Information notice under Turkish Personal Data Protection Law No. 6698 (KVKK)
This notice is provided under the duty to inform in Article 10 KVKK. It also contains the information required by Articles 13–14 GDPR and by Georgian law.
Data controller
For the purposes of KVKK, the GDPR and Georgian law, the controller of your personal data is:
- Company
- VIANOVA TRADING LLC, trading as “ViaNova Logistics”
- Address
- Petre Kavtaradze St. No 31, Apt No: 10, Tbilisi 0186, Georgia
- info@vianovalog.com
- Website
- www.vianovalog.com
The company was founded in 2023. We do not publish a telephone line, so please send any question about personal data by e-mail or post. In this notice, “ViaNova”, “we” and “us” refer to the data controller.
Back to contentsPersonal data we process and how we collect it
We collect personal data electronically, through the forms on our website, the shipment tracking page, correspondence and server logs, to the extent that you, your company or the logistics partners involved in a shipment provide it to us.
| Source | Data processed |
|---|---|
| Freight quote form (Türkiye–Spain line page) | Transport direction, service type, loading and delivery city and postcode, number and type of packages, total weight, pallet dimensions, stackability, cargo ready date, extra services requested, company name, contact person, phone, e-mail, free-text notes, page language |
| Contact form (homepage) | Name, company (optional), e-mail, phone (optional), message, page language |
| Shipment tracking | The shipment/order number you enter; messages you post on the shipment page (the name you enter and the message text) |
| Shipment records | Records we keep to perform the transport: customer company, origin and destination, cargo details, shipment documents, milestones and the contact person details for the shipment; the name, phone number and vehicle registration of the drivers assigned to the shipment |
| Technical data | IP address, browser/user agent, requested URL and time in web server and application logs; IP addresses are also held briefly in memory to prevent abuse |
| Browser storage | On your own device only: your language preference and your recently tracked shipments. This is not sent to us (see section 5) |
The public tracking page and its PDF show shipment information only. Internal notes and driver or contact person details never appear there.
Fields marked with an asterisk (*) on our forms are required; without them we cannot answer your request or prepare a quote. All other fields are optional.
We do not ask for special categories of personal data (such as health or biometric data); please do not enter such information in forms or messages.
Back to contentsPurposes of processing
We process personal data only for the following purposes:
- Answering your requests and preparing freight quotes
- Planning, performing and documenting shipments (transport, warehousing, consolidation, customs coordination)
- Customer communication and shipment tracking
- Meeting our legal obligations (commercial, accounting, tax and customs records)
- Information security and the prevention of fraud and abuse
- Backups and business continuity
We do not send marketing e-mails, so we do not ask for marketing consent. We do not take decisions about you based solely on automated processing.
Back to contentsLegal bases
We rely on the following legal bases under Article 5(2) KVKK and Article 6(1) GDPR:
| Purpose | KVKK art. 5(2) | GDPR art. 6(1) |
|---|---|---|
| Answering requests and preparing quotes | (c) establishing a contract; (f) legitimate interest (general enquiries) | (b) pre-contractual steps; (f) legitimate interests (general enquiries) |
| Planning, performing and documenting shipments | (c) establishing or performing a contract | (b) performance of a contract |
| Customer communication and shipment tracking | (c) performing a contract; (f) legitimate interest | (b) performance of a contract; (f) legitimate interests |
| Commercial, accounting, tax and customs records | (ç) legal obligation; (e) establishing, exercising or protecting a right | (c) legal obligation; (f) legitimate interests (defending claims) |
| Security and the prevention of fraud and abuse | (f) legitimate interest | (f) legitimate interests |
| Backups and business continuity | (f) legitimate interest | (f) legitimate interests |
Legal bases under Article 5(2) KVKK
- (c) the processing of personal data of the parties to a contract is necessary, provided that it is directly related to establishing or performing that contract
- (ç) the processing is necessary for the controller to comply with a legal obligation
- (e) the processing is necessary to establish, exercise or protect a right
- (f) the processing is necessary for the controller’s legitimate interests, provided that the data subject’s fundamental rights and freedoms are not harmed
Our legitimate interests are the security of our systems and data, the prevention of abuse, the defence of legal claims and business continuity.
Under the Georgian Law on Personal Data Protection (2023), processing relies on the corresponding legal bases of that law (contract, legal obligation and legitimate interest).
Back to contentsCookies and browser storage
Our website uses no cookies. No analytics, advertising or social-media trackers and no third-party fonts or scripts are loaded; every file is served from our own server.
For convenience only, the following is kept in your browser’s local storage (localStorage):
| Item | Purpose | Where it is kept |
|---|---|---|
| Language preference | Remembering the language you chose (including on the tracking pages) | On your device only |
| Recently tracked shipments | Quick access to shipments you viewed recently (up to 5 entries: shipment number, origin/destination and status) | On your device only |
This information is not sent to us. You can remove it at any time by clearing this site’s data in your browser settings.
Back to contentsRecipients of personal data
We do not sell personal data. We share it only with the following recipients, and only to the extent needed for the purpose concerned:
| Recipient | Purpose | Location |
|---|---|---|
| Carriers, freight agents, customs brokers, warehouses and other logistics partners | Transport, warehousing and customs handling of the shipment concerned, only to the extent needed for that shipment | Türkiye, Spain, France, Georgia and the transit/destination countries of the shipment |
| Contabo GmbH | Hosting of the web and application server | France (EU) |
| Niobe Bilişim Ltd. Şti. | E-mail service | Istanbul, Türkiye |
| Google (Google Drive) | Storage of backups (business continuity) | May be outside the EU |
| Public authorities (e.g. customs) | Where required by law | Country concerned |
International transfers
The controller is based in Georgia, our server is in France, our e-mail service is in Türkiye and our partners operate in several countries. Your personal data is therefore transferred across borders.
These transfers are made, in line with Article 9 KVKK (as amended in 2024) and Chapter V GDPR, with the safeguards required by applicable law (e.g. adequacy decisions, standard contractual clauses) or, where the law allows, because the transfer is necessary for the contract with you.
Back to contentsRetention periods
We keep personal data only for as long as the purpose requires or the law prescribes:
| Data | Retention period |
|---|---|
| Quote and contact requests that do not lead to a business relationship | 2 years from the request, then deleted automatically from our system. Request e-mails are deleted from our mailboxes at the end of the same period. |
| Shipment/order records and documents | As long as the applicable commercial, tax and customs laws require |
| Server and application logs | About 14 days; rotated daily, then deleted |
| IP addresses used for abuse protection | Briefly, in memory only |
| Backups | For as long as needed for business continuity; used only to restore data |
| Browser storage | Until you delete it, on your device only |
When a period ends, the data is deleted or destroyed. Deleted data may remain in backup copies for some time; these copies are kept only for restoring data and are accessible only to authorised staff.
Back to contentsData security
The main technical and organisational measures we take to protect your personal data:
- HTTPS across the whole site (encrypted connections)
- Backups with access restricted to authorised staff
- Access to the admin system limited to authorised staff with strong passwords
- Least-privilege access
- Rate limiting and a strict content security policy (CSP)
Your rights
Your rights under Article 11 KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed;
- request information about the processing if it is;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request rectification of incomplete or inaccurate data;
- request erasure or destruction of the data under the conditions of Article 7 KVKK;
- request that rectification, erasure or destruction be notified to the third parties to whom the data was transferred;
- object to an outcome against you that arises solely from the analysis of the data by automated systems;
- claim compensation for damage suffered because of unlawful processing.
Your rights under the GDPR
Under Articles 15–22 GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and under Article 77 the right to lodge a complaint with a supervisory authority. You may object, on grounds relating to your particular situation, to processing based on legitimate interests.
Your rights under Georgian law
The Georgian Law on Personal Data Protection gives you the equivalent rights, including access, rectification and erasure.
Back to contentsHow to exercise your rights
To exercise your rights, send your request by one of the following means. Please include your name, contact details, what your request is about and, if relevant, the shipment number concerned.
- E-mail: write to info@vianovalog.com with the subject “Personal data request”. For requests under KVKK, please use the e-mail address you have previously given us and that is in our records, or sign your request with a secure electronic or mobile signature.
- Post: send a signed written request to VIANOVA TRADING LLC, Petre Kavtaradze St. No 31, Apt No: 10, Tbilisi 0186, Georgia.
- GDPR and Georgian law: for requests under these laws, an e-mail to info@vianovalog.com is sufficient.
We reply within 30 days (KVKK) / one month (GDPR), free of charge unless the law allows a fee. We may ask for additional information to verify your identity.
Back to contentsRight to complain
You can lodge a complaint about the processing of your personal data with:
- Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu)
- European Union: the supervisory authority of the EU member state where you live (e.g. AEPD in Spain, CNIL in France)
- Georgia: the Personal Data Protection Service of Georgia
Under Article 14 KVKK, you must first apply to us before you can complain to the Turkish Personal Data Protection Board. If your request is rejected, you find our answer insufficient or we do not reply within 30 days, you may complain to the Board within 30 days of learning of our answer and in any case within 60 days of your request. Your right to complain directly under the GDPR and Georgian law is not affected; we would still welcome the chance to resolve your concern first.
Back to contentsChildren
Our website and services are aimed at businesses. They are not directed at children, and we do not knowingly collect personal data from children.
Back to contentsChanges to this notice
We may update this notice when our services or the law change. The current version is always published on this page; the “Last updated” date at the top shows the latest change.
Back to contents