Privacy Policy
1. Summary
- We are a wine-cellar design and manufacturing company in Istanbul, Türkiye.
- We collect personal data mainly when you send us an enquiry, so that we can reply and prepare a proposal.
- We keep enquiries for 24 months, then delete them, unless you become a customer.
- We do not sell your personal data, we don't share it for advertising, and we don't send marketing emails.
- Analytics and other optional cookies stay off until you choose. See the Cookie Policy.
- You can ask to see, correct or delete your data at any time: winecellars@ardinart.com.
2. Who is responsible
The controller of your personal data is:
ARDİNART SOĞUTMA SİSTEMLERİ SAN. TİC. LTD. ŞTİ., trading as ARDINART Wine Cellars İkitelli OSB Mahallesi, Marmara Sanayi Sitesi L Blok No: 36-37, 34307 Küçükçekmece, Istanbul, Türkiye Phone: +90 212 646 42 66 · Privacy contact: winecellars@ardinart.com
Privacy requests are handled by a person authorised by Ardinart.
Contact for Brazil (LGPD Art. 41, encarregado): the privacy contact above
3. What this policy covers
This policy applies to ardinartwinecellars.com and to enquiries you send us through the site, by email, by phone or on WhatsApp. It does not cover other websites we link to (Instagram, Facebook, WhatsApp, YouTube, Google Maps). They have their own policies.
4. What we collect
You can browse the site without giving us any personal data.
4.1 When you send an enquiry or catalogue request
| Data | Required? |
|---|---|
| Name | Yes |
| Phone and email | Yes |
| Company name | Optional |
| Your role (for example homeowner, architect, designer, hotel or restaurant) | Optional |
| City or location of the project | Optional |
| Project details: type of space and type of solution (required for a survey request); project stage, size and width, bottle capacity, climate zones, materials, timeline, whether you will send photos or plans (optional) | Partly |
| Budget intent (for example "prefer to see a quote first"). We do not ask for amounts. | Optional |
| Preferred contact time | Optional |
| Free-text note | Optional |
| Language and the last page you viewed before sending the form | Automatic |
| Date and time, and the version of this policy you confirmed you had read | Automatic |
Please don't include health, financial or other sensitive information in the free-text note. We don't need it.
Giving us this data is not a legal or contractual requirement. But we can't reply to an enquiry without a way to contact you; everything else is optional.
4.2 Security and anti-spam data (automatic)
- Your IP address is used to limit repeated submissions and to verify the request with Cloudflare Turnstile. We do not store it in plain form: we keep a salted, one-way hash (SHA-256, shortened) with the enquiry and in a short-lived rate-limit file.
- Your browser's user agent (browser and device type, up to 200 characters), and whether the security check passed.
4.3 Technical logs and Cloudflare
The site runs on servers in Türkiye (Veridyen), with Cloudflare in front of it for security and content delivery. On every page request, the hosting server and Cloudflare process standard request data: IP address, date and time, page requested, browser type and referring page. Cloudflare processes this data on its global network, including in the United States, and may set security cookies such as __cf_bm (and cf_clearance if a security check is shown). Server logs are kept for the periods set by the hosting provider and Cloudflare.
4.4 Analytics (only with your consent)
If you allow Analytics, Google Analytics 4 records which pages you visit, for how long, your device and browser type, approximate location (country/city), and events such as button clicks, form steps and a submitted enquiry (form type, type of space and solution, role, language). It uses a random ID stored in the _ga and _ga_3XJZ17ZDT1 cookies. Your name, email, phone number and message are never sent to Google. According to Google, GA4 does not log or store IP addresses.
4.5 Other cookies
Essential storage (theme, view, your cookie choice) and YouTube or Google Maps only when you choose to load them. See the Cookie Policy.
4.6 When you contact us directly
If you email, call or message us on WhatsApp, we receive what you send us, such as your name, number, email address and message.
5. Why we use it, and our legal bases
| Purpose | Data | EU/UK GDPR (Art. 6(1)) | Brazil LGPD (Art. 7) |
|---|---|---|---|
| Replying to your enquiry, arranging a site survey, preparing a proposal | Form data, contact data | (b) steps taken at your request before a contract | V: preliminary procedures for a contract, at your request |
| Following up on an enquiry you sent us | Contact data, project details | (f) legitimate interests: handling our sales enquiries | IX: legitimate interest |
| Protecting the form and the site from spam, bots and attacks (including Cloudflare) | Hashed IP, IP and request data, user agent, security result, logs | (f) legitimate interests: security | IX: legitimate interest |
| Keeping a record that you confirmed reading this policy | Policy version, timestamp | (f) legitimate interests: accountability | IX: legitimate interest |
| Measuring visits to improve the site (Google Analytics) | Analytics data | (a) consent, plus ePrivacy/PECR consent | I: consent |
| Loading YouTube and Google Maps | See Cookie Policy | (a) consent | I: consent |
| Meeting legal duties, and handling legal claims | As needed | (c) legal obligation; (f) legitimate interests | II: legal obligation; VI: exercise of rights |
Turkish legal bases are in the Turkish policy (Kişisel Veri Politikası).
The tick box on our form confirms that you have read this policy. It is not a request for consent, and we don't need your consent to reply to you.
No marketing. We do not send newsletters or marketing messages, and we don't collect consent for them on the website.
No automated decisions. We do not make decisions about you by automated means only, and we do not profile you.
Your right to object. Where we rely on legitimate interests, you can object at any time on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds or need the data for legal claims (GDPR Art. 21). Email winecellars@ardinart.com.
6. Notice at collection (California)
This section is our notice at collection under the California Consumer Privacy Act (CCPA), as amended by the CPRA. It applies to the enquiry form and to browsing the site.
| Category of personal information | Examples | Purpose | Sold or shared? | Kept for |
|---|---|---|---|---|
| Identifiers | Name, email, phone, hashed IP address, analytics ID (only with consent) | Replying to your enquiry; security; site statistics | No | Enquiries 24 months; analytics 2 months; rate-limit data 24 hours |
| Professional information | Company, role | Replying to your enquiry | No | 24 months |
| Commercial information | Project needs, budget intent | Preparing a proposal | No | 24 months (longer if you become a customer, as tax and commercial law require) |
| Internet or network activity | Pages viewed, form steps, browser type, request logs | Security; site statistics (only with consent) | No | Analytics 2 months; logs as set by the hosting provider and Cloudflare |
| Approximate geolocation | Country/city derived from IP | Site statistics (only with consent) | No | 2 months |
We do not collect sensitive personal information. We do not sell or share personal information, including that of consumers under 16. Full details are in the rest of this policy; your rights are in §10.2.
7. How long we keep it
| Data | Period |
|---|---|
| Enquiries in our enquiry log | 24 months from the date received, then deleted automatically by a daily clean-up |
| Enquiry emails in our mailboxes | 24 months |
| Enquiries that become a customer relationship | For the contract period and then as Turkish commercial and tax law requires (generally 5 to 10 years) |
| Rate-limit records (hashed IP and timestamps) | 24 hours |
| Google Analytics event data | 2 months |
| Server and Cloudflare logs | As set by the hosting provider and Cloudflare |
| Server backups | No longer than the periods above |
| Your cookie choice | 12 months |
8. Who receives it
We don't sell or rent your personal data, and we don't share it for advertising. Our staff who handle enquiries can see it. We also use these service providers, who process it for us under contract:
| Provider | What for | Location |
|---|---|---|
| Veridyen | Hosting the website and the enquiry log | Türkiye |
| Cloudflare, Inc. | Security, content delivery (CDN), security cookies and the Turnstile anti-bot check on the form | United States and Cloudflare's global network |
| Yandex 360 for Business (contracting entity for international customers: Air Smart Advertising Solutions FZ-LLC, Dubai) | Sending form enquiries by email and hosting our company mailboxes (@ardinart.com) | United Arab Emirates; Yandex's terms allow sub-processors, including in Russia. |
| Google LLC (Google Analytics 4) | Visit statistics, only with your consent | United States and other Google locations |
When you choose to load a YouTube video or a Google Map, Google receives your data as an independent controller under its own policy.
We may also disclose data to courts, public authorities or professional advisers where the law requires it or to protect our legal rights.
9. International transfers
We are based in Türkiye, and the website and enquiry log are hosted in Türkiye. When you send us an enquiry from abroad, your data comes to Türkiye.
- EU/EEA and UK. The European Commission has not adopted an adequacy decision for Türkiye, and the UK has not made adequacy regulations for Türkiye. We protect your data as described in this policy wherever it is.
- Cloudflare and Google (United States). Where the GDPR or UK GDPR applies, we rely on Cloudflare, Inc.'s and Google LLC's certification under the EU-U.S. Data Privacy Framework and its UK Extension, and on the Standard Contractual Clauses (and UK Addendum) in their data processing terms (the Cloudflare Data Processing Addendum and the Google Ads Data Processing Terms) as a fallback.
- Yandex (United Arab Emirates, possibly Russia). Neither country has an EU or UK adequacy decision. We are reviewing the safeguards for this transfer.
- Türkiye. Transfers from Türkiye abroad follow Article 9 of Law No. 6698 (KVKK) as amended in 2024. For regular transfers we rely on the standard contracts published by the Turkish Data Protection Board. Signing these contracts and notifying them to the Authority (within five business days of signing) is in progress.
- Brazil. Transfers follow LGPD Art. 33, using standard contractual clauses under ANPD Resolution CD/ANPD No. 19/2024 where needed.
You can ask us for a copy of, or information about, these safeguards at winecellars@ardinart.com.
10. Your rights
You can use these rights free of charge. We may need to check your identity first. We will not treat you differently for using them.
10.1 EU, EEA and UK
You have the right to:
- access your data and get a copy;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it;
- data portability: receive data you gave us in a machine-readable format;
- object to use based on our legitimate interests (see the box in §5);
- withdraw consent at any time (for analytics: "Cookie preferences" in the footer), without affecting what we did before.
We reply within one month, or up to two more months for complex requests, in which case we tell you why.
You can complain to your local data protection authority (list: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) or, in the UK, the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/). We would welcome the chance to help first.
10.2 United States
Depending on the state you live in, you may have the right to:
- know and access what personal information we hold about you and how we use it;
- delete it;
- correct it;
- opt out of the sale or sharing of personal information, targeted advertising and profiling. We do none of these, but you can still ask, and we honour the Global Privacy Control signal;
- not be discriminated against for using your rights;
- appeal if we refuse your request: reply to our decision email with "Appeal" and we will review it within 45 days. If we still refuse, you can contact your state Attorney General.
In the last 12 months we collected the categories listed in §6, from you and your device, for the purposes in §5, and disclosed them for business purposes only to the service providers in §8. We did not sell or share personal information.
You can make a request by email (winecellars@ardinart.com), by phone (+90 212 646 42 66) or by post (address in §2). You can use an authorised agent; we will ask for proof of authorisation. We aim to reply within 45 days (extendable by 45 days with notice).
Comprehensive state privacy laws (such as California's CCPA/CPRA) apply only to businesses above certain size thresholds. We offer these rights to all U.S. visitors regardless.
10.3 Brazil (LGPD)
Under LGPD Art. 18 you have the right to:
- confirmation that we process your data;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- portability to another provider;
- deletion of data processed with your consent;
- information about the public and private entities we share data with;
- information about the option not to consent, and what follows if you don't;
- revocation of consent.
You can also object to processing based on another legal basis if it does not comply with the LGPD (Art. 18, §2). We confirm or give access straight away in simplified form, or within 15 days in full (Art. 19). We make no decisions based solely on automated processing (Art. 20). You can petition the Autoridade Nacional de Proteção de Dados (ANPD): https://www.gov.br/anpd.
10.4 Other South American countries
If you live in Argentina, Chile, Colombia, Peru, Uruguay or another country with a data protection law, you have similar rights of access, correction, deletion and objection. Contact us and we will apply the rights available to you.
10.5 Türkiye
Visitors in Türkiye have the rights in Article 11 of Law No. 6698 (KVKK). The Turkish policy (Kişisel Veri Politikası) explains them and how to apply: Kişisel Veri Politikası.
10.6 How to make a request
Email winecellars@ardinart.com with the subject "Privacy request", call +90 212 646 42 66, or write to the address in §2. Tell us what you want and how we can reach you. To protect you, we will usually confirm your request from the email address or phone number you used in your enquiry.
11. Children
The site is for adults planning homes, hotels, restaurants and yachts. It is not aimed at children under 16, and we don't knowingly collect their data. If you think a child has sent us data, contact us and we will delete it.
12. Security
We use HTTPS throughout. The enquiry log is stored outside the public part of the web server, IP addresses are kept only in hashed form, and access is limited to the people who need it. No system is completely secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires.
13. Changes
We will update this policy when our practices change, and change the date above. If a change is significant, we will show it on the site.
14. Contact
winecellars@ardinart.com · +90 212 646 42 66 ARDİNART SOĞUTMA SİSTEMLERİ SAN. TİC. LTD. ŞTİ., İkitelli OSB Mahallesi, Marmara Sanayi Sitesi L Blok No: 36-37, 34307 Küçükçekmece, Istanbul, Türkiye