Business-contact data
Name, surname, business email address, telephone number, job title, employer, department and authorised-contact role.
Privacy & Data Protection
Privacy Policy
This Policy explains, in practical terms, how Beyoğlu Professional handles personal data across its public website, assessments, workspace, compliance tools, APIs and managed PPWR-EPR services. It describes who is responsible for the processing, what information can enter the service, why it is used, where it may come from, who may receive it, how long it is kept, how international transfers are handled and how individuals can exercise their data-protection rights.
Privacy & Data Protection
Our position
Packaging-EPR work cannot be operated without identifying the relevant company, authorised contacts, Producer status, packaging, transactions and Member States. We use personal data only where it has a defined role in operating, securing or supporting that work.
We do not sell personal data. We do not treat regulatory information as advertising data. We do not ask customers to send end-consumer information that is unnecessary for a compliance task. Where another organisation receives personal data, we distinguish whether it acts for Beyoğlu, for the customer, or in its own capacity as an authority, Producer Responsibility Organisation, payment provider or other independent controller.
1. Who we are
Who we are
The public service brand and the current legal entity are identified separately.
| Item | Details |
|---|---|
| Service brand | Beyoğlu Professional — PPWR-EPR Compliance Services. The public-facing brand used for European packaging-EPR compliance services, tools and platform functions. |
| Current business entity | THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ. The current Turkish legal and administrative entity operating the public service during the present rollout stage. |
| Legal / administrative address | Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye. |
| Tax registration | Tax No. 8430730980 — Alemdağ Vergi Dairesi. |
| Current development base | İstanbul, Türkiye. |
| European structure | A staged European rollout. European entities, branches or statutory representative structures are described as established only after the relevant legal arrangement has actually taken effect. |
| Contracting entity | Identified expressly in the applicable Order Form, commercial agreement, regulatory mandate or country-specific representation document. |
| Regulatory scope | Packaging EPR and PPWR Chapter VIII operations. The service is not presented as a generic EU product-safety authorised-representative service. |
2. Data controller
Data controller
For the current public website, contact enquiries, public assessment flows and other processing for which no different entity is expressly identified, the controller is THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ, at the address stated above.
Privacy enquiries and data-subject requests can be submitted through our contact page. A later customer engagement may identify another Beyoğlu entity as controller, joint controller, processor, statutory representative or contracting party for a defined operation. Where that happens, the relevant agreement, Data Processing Agreement or regulatory mandate governs that relationship.
EU representative under GDPR Article 27
The current controller is established in Türkiye, outside the European Union and European Economic Area. Where GDPR Article 3(2) applies and Article 27 requires a representative in the Union, that representative must be designated in accordance with the Regulation unless the statutory exception applies.
No EU GDPR Article 27 representative is identified in this notice as of 9 September 2026. We do not publish a representative before an appointment has become legally effective. If a designation becomes applicable and effective, the representative's identity and contact details will be added to this Policy and the relevant notices.
Data Protection Officer
No Data Protection Officer contact is published in this notice as of 9 September 2026. We review the criteria in GDPR Article 37 and applicable Turkish law. If appointment becomes mandatory, or a DPO is appointed voluntarily, the relevant contact details will be published.
3. Applicable privacy framework
Applicable privacy framework
The current Turkish entity is subject to applicable Turkish personal-data law, including Law No. 6698 on the Protection of Personal Data where that law applies.
GDPR can also apply to processing within its territorial scope, including qualifying activities connected with offering goods or services to individuals in the Union. For processing governed by GDPR, this Policy is structured to provide the information required by Articles 13 and 14 as relevant.
The applicable legal basis, controller role and rights can vary by processing operation, customer relationship and country. This Policy therefore describes the present public-service framework; a contract, mandate or country-specific notice may provide additional information for a defined service.
4. Categories of data
Categories of data
Account and authentication data
Account identifier, authentication events, account role, access permissions, security settings and related account information.
Corporate and registration information
Legal name, company number, registered address, VAT data, EORI or other identifiers where relevant, authorised-signatory information and corporate documents.
Producer and regulatory data
Producer status, national registrations, EPR numbers, PRO memberships, EPR authorised-representative mandates, authority correspondence, reporting records and regulatory evidence.
Product and packaging data
SKU, product description, packaging components, materials, weights, unit quantities, packaging categories and versioned packaging records.
Order and shipment data
Order and parcel references, destination Member State, shipment date, SKU quantities, fulfilment route, cancellation, return and related transactional events.
Billing and regulatory-payment records
Invoice information, service-fee records, regulatory-contribution calculations, payment status, payment references, funding reservations and reconciliation records.
Correspondence and support records
Messages, support requests, assessment answers, meeting records, customer instructions and regulatory correspondence.
Device and system information
IP address, browser and device information, timestamps, session information, API events, security logs and diagnostic information.
Consent and preference records
Cookie choices, consent records, communication preferences, opt-outs and related preference history.
Data minimisation
Do not send us consumer personal data merely because an order contains it. Packaging-EPR reporting normally needs data such as destination country, parcel or shipment reference, product, quantity and packaging. It usually does not require the buyer's name, private email address or precise residential address. API and import integrations should therefore remove unnecessary end-consumer data wherever the compliance purpose can be achieved without it.
5. Where information comes from
Where information comes from
We may receive personal data directly from the individual concerned, from the organisation that employs or instructs that person, or from systems connected to a customer's compliance workflow.
Other sources can include customer APIs and commerce systems, public company registers, Producer registers, competent authorities, PROs and recognised compliance systems, marketplaces, fulfilment providers, payment providers and publicly available professional business information.
Where GDPR Article 14 applies because data was not obtained directly from the data subject, the information required by Article 14 is provided within the applicable time limits unless a lawful exception applies. Depending on the circumstances, that can require notice within a reasonable period and no later than one month, or earlier when the data is first used to communicate with the person or first disclosed to another recipient.
6. Purposes and legal bases
Purposes and legal bases
We do not rely on one blanket legal basis for every processing activity.
| Processing purpose | Typical data involved | GDPR basis typically relied upon where GDPR applies |
|---|---|---|
| Responding to an enquiry or requested assessment | Contact details, company data and information supplied in the enquiry | Article 6(1)(b) where the individual requests pre-contractual steps; Article 6(1)(f) for ordinary B2B correspondence involving representatives of an organisation. |
| Creating and administering an account or workspace | Identity, business contact, authentication and account data | Article 6(1)(b) where applicable; Article 6(1)(f) for administration of access provided to corporate users. |
| Producer assessment and country activation | Company, sales-route, Producer, packaging and contact data | Article 6(1)(b); Article 6(1)(f) where processing concerns the customer's representatives. |
| Regulatory registration and reporting | Corporate identifiers, authorised contacts, mandate data, packaging quantities and regulatory records | Article 6(1)(b); Article 6(1)(c) where processing is necessary for a legal obligation applying to the relevant Beyoğlu entity or statutory representative. |
| PRO / system administration and evidence retention | Producer, registration, reporting, contact and evidence data | Articles 6(1)(b), 6(1)(c) and, where appropriate, 6(1)(f). |
| Regulatory-payment calculation and administration | Company, parcel, packaging, invoice and payment data | Articles 6(1)(b) and 6(1)(c); Article 6(1)(f) for audit, reconciliation and fraud-control operations. |
| Customer support and service communication | Contact details and correspondence | Articles 6(1)(b) and 6(1)(f). |
| Platform security, abuse prevention and diagnostics | Account, device, IP, API and security-log data | Article 6(1)(f); Article 6(1)(c) where a specific security obligation applies. |
| Accounting, tax, audit and legal claims | Contract, invoice, payment and correspondence data | Articles 6(1)(c) and 6(1)(f). |
| Optional non-essential analytics | Cookie, device and usage information | Article 6(1)(a) consent where consent is required, together with applicable ePrivacy rules. |
| Optional electronic marketing | Business-contact and preference data | Consent or another lawful basis only where permitted by GDPR and applicable electronic-marketing law. |
Legitimate interests
Where Article 6(1)(f) is used, our legitimate interests can include operating a B2B service, administering relationships with corporate customers, maintaining service integrity, securing accounts and APIs, preventing fraud or abuse, maintaining regulatory evidence, defending legal claims and improving the reliability of compliance workflows.
Legitimate interest is not treated as a substitute for consent where ePrivacy rules or another applicable law require consent.
7. Is providing the data compulsory?
Is providing the data compulsory?
A visitor can read public Knowledge Hub material without providing the corporate and packaging information required for a managed compliance service.
To activate a country, register a Producer, operate reporting, calculate a regulatory contribution, administer regulatory payments or accept a statutory mandate, we must receive the information required for that task.
Where information is a statutory or contractual requirement, failure to provide it can mean that we cannot activate the country, file a declaration, accept a mandate, calculate a reliable EPR amount or continue the affected service.
8. Recipients
Recipients
Depending on the country and service, personal data may be disclosed to:
- national environmental or other competent authorities;
- national Producer registers and regulatory portals;
- authorised PROs, compliance schemes and EPR system operators;
- deposit-return systems where relevant;
- an eligible EPR Authorised Representative or country-specific Beyoğlu entity where a lawful local representation structure is used;
- marketplaces and fulfilment providers where the customer instructs us to provide evidence or the legal process requires an exchange;
- licensed payment service providers, banks and payment infrastructure used for service or regulatory payments;
- cloud, hosting, content-delivery, security, authentication and communications providers;
- accountants, auditors, insurers, lawyers and other professional advisers; and
- courts, regulators, law-enforcement bodies or other public authorities where disclosure is legally required.
Current public-site infrastructure
The current public website is generated as static content and uses Google Cloud infrastructure for object storage, HTTPS delivery and content distribution, including Cloud Storage and Cloud CDN in the current production architecture. Technical providers can process limited request, security and delivery data required to operate those services.
Optional analytics or comparable technologies are handled under the Cookie & Similar Technologies Policy and should operate according to the consent configuration applicable at the time. Provider arrangements can change as the platform develops; current contracts, processor terms and technical configuration govern the actual processing rather than an outdated static provider list on this page.
9. International transfers
International transfers
Türkiye is a third country for GDPR transfer purposes and, as of this Policy review, is not among the jurisdictions covered by a European Commission adequacy decision.
Where personal data is transferred from the EEA to Türkiye in circumstances governed by GDPR Chapter V, an applicable transfer mechanism must be identified. Depending on the relationship, this can include the European Commission's Standard Contractual Clauses under Article 46 together with supplementary technical, contractual or organisational measures appropriate to the transfer.
Data can also be processed in other countries through infrastructure or service providers. The transfer mechanism depends on the destination, provider and processing relationship, and can include an adequacy decision, Standard Contractual Clauses or another mechanism permitted by Chapter V.
Transfers from Türkiye are separately assessed under Turkish Law No. 6698, including the amended Article 9 framework and the applicable rules on adequacy, appropriate safeguards, standard contracts and other permitted transfer mechanisms.
A data subject may request information about the safeguard relevant to their personal data through our contact page.
10. Retention
Retention
We retain records according to their function rather than under one indefinite period.
| Record type | Retention approach |
|---|---|
| Unconverted enquiries | Normally up to 24 months after the last substantive interaction, unless a dispute, security matter or legal obligation justifies longer retention. |
| Assessment / pre-contract workspace data | Normally up to 24 months after the last relevant activity where no engagement follows, unless deletion is requested and available or longer retention is legally justified. |
| Active customer account data | For the duration of the service and then for the period needed to complete termination, regulatory handover, accounting and claims obligations. |
| Contracts, invoices and accounting records | For the statutory period required by the applicable commercial, accounting and tax regime. |
| EPR registration, declaration and evidence records | For the country-specific period required by law, authority, register, PRO / system rules or the relevant mandate. No universal EU retention period is asserted. |
| Security and access logs | For a period proportionate to security, troubleshooting and audit needs, extended where a specific incident, investigation or legal claim requires preservation. |
| Consent records | For as long as necessary to demonstrate the consent, preference and any later withdrawal. |
| Marketing suppression records | A minimal suppression record may be retained after an opt-out so that the opt-out continues to be respected. |
When a retention period ends, information is deleted, anonymised or otherwise removed from active use unless continued retention is legally justified.
11. Your rights
Your rights
Where GDPR applies, and subject to its conditions and exceptions, you may have the right to:
- obtain confirmation whether personal data concerning you is being processed and access that data;
- correct inaccurate data and complete incomplete data;
- request erasure under Article 17;
- request restriction of processing;
- object to processing based on Article 6(1)(e) or 6(1)(f) under Article 21;
- object at any time to direct-marketing processing;
- receive qualifying data in a structured, commonly used and machine-readable format under Article 20;
- withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing;
- exercise applicable safeguards concerning qualifying solely automated decision-making under Article 22; and
- obtain information about applicable Article 46 safeguards for qualifying international transfers.
Rights under Turkish data-protection law
Where Law No. 6698 applies, the rights available to the data subject under that law, including the right to apply to the controller and the applicable complaint mechanisms before the Personal Data Protection Authority, remain available in accordance with the statutory procedure.
How we handle requests
Requests can be submitted through our contact page or sent to the controller at the corporate address above.
Under GDPR, we respond without undue delay and normally within one month after receiving a valid request. Where permitted because of complexity or the number of requests, the period can be extended by up to two further months; the data subject is informed of the extension within the initial one-month period. Requests are normally handled without charge, subject to the Regulation's rules for manifestly unfounded or excessive requests. We may request additional information where reasonably necessary to verify the requester's identity.
12. Complaints
Complaints
We encourage individuals to contact us so that a privacy concern can be investigated and corrected promptly. This does not remove any right under GDPR Article 77 to lodge a complaint with a competent supervisory authority, including in the Member State of habitual residence, place of work or place of the alleged infringement.
Where Turkish Law No. 6698 applies, the application and complaint mechanisms under that law and the Turkish Personal Data Protection Authority framework remain available in accordance with the applicable procedure.
13. Automated processing
Automated processing
The platform can use deterministic rules and software-assisted workflows to determine country scope, map packaging profiles to shipments, calculate expected regulatory contributions, detect missing information and route exceptions for review. Public checkers and calculators can likewise produce automated outputs based on information supplied by the user.
These functions are not represented as authority decisions and do not, by themselves, constitute solely automated legal decisions concerning an individual within the meaning of GDPR Article 22.
As of this Policy version, Beyoğlu does not state that it uses solely automated Article 22 decision-making that produces legal or similarly significant effects on individuals. If this changes, the relevant notice will explain the logic, significance, expected consequences and safeguards, including any applicable right to human intervention.
14. Special-category and children's data
Special-category and children's data
The PPWR-EPR service is not designed to collect special-category personal data, criminal-offence data or data from children.
Customers should not provide health data, biometric data, political opinions, religious or philosophical beliefs, trade-union information, sexual-life or sexual-orientation data, or criminal-record information unless a specific lawful compliance purpose requires it and the relevant legal conditions have been established in advance.
The service is a professional B2B compliance service and is not directed at children.
16. Security and personal-data breaches
Security and personal-data breaches
We apply technical and organisational measures appropriate to the nature and risk of the processing. Further information about the public-service security framework is available in our Data & Security Policy.
Where GDPR applies and a personal-data breach is likely to result in a risk to individuals' rights and freedoms, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach. Where a breach is likely to result in a high risk, affected data subjects must also be informed without undue delay unless a statutory exception applies.
Breach facts, effects and remedial measures are documented as required by applicable law.
17. Changes to this Policy
Changes to this Policy
We update this Policy when material changes occur, including changes in the controller or contracting structure, appointment of an EU GDPR representative or DPO, changes to material infrastructure or processors, deployment of new payment infrastructure, or introduction of a materially different processing purpose.
The effective date and review date remain visible. Where applicable law requires direct notice of a new processing purpose or other material change, publication of a revised web page alone is not treated as a substitute for that notice.
Privacy and data-subject requests
Controller: THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ. Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye.
Use our contact page for privacy enquiries and data-subject requests.