Published: April 2026

CHEMIKALIENEXPO.DE – PRIVACY POLICY

Last Updated: April 2026

Version: PP-2026-01

This Privacy Policy explains how SCMist ("we", "us", "our"), operating ChemikalienExpo.de and the following sister domains: scmist.com, sellchemicals.com, sellchemical.com, chemikalienexpo.com, chemikalienexpo.de, chemikalienkatalog.com, chemikalienkatalog.de — collects, uses, stores, and protects personal data. SCMist is a company registered in Canada (Ontario).

This policy applies to all users of kimyasanayii.com and complies with:

  • Turkey: KVKK (Law No. 6698 on Protection of Personal Data)
  • European Union: GDPR (General Data Protection Regulation)
  • Canada: PIPEDA (Personal Information Protection and Electronic Documents Act)
  • Brazil: LGPD (Lei Geral de Proteção de Dados)
  • United States: CCPA and applicable state laws

    • 1. DATA CONTROLLER

    SCMist

    Address: 100 Albert Street, Ottawa, ON, Canada

    Privacy Contact: privacy@scmist.com

    Where required by applicable law, users may contact us regarding personal data processing, rights requests, or complaints using the contact above.

    SCMist has not appointed a Data Protection Officer (DPO) where not legally required. If such appointment becomes mandatory, this policy will be updated accordingly.

    For KVKK purposes (Turkey): SCMist acts as the Data Controller (Veri Sorumlusu).

    For GDPR purposes (EU): SCMist acts as the Data Controller.

    Governing law: Ontario, Canada

    2. WHAT DATA WE COLLECT

    We collect and process only the minimum amount of personal data necessary to provide and operate the Platform in accordance with the purposes described in this Policy.

    2.1 Data You Provide Directly

    Registration data: first name, last name, corporate email address, company name

    Company profile data: company description, address, country, phone, website, logo, product/catalog information, certifications, documents

    Staff data (optional): name, title, department, LinkedIn URL, photo — only if the staff member provides granular consent individually

    Communication data: messages sent through inquiry forms or contact forms

    2.2 Data Collected Automatically

    Technical data: IP address, browser type, operating system, device type

    Usage data: pages visited, time spent, search queries, clicks

    Cookie data: session cookies, preference cookies (see Section 9)

    Login data: login timestamps, session tokens, last login date

    2.3 Data We Do NOT Collect

    We do not collect:

  • Payment card numbers (processed directly by Stripe — we receive only transaction status)
  • Government-issued ID numbers
  • Biometric data
  • Health or medical data
  • Personal email addresses (registration blocked for personal domains)

    • 3. HOW WE USE YOUR DATA

    3.1 To Provide the Service

  • Account creation and authentication
  • Company profile and catalog display
  • Enabling B2B inquiries and contact between parties
  • Banner advertising delivery

    • 3.2 To Operate the Platform

  • Platform security and fraud prevention
  • Technical maintenance and debugging
  • Performance monitoring and analytics

    • 3.3 To Comply with Legal Obligations

  • Consent record keeping (KVKK/GDPR requirement)
  • Response to lawful requests from authorities
  • Tax and billing compliance

    • 3.4 To Communicate with You

  • Transactional emails (registration, password reset, verification)
  • Service notifications (plan renewal, expiry warnings)
  • Legal notices (policy updates, re-confirmation requests)

    • We do NOT send marketing emails without your explicit consent.

    4. LEGAL BASIS FOR PROCESSING (GDPR / KVKK)

    4.1 Contract Performance

    Processing necessary to provide the service you registered for (account management, profile display, inquiry routing).

    4.2 Legal Obligation

    Processing required to comply with applicable laws (consent logging, tax records, authority requests).

    4.3 Legitimate Interests

    Platform security, fraud prevention, and service improvement — where these interests are not overridden by your rights.

    4.4 Consent

    Where we rely on consent (e.g., staff granular field-level data, optional profile fields, cookies beyond strictly necessary), you may withdraw consent at any time without affecting the lawfulness of prior processing.

    5. DATA RETENTION

    Account data: retained for the duration of the account, plus 2 years after deletion request

    Consent records: retained for 7 years (KVKK/GDPR legal requirement) — stored separately with restricted access and retained only as necessary for legal compliance obligations

    Company profile data: retained for account duration; soft-deleted on account closure

    Transaction/billing records: retained for 7 years (tax compliance)

    Server logs and IP data: retained for 90 days

    Inactive accounts: accounts with no login for 36 months may be flagged for deletion with prior notice

    6. DATA SHARING AND THIRD PARTIES

    We do not sell, rent, or trade personal data to third parties under any circumstances.

    We share data only with:

    6.1 Service Providers (Data Processors)

  • Stripe: payment processing (card data never reaches our servers)
  • Mailgun: transactional email delivery
  • Cloud hosting provider (OVH): server infrastructure
  • These processors are bound by data processing agreements.

    • 6.2 Legal Requirements

    We may disclose data when required by law, court order, or governmental authority. We will notify you where legally permitted.

    6.3 Business Transfer

    In the event of a merger, acquisition, or asset sale, user data may be transferred. Users will be notified in advance.

    7. INTERNATIONAL DATA TRANSFERS

    Your data may be processed in Canada, Turkey, EU member states, or other countries where our service providers operate. Where data is transferred outside your country, we ensure:

  • Adequate protection measures are in place
  • Standard contractual clauses or equivalent safeguards are used
  • Compliance with KVKK Article 9, GDPR Chapter V, and PIPEDA requirements
  • Where required, Standard Contractual Clauses (SCCs) or equivalent legal safeguards are used in accordance with applicable laws.

    • 8. YOUR RIGHTS

    8.1 Rights Under GDPR (EU Users)

  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent at any time
  • Right to lodge a complaint with your national supervisory authority

    • 8.2 Rights Under KVKK (Turkish Users)

    Under Article 11 of KVKK, you have the right to:

  • Learn whether your personal data is processed
  • Request information about the processing
  • Learn the purpose of processing and whether data is used accordingly
  • Know third parties to whom data is transferred
  • Request correction of incomplete or inaccurate data
  • Request deletion or destruction of data
  • Object to automated processing that produces adverse effects
  • Request compensation for damages caused by unlawful processing

    • KVKK requests must be submitted to privacy@scmist.com or through the Platform website. We will respond within 30 days.

    8.3 Rights Under PIPEDA (Canadian Users)

  • Right to access your personal information
  • Right to challenge accuracy and completeness
  • Right to withdraw consent (subject to legal and contractual restrictions)

    • 8.4 Rights Under CCPA (California Users)

  • Right to know what personal information is collected
  • Right to delete personal information
  • Right to opt-out of sale (we do not sell data)
  • Right to non-discrimination for exercising your rights

    • To exercise any right, contact us at privacy@scmist.com. We will respond within 30 days.

    9. COOKIES

    9.1 Strictly Necessary Cookies

    Required for the Platform to function. Cannot be disabled.

  • Session authentication token
  • Language preference
  • Theme preference

    • 9.2 Functional Cookies

    Enhance user experience. Can be disabled.

  • Remember me / persistent login
  • Last visited company/product

    • 9.3 Analytics Cookies

    Used to understand Platform usage. Disabled by default; enabled only with consent.

    We do not use third-party advertising cookies.

    Where required by applicable law, a cookie consent banner is presented to users on first visit, allowing them to accept or manage non-essential cookies.

    10. STAFF DATA AND GRANULAR CONSENT

    Staff members listed on company Team pages have individual control over their own data fields. Each staff member:

  • Provides explicit per-field granular consent
  • Can withdraw consent for individual fields at any time
  • Controls visibility of their name, title, photo, LinkedIn, and contact details

    • No company owner or platform administrator can override a staff member's individual field-level consent decision. All consent actions are logged with timestamps and are retained as required for legal compliance obligations.

    11. CHILDREN'S DATA

    The Platform is designed exclusively for business users and is not directed at individuals under the age of 18. We do not knowingly collect data from minors. If we become aware that a minor has registered, the account will be closed and data deleted.

    12. DATA SECURITY

    We implement appropriate technical and organizational measures to protect your data including:

  • HTTPS/TLS encryption for all data in transit
  • Bcrypt password hashing
  • IP-based rate limiting on authentication endpoints
  • Session token rotation and expiry
  • Role-based access control
  • Regular backups with offsite storage

    • No system is 100% secure. In the event of a data breach affecting personal data, we will notify affected users and relevant authorities without undue delay and within the timeframes required by applicable law (e.g., 72 hours under GDPR, where applicable).

    13. AUTOMATED DECISION-MAKING

    The Platform uses limited automated processing:

  • Response badge calculation (based on inquiry response times) — informational only, not used for access decisions
  • Account suspension triggers (based on detected abuse patterns) — always subject to human review

    • We do not use fully automated decision-making that produces legal or similarly significant effects without human review.

    14. CHANGES TO THIS POLICY

    We may update this Privacy Policy when required by law or operational changes. When material changes are made:

  • Users will be notified via email or platform notification
  • A new version will be published with an updated date
  • Re-confirmation of consent may be required for continued use

    • 15. CONTACT AND COMPLAINTS

    For privacy-related requests or complaints:

    Email: privacy@scmist.com

    Or contact us through the Platform website.

    If you are not satisfied with our response:

  • EU users may contact their national Data Protection Authority (DPA)
  • Turkish users may contact the Kişisel Verileri Koruma Kurumu (KVKK Kurulu): www.kvkk.gov.tr
  • Canadian users may contact the Office of the Privacy Commissioner of Canada: www.priv.gc.ca
  • California users may contact the California Privacy Protection Agency: www.cppa.ca.gov

    • 16. LANGUAGE AND INTERPRETATION

    This Privacy Policy is available in Turkish, English, and German. In case of conflict, the English version shall prevail.

    17. EFFECTIVE DATE

    This Privacy Policy is effective from April 2026. Use of the Platform constitutes acceptance of this policy.