Privacy Policy
This Privacy Policy explains how IMICRYL DENTAL A.Ş. ("IMICRYL", "we", "us") collects, uses, shares and protects personal data when you apply for an account, sign in and place orders on the IMICRYL B2B Sales Portal at order.imicryl.com (the "Portal"). It is provided in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").
1. Who we are
The data controller responsible for your personal data is:
Konya Organize Sanayi Bölgesi, Vezirköy Cad. No:2, Selçuklu / Konya, Türkiye
Phone: +90 332 239 06 14
E-mail: export@imicryl.com
The Portal is a business-to-business ordering platform intended for dental dealers, clinics, laboratories, hospitals, universities and dental professionals. It is not intended for consumers or for persons under 18.
2. Data we collect
Information you give us
- Membership application and account details: account type, company / clinic / institution name, contact person's full name, e-mail address, phone number, country, city, address and, optionally, tax office and tax / VAT number.
- Sign-in details: your e-mail address or customer code and your password. Passwords are stored only in irreversibly hashed form; we cannot see them.
- Order information: the products, quantities, prices, order notes and changes you make to your orders.
- Communications: messages you send us by e-mail or phone about your account or orders.
Information created when you use the Portal
- Account records: your customer code, assigned price list, account status, and the date your application was reviewed.
- Technical data: your IP address and basic request information (date, time, page requested, browser type) processed by our servers for security, abuse prevention (for example, limiting repeated membership applications from the same network) and troubleshooting.
We do not use analytics, advertising or tracking tools on the Portal, and we do not collect special categories of personal data (such as health data) through it.
3. Signing in with Google, Apple, Facebook or X
You can choose to sign up or sign in with a Google, Apple, Facebook or X account instead of a password. If you do:
- You are redirected to that provider, which asks for your permission. We never see your password for that account.
- We receive only basic profile information: a unique user identifier from the provider, your name and, if the provider shares it, your e-mail address and whether it has been verified. We request no other permissions; we do not access your contacts, posts, photos or friends, and we never post on your behalf.
- If you choose Apple's "Hide My Email" option, we receive a private relay address created by Apple, which forwards messages to you.
- We store the provider's name, your user identifier and the e-mail address received so that we can recognise you the next time you sign in. If a verified e-mail address matches an existing IMICRYL account, the sign-in is linked to that account.
- New sign-ups through a provider are still reviewed and must be approved by IMICRYL before the account can be used.
The provider processes your data under its own privacy policy: Google, Apple, Meta (Facebook), X. You can withdraw the Portal's access at any time from your account settings with that provider; see Deleting your data.
4. Why we use your data
| Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|
| Reviewing your membership application and verifying that you are a dental business or professional | Steps taken at your request before entering into a contract; our legitimate interest in selling only to professional customers |
| Creating and managing your account, signing you in, showing you the prices of your assigned price list | Performance of a contract |
| Receiving, changing, confirming, invoicing and delivering orders; preparing proforma invoices | Performance of a contract; compliance with legal obligations |
| Communicating with you about your application, account and orders | Performance of a contract; our legitimate interest |
| Keeping commercial, accounting and tax records | Compliance with legal obligations (e.g. Turkish Commercial Code and Tax Procedure Law) |
| Protecting the Portal against misuse, fraud and unauthorised access | Our legitimate interest; compliance with legal obligations |
| Establishing, exercising or defending legal claims | Our legitimate interest; establishment, exercise or protection of a right |
We do not sell your personal data, use it for advertising, or make decisions about you based solely on automated processing.
5. Cookies and browser storage
The Portal uses only cookies and browser storage that are strictly necessary for it to work. They are not used for tracking or advertising.
| Name | Purpose | Duration |
|---|---|---|
| customer_token | Keeps you signed in | 7 days, or until you sign out |
| oauth_state | Protects sign-in with Google, Apple, Facebook or X against forgery | 10 minutes |
| social_signup | Remembers your verified provider details while you complete the membership form | 30 minutes |
| Local storage: shopping cart | Keeps your shopping cart and order changes on your device until you submit them | Until you clear it or submit the order |
The Portal loads fonts from Google Fonts, which means your browser connects to Google's servers and Google receives your IP address. See Google's Privacy Policy.
6. Who we share data with
We share personal data only where necessary for the purposes above:
- Service providers acting on our instructions, such as server hosting and IT support providers.
- The sign-in provider you choose (Google, Apple, Meta or X), to the extent needed to complete the sign-in.
- Logistics and freight companies, customs brokers and banks, to deliver your orders and process payments.
- Our professional advisers (such as auditors and lawyers), under confidentiality obligations.
- Public authorities and courts, where required by law.
7. International transfers
As an exporter, we work with customers and service providers in many countries. Your data may therefore be processed outside your country, including outside Türkiye and the European Economic Area, for example by our hosting provider, by the sign-in provider you choose, or by carriers delivering your order. Where such transfers take place, we rely on the safeguards required by applicable law, such as standard contractual clauses, or on the transfer being necessary to perform our contract with you.
8. How long we keep data
- Account data: for as long as your account is active, and afterwards for as long as needed for the purposes it was collected for or required by law.
- Orders and related commercial records: for the periods required by commercial and tax law (in Türkiye, generally 10 years).
- Membership applications that are not approved: only for as long as necessary to handle the application and any follow-up; you can ask us to delete them at any time.
- Linked sign-in accounts: until you unlink them, your account is deleted, or you ask us to remove them.
- Server logs: for a limited period for security and troubleshooting.
When the retention period ends, data is deleted, destroyed or anonymised.
9. Security
We protect your data with appropriate technical and organisational measures, including encrypted (HTTPS) connections, hashed passwords, encrypted storage of sign-in provider keys, access limited to authorised staff, and administrator approval for new accounts. No method of transmission or storage is completely secure, so please keep your password confidential and tell us immediately if you suspect unauthorised use of your account.
10. Your rights
Subject to the conditions of applicable law (KVKK Article 11 and, where applicable, GDPR Articles 15–22), you have the right to:
- learn whether your personal data is processed and request information about it;
- learn the purpose of processing and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction of incomplete or inaccurate data;
- request deletion or destruction of your data;
- request that third parties to whom data was transferred be notified of corrections or deletions;
- object to a result against you arising exclusively from automated processing;
- claim compensation for damage caused by unlawful processing;
- where the GDPR applies: restrict processing, object to processing based on legitimate interests, and receive your data in a portable format.
To exercise your rights, e-mail export@imicryl.com from the e-mail address registered to your account, or write to the address in section 1. We will respond within 30 days. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, if you are in the EU/EEA, with your local data protection authority.
11. Deleting your data
You can ask us to delete your account and personal data at any time, including data received through Google, Apple, Facebook or X sign-in:
- Send an e-mail to export@imicryl.com with the subject "Data deletion request", from the e-mail address registered to your account (or the address your sign-in provider shared with us). Include your company name and, if you have one, your customer code.
- We may contact you to verify your identity before deleting anything.
- We will delete your account and linked sign-in data and confirm by e-mail within 30 days. Records we are legally required to keep, such as orders and invoices, are retained for the legal period and then deleted.
You can also remove the Portal's access from your sign-in provider at any time: Google account connections; on Apple devices, Settings → [your name] → Sign in with Apple (or account.apple.com); Facebook → Settings → Apps and websites; X → Settings → Connected apps. Removing access there stops future sign-ins but does not delete the data we already hold; to delete it, follow the steps above.
12. Changes and contact
We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last changed; significant changes will be announced on the Portal. For any questions about this policy or your personal data, contact us at export@imicryl.com.