MARBLELINE
Privacy Policy
This policy explains how your personal data is processed when you visit the MARBLELINE website and when you contact us.
Last updated:
Data controller
Your personal data is processed by Marbleline Madencilik Dış Ticaret Limited Şirketi ("MARBLELINE") as the data controller.
- Locations: Antalya and Dubai (by appointment only)
- Phone: +90 507 051 7206
- Email: gulce@marbleline.org
- Tax office: Kaymakkapı
- MERSIS No.: 0612 1648 7620 0001
Personal data we process
The website is designed not to collect personal data from visitors by default. The following data is processed only in the situations described:
- Direct email correspondence: your email address, name, any other details you include in your signature or message, and the content of the correspondence.
- Technical logs: server records kept by the hosting infrastructure for the secure operation of the site, such as IP address, browser information and request time.
- Analytics data: anonymised usage and performance data, only if you allow analytics cookies.
Purposes of processing
- To respond to your enquiries and carry on correspondence,
- To keep the website secure and prevent misuse,
- To measure the use and performance of the site, if you allow it,
- To comply with legal obligations.
Legal grounds
Your personal data is processed on the legal grounds set out in Article 5 of Turkish Personal Data Protection Law No. 6698 (KVKK): processing that is directly related to entering into or performing a contract, compliance with a legal obligation, the controller's legitimate interests provided that your fundamental rights and freedoms are not harmed, and — for analytics cookies — your explicit consent.
Where the EU General Data Protection Regulation (GDPR) applies to you, the corresponding grounds are Article 6(1)(b) (steps prior to entering into a contract), 6(1)(c) (legal obligation), 6(1)(f) (legitimate interests) and 6(1)(a) (consent).
Retention periods
Personal data is kept for as long as the purpose of processing requires and for any period required by law, after which it is deleted, destroyed or anonymised.
- Contact correspondence: for no more than 2 years after the enquiry is resolved; where a legal duty or dispute applies, until the relevant period expires.
- Site runtime logs: for the limited retention period included in the active Vercel plan.
- Analytics data: not collected while Google Analytics is disabled; if enabled later, its retention setting will be disclosed in this policy.
Service providers and transfers
Your personal data may be shared, only for the purposes above and to the extent necessary, with the providers whose services we use:
- Hosting and content delivery: Vercel Inc.; server functions are configured for the Frankfurt (fra1) region, while static content may be served through a global CDN.
- Contact: no third-party form delivery service is used by default; visitors write directly to the company address through their own email provider.
- Analytics: currently not used; if separately enabled, Google Analytics 4 (Google Ireland Limited / Google LLC) may load only after the visitor gives permission.
Vercel may process operational data in the United States and other countries while providing the service. Its data processing terms and subprocessor list are considered when assessing the transfer; MARBLELINE does not enable a new overseas data-processing service unless an appropriate safeguard or another valid transfer condition under Article 9 of the KVKK is in place.
Your rights
Subject to the conditions of applicable law, you may request access to your personal data, its correction or deletion, a restriction of processing, and information about the third parties it has been transferred to. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Where the GDPR applies, you also have the right to data portability, to object to processing based on legitimate interests, and to lodge a complaint with a supervisory authority.
To exercise your rights, write to gulce@marbleline.org.
Security
The site is served using HTTPS and HSTS, with a content security policy and restrictions on framing and browser permissions. Form input is validated on the server and protected against automated misuse by a hidden field. In the default configuration, no analytics or tracking script runs and contact messages are not stored in a website database. Access and processing are limited to the minimum required to provide the service.
Changes
This policy may be updated when necessary. The current version is always published on this page.