Privacy Policy

Last updated: 19 July 2026

This Privacy Policy explains how Stepstone Dış Ticaret Ltd. Şti. (“Stepstone”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit stpstone.com, contact us, request information or a quotation, or otherwise communicate with us in connection with a business or manufacturing project.

This notice is intended to provide information under Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

1. Data Controller

The controller responsible for the processing described in this Policy is:

Stepstone Dış Ticaret Ltd. Şti.
Altınşehir Mah., 301. Sk. No: 4, Kapı No: 51
Nilüfer, Bursa, Türkiye
Email: [email protected]

2. Personal Data We Collect

Depending on how you interact with us, we may process the following categories of personal data:

  • Identity and business contact data: name, surname, company name, job title, business email address and telephone number.
  • Inquiry and project data: the contents of your message, requested services, project requirements, quotation information and technical or commercial details that you choose to provide.
  • Communication data: emails, form submissions and records of our correspondence with you.
  • Technical and security data: IP address, browser and device information, requested URLs, timestamps, referral information and security or error logs.
  • Cookie and consent data: cookie identifiers, consent choices and information concerning your interaction with the website.
  • Analytics data: information about page views, sessions, approximate location, device type and general website interaction where Analytics consent has been provided.
  • Business relationship data: quotation, customer, supplier, project, delivery, accounting and contractual records where a business relationship is established.

We do not intentionally request special-category personal data through our website. Please do not include sensitive personal information in a contact form or ordinary email unless it is necessary and you have a lawful basis for providing it.

3. How We Collect Personal Data

We may obtain personal data:

  • directly from you through website forms, email, telephone or other communications;
  • from the company or organisation that you represent;
  • automatically through website logs, cookies and similar technologies;
  • from customers, suppliers or project partners where necessary for a legitimate business purpose.

Fields marked as required are necessary for us to receive and respond to your request. If you do not provide the required information, we may be unable to answer your inquiry, prepare a quotation or progress a project.

4. Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

Responding to inquiries and preparing quotations

We use contact and project information to respond to requests, assess manufacturing requirements, prepare quotations and take steps requested before entering into a contract.

Where GDPR applies, the legal bases are Article 6(1)(b) GDPR and, where appropriate, our legitimate interests under Article 6(1)(f) GDPR in managing business communications and developing customer relationships. Under KVKK, processing is based on the applicable conditions in Article 5, including processing necessary for a contract or our legitimate interests.

Managing customer, supplier and project relationships

We may process data to plan and manage projects, communicate with relevant parties, coordinate manufacturing services, maintain commercial records and fulfil contractual obligations.

The legal bases may include contract performance, compliance with legal obligations and our legitimate interests in operating and documenting our business activities.

Website operation, security and fraud prevention

We process technical and security data to operate the website, detect errors, maintain security, prevent spam and protect our forms against automated or malicious activity.

Where GDPR applies, this processing is based on our legitimate interests under Article 6(1)(f) GDPR. Under KVKK, it is based on the applicable processing conditions in Article 5.

Website analytics

With your consent, we use Google Analytics 4 to understand how visitors use the website and to improve its content, performance and usability. Analytics storage is denied by default and is enabled only after you provide consent.

Where GDPR applies, the legal basis is your consent under Article 6(1)(a) GDPR. Where consent is required under KVKK or applicable cookie rules, the processing is carried out on the basis of your explicit consent.

Legal compliance and claims

We may process and retain data to comply with accounting, tax, commercial and other legal obligations, respond to lawful authority requests and establish, exercise or defend legal claims.

5. Website Forms and Spam Protection

Information submitted through our website forms may be stored in our WordPress and hosting environment and delivered to us by email. We use a honeypot mechanism and Google reCAPTCHA to protect forms against spam, fraud and automated abuse.

When reCAPTCHA is used, technical information may be sent to Google for risk analysis. Google reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service .

6. Cookies, Consent and Google Analytics

We use CookieYes to record and manage cookie preferences. Necessary cookies support website security and consent management. Optional Analytics cookies are activated only after consent.

You can accept, reject or customise optional cookies through our consent banner. You can change or withdraw your choice at any time by selecting the Cookie Preferences button displayed on the left side of the website.

Detailed information about the cookies currently used, their purposes and storage periods is available in our Cookie Policy.

7. Recipients and Service Providers

Where necessary and proportionate, personal data may be shared with:

  • website hosting, database, technical support and security providers;
  • email delivery and communication service providers;
  • Google in connection with reCAPTCHA and consent-based Google Analytics services;
  • CookieYes in connection with cookie-consent management;
  • selected manufacturing, supplier or project partners where necessary to evaluate requirements, prepare a quotation, plan or deliver a project;
  • accountants, legal advisers, insurers and other professional advisers;
  • public authorities, courts or regulators where disclosure is legally required;
  • a successor or relevant party in connection with a lawful merger, restructuring or business transfer.

We require service providers and business partners to process personal data only for authorised purposes and with appropriate confidentiality and security protections.

We do not sell or rent personal data and do not currently use advertising cookies on the website.

8. International Data Transfers

Some service providers, including Google and CookieYes, may process data in countries outside Türkiye or the European Economic Area. Depending on the location of the provider and the relevant processing activity, these countries may have different data-protection laws.

Cross-border transfers are carried out only where an applicable lawful transfer condition is available and, where required, appropriate safeguards are used. These safeguards may include an adequacy decision, standard contractual clauses, standard contracts recognised under KVKK, another legally recognised transfer mechanism or explicit consent where legally permitted.

You may contact us for further information about the safeguards relevant to a particular transfer.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, accounting, contractual or reporting obligations.

  • Unsuccessful inquiries and quotations: generally retained for up to 36 months after the last meaningful communication, unless a longer period is necessary for a legal claim or another lawful reason.
  • Customer, supplier and project records: retained for the duration of the business relationship and afterward for the applicable statutory record-keeping and limitation periods.
  • Technical and security logs: generally retained for up to 90 days, unless a security incident, investigation or legal obligation requires longer retention.
    • <
  • Google Analytics data: event data is retained for 14 months. User-level data is retained for 2 months. The user-level retention period is not reset when new user activity is recorded. Aggregated reports may remain available for longer.
  • Cookie preferences and consent records: retained for the period necessary to remember your choices and demonstrate compliance. The CookieYes consent-preference cookie is generally stored for up to 12 months.

When retention is no longer necessary, data is deleted, anonymised or securely isolated until deletion through the applicable backup cycle.

10. Your Data-Protection Rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • request confirmation of whether we process your personal data;
  • obtain access to your personal data and information about its processing;
  • request correction of inaccurate or incomplete data;
  • request deletion or erasure of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • receive certain data in a structured, commonly used and machine-readable format;
  • withdraw consent at any time where processing is based on consent;
  • request notification of correction or deletion to relevant recipients where required;
  • object to a result produced exclusively through automated processing where applicable;
  • claim compensation where you suffer damage because of unlawful processing.

To exercise a right, contact [email protected]. Please describe your request clearly. We may request reasonable information to verify your identity and protect personal data against unauthorised access.

You also have the right to lodge a complaint with the Personal Data Protection Authority of Türkiye or, where GDPR applies, with the competent supervisory authority in your EEA country.

11. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures may include access controls, security monitoring, spam protection, backups and restricted administrative access.

No internet transmission or storage system can be guaranteed to be completely secure. If you believe that personal data has been compromised, please contact us promptly.

12. Children

This website is intended for business and professional users and is not directed to children. We do not knowingly collect personal data from children through the website.

13. Automated Decision-Making

We do not use personal data collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects.

14. External Links

The website may contain links to third-party websites, including LinkedIn and Google policy pages. Those websites operate under their own privacy notices. We are not responsible for the privacy practices of external websites.

15. Changes to This Policy

We may update this Privacy Policy when our services, providers, processing activities or legal obligations change. The latest revision date will be shown at the top of this page.

16. Contact Us

If you have questions about this Privacy Policy or our processing of personal data, please contact:

Stepstone Dış Ticaret Ltd. Şti.
Altınşehir Mah., 301. Sk. No: 4, Kapı No: 51
Nilüfer, Bursa, Türkiye
Email: [email protected]