Privacy Policy

Who processes your personal data on our websites biotama.com.tr and celurecosmetic.com, what we process, why, on what legal basis, for how long, and your rights.

Last updated: October 6, 2026

We review this notice periodically and whenever our processing, our service providers or the law change.

This notice explains how Biotama A.Ş. processes personal data when you visit biotama.com.tr or our Celure cosmetics website celurecosmetic.com, send us a quote request or a message, or subscribe to our newsletter. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and our information under Articles 13 and 21 of the EU General Data Protection Regulation (GDPR) for visitors in the European Union.

We collect only what each purpose below needs. We do not sell personal data, we use no advertising cookies, and we do not build profiles of visitors.

Both websites are operated by Biotama A.Ş., and this notice applies to both. Celure is Biotama's cosmetics brand; quote requests and messages sent from celurecosmetic.com go through the forms on biotama.com.tr. Where this notice speaks of "the website", it means whichever of the two websites you use.

1. Data controller

The data controller for both websites is Biotama A.Ş., a joint-stock company established in Türkiye:

Registered trade name: [LEGAL-TBD: to be supplied by Biotama]
Registered office address: [LEGAL-TBD: to be supplied by Biotama]
Seat: Ankara, Türkiye
MERSİS number: [LEGAL-TBD: to be supplied by Biotama]
Registered e-mail address (KEP): [LEGAL-TBD: to be supplied by Biotama]
E-mail: info@biotama.com.tr
Phone: +90 549 484 13 85

[LEGAL-TBD: Not yet confirmed by Biotama; to be completed before publication: EU representative (Art. 27 GDPR) and data protection officer]

2. What we process, why, and on what legal basis

Each block below describes one processing activity. "KVKK" means Law No. 6698, "GDPR" means Regulation (EU) 2016/679. Where we rely on our legitimate interests, you can object at any time (section 7).

2.1 Visiting the website (hosting and server logs)

Data: Your device's IP address, the date and time, the page requested, the referring page, and your browser's user-agent string (browser and operating system), as your browser sends them with every request. For security, our hosting provider's firewall also evaluates technical connection characteristics (such as a TLS fingerprint) to recognise attacks and automated traffic, and may ask your browser to pass a short automatic check.
Purpose: Delivering the pages you request, keeping the website secure and available, and finding errors.
How it is collected: Automatically, whenever your browser requests a page from biotama.com.tr or celurecosmetic.com.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in operating a secure website.
Legal basis (GDPR): Art. 6(1)(f) GDPR: the same legitimate interest.
Recipients: Vercel Inc. (USA), our hosting provider, as data processor. Pages are delivered through Vercel's worldwide network; our server functions run in Vercel's Frankfurt (Germany) region. Our web development service provider can access these logs, as data processor, to operate and maintain the website.
Retention: Request logs are deleted automatically at the end of the hosting platform's log retention period. Our own application log lines pass through a filter that removes e-mail addresses and IP addresses before they are written.

2.2 Protection against abuse of the forms and the sign-in

Data: A pseudonymised hash of your IP address (a shortened SHA-256 value computed without a secret key); when you send a form, a hash of the e-mail address you entered; and, when an administrator signs in, a hash of the e-mail address entered. The addresses themselves are not stored.
Purpose: Limiting how often a form can be sent (five times per hour from one IP address) or a newsletter link can be used, and blocking repeated submissions from one e-mail address within five minutes, so the forms, the newsletter links and the sign-in cannot be used for spam or attacks.
How it is collected: Automatically, when you send a form, use the confirmation or unsubscribe link from one of our newsletter e-mails, or sign in to the administration area.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in the security of our systems.
Legal basis (GDPR): Art. 6(1)(f) GDPR: the same legitimate interest.
Recipients: Upstash, Inc. (USA; database in Frankfurt, Germany), as data processor.
Retention: The counters expire automatically: the IP and sign-in e-mail counters within about two hours, the form e-mail marker after five minutes.

2.3 Quote requests

Data: Contact details (name, company, e-mail address, country; phone number, job title, WhatsApp number and website if you give them); your project (service, product category, target market, quantity, packaging, formulation, timeline, notes); how you heard about us, if you answer; and only if you fill in the optional section: company and billing details (trade name, company type, tax and registration numbers, EORI number, billing and delivery addresses, delivery terms, budget, sales channel, label languages, dates, documents you need) and up to five attached files. If you send the request from your quote list, also the products on it (product name and catalogue reference).
Purpose: Preparing and sending you a quote and communicating with you about it before a possible contract. We send you a copy of your request by e-mail as confirmation.
How it is collected: Through the web form on biotama.com.tr, which the quote buttons on celurecosmetic.com also open; products you selected on a quote list are carried to the form in the page address. The form is delivered to us by e-mail.
Legal basis (KVKK): Art. 5(2)(c) KVKK: processing is directly necessary for steps taken at your request before a contract is concluded; for the optional company details also Art. 5(2)(f) (our legitimate interest in answering a business enquiry).
Legal basis (GDPR): Art. 6(1)(b) GDPR where you act for yourself; otherwise Art. 6(1)(f): our legitimate interest in answering an enquiry from the company you represent.
Recipients: Vercel Inc. (processes the submission), Resend, Inc. (USA; e-mail delivery) as data processors, and our sales team's mailbox. The website does not store your request in a database. Attachments travel with the e-mail and are not stored on the website.
Retention: In our mailbox for as long as needed to handle your request; if a business relationship follows, for the periods commercial law requires for business correspondence (Turkish Commercial Code Art. 82). Resend keeps delivery records for the period set by its service.
Good to know: Fields marked as required are needed to prepare a quote; without them we cannot answer your request. Everything else is optional. The quote list itself is kept only in your browser (see our Cookie Policy) and reaches us only when you send the form.

2.4 Contact form

Data: Name, e-mail address, subject and your message; company, phone number and country if you give them.
Purpose: Answering your message. We send you a copy by e-mail as confirmation.
How it is collected: Through the web form on biotama.com.tr (celurecosmetic.com links to it); it is delivered to us by e-mail.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in answering enquiries; where your message concerns a contract with you, Art. 5(2)(c).
Legal basis (GDPR): Art. 6(1)(f) GDPR; where your message concerns a contract with you, Art. 6(1)(b).
Recipients: Vercel Inc. and Resend, Inc. (USA) as data processors, and our mailbox. The website does not store your message in a database.
Retention: In our mailbox for as long as needed to handle your message; if a business relationship follows, for the periods commercial law requires.
Good to know: Fields marked as required are needed to answer you.

2.6 Visitor statistics without cookies (our own measurement)

Data: For each page view your browser sends us the page path (without query string or anchor), the referring page, the page language and, where your browser measures them, page-speed values (Core Web Vitals). Our server adds the country, which our hosting provider derives from your IP address, and the browser family, operating-system family and device class (mobile, tablet or desktop), derived from your browser's user-agent string. The referring page is reduced to its host name. Our server also records which of our two websites you visited (biotama.com.tr or celurecosmetic.com), from the address your browser requested.
Purpose: Counting visits, popular pages, countries, referring websites, devices and page speed, so that we can run and improve the website.
How it is collected: Automatically, by a small script on each page. No cookies are used and nothing is stored on your device.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in measuring the use and performance of our website with aggregated statistics that do not identify you.
Legal basis (GDPR): Art. 6(1)(f) GDPR: the same legitimate interest.
Recipients: Vercel Inc. (runs our server functions) and Upstash, Inc. (USA; database in Frankfurt, Germany), as data processors. In the website, only Biotama's owner and administrator accounts can see the statistics; our web development service provider can access the underlying database, as data processor, for maintenance.
Retention: Only daily totals are stored. They are deleted automatically after 400 days.
Good to know: To count unique visitors per day without identifying anyone, our server computes a keyed hash (HMAC-SHA-256) of the date, your IP address and your user-agent string in memory, adds it to a probabilistic counter (HyperLogLog) and discards it. The hash, your IP address and your user-agent string are never stored, so a person seen on two days is counted twice. If your browser sends a Do Not Track or Global Privacy Control signal, your visit is not counted at all. Visits to the admin area and by known bots are not counted. To limit abuse of the counter, the server keeps a hash of the IP address in its working memory only briefly (the counting window is one minute); it is never written anywhere. You can also switch off counting for your browser with one click: on biotama.com.tr in our Cookie Policy, on celurecosmetic.com under "Privacy settings" in the page footer. That choice is stored only in your browser, and because browsers keep each website's data separately, it applies only to the website on which you make it; to stop counting on both websites, make it on each.

2.7 Vercel Web Analytics

Data: Per page view: the time, the page address without query string or anchor, the route, the referring page, the country, region and city derived from your IP address, the operating system and browser with their versions, and the device type. To tell visitors apart, Vercel computes a hash from the incoming request, which according to Vercel is discarded after 24 hours.
Purpose: Statistics on the use and reach of the website, complementing our own measurement.
How it is collected: Automatically, by a script served from our own domain. No cookies are used and nothing is stored on your device.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in measuring the use of our website.
Legal basis (GDPR): Art. 6(1)(f) GDPR: the same legitimate interest.
Recipients: Vercel Inc. (USA), as data processor. Our web development service provider can see the reports, as data processor, for maintenance.
Retention: Aggregated reports are kept for the retention period of our Vercel plan.
Good to know: Nothing is sent to Vercel Web Analytics if your browser sends a Do Not Track or Global Privacy Control signal, or if you have switched off counting on that website (section 2.6); query strings and anchors are removed from the address in your browser before anything is sent. You can also object by writing to us (section 7).

2.8 Copy detection (website integrity)

Data: Each page of both websites contains a 1×1 pixel image that your browser loads from bg-static.vercel.app. With that request the server receives the date and time, your IP address, your browser's user-agent string and the address (origin) of the website that served the page, for example https://biotama.com.tr or https://celurecosmetic.com, but not the path of the page.
Purpose: Detecting unauthorised copies of our websites served from other domains: the request names the website that served the page.
How it is collected: Automatically, when your browser loads a page.
Legal basis (KVKK): Art. 5(2)(f) KVKK: our legitimate interest in protecting our content and intellectual property.
Legal basis (GDPR): Art. 6(1)(f) GDPR: the same legitimate interest.
Recipients: The image server is operated for us by our web development service provider, as data processor, on the infrastructure of Vercel Inc. (USA), which acts as a sub-processor.
Retention: Request records are kept only as long as needed to detect copies of our websites and, where a copy is found, to take action against it. The hosting platform's own request logs are deleted automatically at the end of its log-retention period. The records are never used for advertising, for profiling or to follow you across other websites.

2.9 Google Maps (only if you load the map)

Data: When you choose to load the map on our contact page, your browser connects to Google. Google receives your IP address and browser and device information, and may read or set cookies. Your browser is told not to send Google the address of our page.
Purpose: Showing our location on an interactive map.
How it is collected: Only after you click the button that loads the map. Until then nothing is sent to Google; our address and a link that opens Google Maps are shown instead.
Legal basis (KVKK): Your explicit consent, given by clicking to load the map (Art. 5(1) KVKK).
Legal basis (GDPR): Your consent, Art. 6(1)(a) GDPR, and for access to your device § 25(1) of the German TDDDG.
Recipients: Google LLC (USA) receives the data as an independent controller under its own privacy policy (policies.google.com/privacy). Google LLC is certified under the EU-U.S. Data Privacy Framework.
Retention: Decided by Google.
Good to know: Your choice is remembered in your browser for up to 12 months. You can withdraw it at any time with "Hide map and forget my choice" next to the map, or by clearing this website's data in your browser; the map is then no longer loaded.

2.10 Administrator accounts (Biotama staff only)

Data: For people Biotama has invited to manage the website: e-mail address, role, a hash of the password, an encrypted two-factor secret, hashes of recovery codes, sign-in sessions (with a keyed hash of the IP address and the browser's user-agent string) and a security log of administrative actions (with a keyed hash of the IP address, never an e-mail address).
Purpose: Secure access to the administration of the website, and accountability for changes.
How it is collected: From the invitation, the sign-in and the use of the administration area.
Legal basis (KVKK): Art. 5(2)(c) and (f) KVKK.
Legal basis (GDPR): Art. 6(1)(b) and (f) GDPR.
Recipients: Neon (Databricks, Inc., USA; database in Frankfurt, Germany), Vercel Inc. and, for invitation and password-reset e-mails, Resend, Inc., as data processors.
Retention: As long as the account exists. Sessions end after 12 hours at the latest, or after 2 hours without activity; their records are deleted automatically 30 days after that latest end. Invitations expire after 72 hours and password-reset links after 1 hour; their records are deleted automatically 30 days after expiry. Security-log entries are deleted automatically after two years.

3. Service providers and transfers abroad

We use the following service providers. They process personal data only on our instructions (data processors), except Google, which acts as an independent controller for the map.

Vercel Inc., USA: hosting, server functions, Vercel Web Analytics and image storage. Server functions run in Frankfurt, Germany; pages are delivered through Vercel's worldwide network.
Neon (Databricks, Inc.), USA: database for newsletter and administrator data, hosted in Frankfurt, Germany.
Upstash, Inc., USA: counters for abuse protection and visitor statistics, hosted in Frankfurt, Germany.
Resend, Inc., USA: sending e-mails (form notifications, confirmations, newsletter). Resend stores e-mail data in the United States.
Our web development service provider: building, operating and maintaining the website, including the copy-detection image server (section 2.8). In that work it may see personal data in hosting logs, the database and statistics, and it processes them only on our instructions.
Google LLC, USA: only if you load the map.

Under the KVKK, using these providers is a transfer of personal data abroad, because their servers are outside Türkiye (in Germany and the USA). Transfers to our data processors take place under Art. 9 KVKK on the basis of the standard contracts announced by the Personal Data Protection Board, which are notified to the Authority as the law requires. You can ask us which safeguard applies to which provider (section 8).

Google LLC is not our data processor: it receives data directly from your browser, as an independent controller, and only after you click to load the map (section 2.9). For visitors in the EU, Google LLC is certified under the EU-U.S. Data Privacy Framework.

For visitors in the EU: transfers to our data processors in the USA rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses in our data processing agreement with that provider.

[LEGAL-TBD: Not yet confirmed by Biotama; to be completed before publication: data processing agreements with every provider named in this section; KVKK standard contracts signed and notified to the Authority; the data locations stated in this policy]

4. How we protect your data

Every page is served over an encrypted connection (HTTPS with HSTS).
Form submissions are not stored on the website; they are delivered to us by e-mail.
IP addresses are never stored in readable form. For proof of newsletter consent and for administrator security we store a keyed hash that cannot be traced back without our secret key; the abuse-protection counters use a shortened hash without a key, which is pseudonymised rather than anonymous and expires within about two hours.
Administrator access requires a password and a second factor; the database enforces access rules on every row.
Application logs are filtered so that e-mail addresses, IP addresses and secrets are never written to them.

5. No automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

6. Your rights

Under Article 11 KVKK you have the right to:

learn whether your personal data are processed;
request information about the processing if they are;
learn the purpose of the processing and whether the data are used in line with it;
know the third parties in Türkiye or abroad to whom your data are transferred;
have incomplete or inaccurate data corrected;
have your data erased or destroyed under the conditions of Article 7 KVKK;
have corrections, erasures and destructions notified to the third parties who received the data;
object to a result against you that arises from analysis of your data exclusively by automated systems;
claim compensation if you suffer damage from unlawful processing.

If the GDPR applies to you, you also have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and you can withdraw a consent at any time with effect for the future (Art. 7(3)).

7. Your right to object

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK), that is for server logs, abuse protection, visitor statistics and copy detection, you can object at any time on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims. Write to us at info@biotama.com.tr.

Turning on Do Not Track or Global Privacy Control in your browser, or the "Do not count me" button (on each of our websites; see section 2.6), immediately stops both visitor statistics (sections 2.6 and 2.7) for your browser.

8. How to exercise your rights

Send your request to us in writing through one of these channels:

Registered office address: [LEGAL-TBD: to be supplied by Biotama]
Registered e-mail address (KEP): [LEGAL-TBD: to be supplied by Biotama]
E-mail: info@biotama.com.tr

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, an application must state your name and surname (and carry your signature if made in writing); your Turkish identity number, or for foreign nationals your nationality and passport or identity-card number; your residence or business address for notifications; your e-mail address, telephone or fax number if any; and the subject of your request. Applications by e-mail can be sent from an e-mail address you have previously given us and that is registered in our records, or with a secure electronic signature.

We answer free of charge as soon as possible and within 30 days at the latest. If answering causes additional cost, we may charge the fee set in the Board's tariff. We may ask you to confirm your identity so that we never disclose your data to someone else.

9. Complaints to a supervisory authority

If we reject your application, if you find our answer insufficient, or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our answer and in any case within 60 days of your application (Art. 14 KVKK).

If the GDPR applies to you, you can also lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

10. Children

Our websites are directed at businesses. They are not intended for children, and we do not knowingly process children's data.

11. Changes to this notice

We update this notice when our processing, our service providers or the law change. The date at the top of the page shows the current version.