhatsApp, your telephone number, profile information and message content.
These transfers are carried out under Article 9 of the KVKK as amended by Law No. 7499. Where there is no adequacy decision of the Personal Data Protection Board for the recipient country or for a sector within that country, the transfer is based on one of the appropriate safeguards listed in Article 9/2 — in particular the standard contract published by the Board (Art. 9/2-c) or an undertaking approved by the Board (Art. 9/2-ç). An executed standard contract is notified to the Board within five business days of signature (Art. 9/3). Where neither an adequacy decision nor appropriate safeguards exist, a transfer may only take place in the incidental cases listed in Article 9/6. For Google Analytics 4 and Google Maps, the transfer is based on the explicit consent you give in the cookie preferences. You may request a copy of the transfer safeguard documentation through the application channels set out below.
7. Retention Periods
- Requests resulting in a commercial relationship: form e-mails and the personal data they contain are retained for the duration of the commercial relationship and, thereafter, for the limitation and statutory retention periods prescribed by applicable legislation (see 1 Year).
- Requests that do not result in a quotation or commercial relationship: retained for a maximum of 1 Year, after which they are deleted or destroyed.
- Rate-limiting records: temporary counter files containing the salted hash of an IP address are kept for a default window of one hour; once the window expires the records cease to have effect, and the files are deleted automatically no later than twice the window length. For the acknowledgement e-mail counter the default window is 24 hours.
- Google Analytics 4 data: retained in Google Analytics for 14 months and deleted automatically at the end of that period. The _ga and _ga_XSPKMGE8T4 cookies remain in your browser for at most 12 months after your last visit and are deleted when you withdraw your consent.
- WhatsApp correspondence: correspondence relating to a request is retained for the periods stated above for form data.
- Server and application logs: technical records kept on the hosting infrastructure and in the application log are retained for a limited period for security purposes (see 1 Year).
Personal data whose retention period has expired is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Data Security Measures
In accordance with Article 12 of the KVKK, the Company implements technical and organisational measures to ensure an appropriate level of security, including:
- Transmission of the entire website and all form submissions over encrypted HTTPS/TLS connections;
- Server-side re-validation of form data, with the e-mail message composed on the server rather than by the client, so that form content can never reach e-mail headers or recipient fields;
- Input sanitisation: stripping of control characters, enforcement of valid UTF-8, and per-field length limits;
- Cloudflare Turnstile bot protection, a hidden honeypot field, and a minimum form completion time check;
- A per-IP rate limit and a per-e-mail-address limit on automatic acknowledgements, with counter keys stored only as installation-salted hashes;
- Acceptance of requests only from the site's own origin (origin verification);
- Configuration files containing credentials kept outside the web root or blocked from direct access, and temporary files created with owner-only permissions (0600);
- Access to corporate mailboxes restricted to authorised personnel and protected by multi-factor authentication.
9. Rights of the Data Subject under Article 11 of the KVKK
Everyone has the right to apply to the data controller and, in relation to themselves:
- Learn whether their personal data is being processed;
- Request information if their personal data has been processed;
- Learn the purpose of the processing and whether the data is used in accordance with that purpose;
- Know the third parties, in Türkiye or abroad, to whom their personal data has been transferred;
- Request rectification of their personal data if it has been processed incompletely or inaccurately;
- Request the erasure or destruction of their personal data under the conditions set out in Article 7 of the KVKK;
- Request that any action taken under the two preceding items (sub-paragraphs (d) and (e) of Article 11) be notified to the third parties to whom their personal data has been transferred;
- Object to an outcome arising to their detriment as a result of the exclusively automated analysis of their processed data;
- Claim compensation for damage suffered as a result of the unlawful processing of their personal data.
In addition, where your data is processed on the basis of legitimate interests, you may object to that processing by explaining your particular situation; and where processing is based on explicit consent (Google Analytics 4 and the embedded Google Maps frame), you may withdraw your consent at any time through the “Cookie preferences” link in the page footer.
10. How to Submit an Application
You may submit requests concerning the rights above, together with information and documents establishing your identity, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller, through one of the following channels:
- In writing: by delivering a wet-signed petition in person or through a notary public to Mansuroglu Mah. Ankara Cad. Yan Yolu No: 47 D: 201, Mavi Plaza, Bayrakli / Izmir, Türkiye;
- By secure electronic signature or mobile signature: sending your signed application to sales@multitransport.com.tr;
- From the e-mail address registered in our systems: sending your application to sales@multitransport.com.tr from the e-mail address you have previously notified to us and which is registered in our records.
Your application must state your name and surname, your signature (if made in writing), your Turkish ID number (for foreign nationals, nationality, passport number or identity number if any), your residential or business address for notification, your e-mail address, telephone and fax number if any, and the subject of your request. Attaching any relevant information and documents will help us process your request faster.
The Company will conclude your request free of charge as soon as possible and in any event within thirty days, depending on its nature. Where the process entails an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board. If your application is rejected, if you find the response insufficient, or if no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within thirty days of becoming aware of the response and, in any case, within sixty days of the date of your application.
11. Entry into Force and Updates
This privacy notice entered into force on 30.09.2026. The Company reserves the right to amend this notice in line with changes in legislation and in our data processing practices. The current version is always published at multitransport.com.tr; where material changes are made, the effective date is updated.
In the event of any discrepancy between the Turkish and English versions of this notice, the Turkish version shall prevail.