This notice is for people in the European Union, the European Economic Area and the United Kingdom who visit roicool.com (the "Site"), contact us or work with us. It explains how we process your personal data under the EU General Data Protection Regulation ("GDPR") and the UK GDPR with the Data Protection Act 2018. It adds to our KVKK Privacy Notice, which describes every processing activity in detail; where the GDPR gives you more rights, this notice applies.
1. Who we are
The controller is Milore Tekstil Gıda ve Toptan Ticaret Limited Şirketi ("Roicool"), a company registered in Türkiye, registered address Halil Rıfat Paşa Mah. Yüzer Havuz Sok. Perpa Ticaret Merkezi No:1 İç Kapı No:2072, 34384 Şişli / Istanbul, Türkiye, e-mail info@roicool.com. Roicool is the brand under which the company provides digital marketing, SEO, GEO, web and software services. We have no establishment in the EU or the UK.
2. Our representatives in the EU and the UK
We have not appointed a representative in the EU or the UK under Article 27 of the GDPR or of the UK GDPR. For anything in this notice, including data protection questions, contact the company at info@roicool.com.
3. What we process, why and on what lawful basis
| Purpose | Data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Answering a contact, proposal or meeting request; preparing a proposal | Name, e-mail, message; optional company, phone, website, service of interest; page, language, time, browser | Steps at your request before a contract (6(1)(b)); our legitimate interest in answering business enquiries (6(1)(f)) |
| Giving you an e-book or a free-tool report | Name, e-mail, company, optional phone; which e-book; the report's score and band | Steps at your request (6(1)(b)) |
| Following up a business enquiry in our CRM | The enquiry details above | Legitimate interest in B2B follow-up (6(1)(f)); you can object at any time |
| Partner program applications and registrations | Applicant and company details; a registered prospect's contact | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Marketing e-mails (and SMS on the partner form) | Name, e-mail, phone, the record of your opt-in | Consent (6(1)(a)), given with a separate unticked box |
| Site analytics (Google Analytics 4) | Usage data, device and browser data, analytics IDs | Consent (6(1)(a)) under ePrivacy Art. 5(3) / PECR reg. 6, given in the cookie banner |
| Ad measurement (Google Ads, Meta) | Ad click IDs, Meta cookies, a SHA-256 hash of your e-mail and phone when you submit a form | Consent (6(1)(a)), given in the cookie banner |
| Security of the Site and forms | IP address (briefly; hashed in abuse logs), Cloudflare Turnstile signals | Legitimate interest in security (6(1)(f)) |
| Accounting and legal duties | Contract and invoice records | Legal obligation (6(1)(c)) |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for that assessment. We do not ask for special categories of data and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies
Under the ePrivacy Directive (Article 5(3)) and the UK Privacy and Electronic Communications Regulations (PECR), we store or read information on your device only when it is strictly necessary for the Site, or with your consent. Every analytics and marketing cookie is off until you switch it on; "Reject" is as easy as "Accept"; Google Consent Mode v2 starts with every signal denied; you can withdraw consent at any time through "Cookie settings" at the foot of every page. Details and durations are in our Cookie Policy.
5. Who receives your data
Our processors: hosting (Hetzner Online GmbH, Germany, EU; our CRM, open-source Twenty, and our server-side tag manager run on the same server), e-mail delivery (Resend, Plus Five Five, Inc., US), Cloudflare, Inc. (US: DNS, content delivery, firewall, form security and encrypted backups), Sentry (error monitoring, no personal data) and, with your consent, Google and Meta (analytics and advertising). Also our professional advisers and public authorities where the law requires it. We do not sell personal data.
6. International transfers
We are based in Türkiye, for which the European Commission and the UK have made no adequacy decision. When you send us data, you send it to us in Türkiye directly. Our processors in the United States receive data under the EU–US Data Privacy Framework and its UK Extension where they are certified, or else under the European Commission's Standard Contractual Clauses (with the UK Addendum or the UK International Data Transfer Agreement). You can ask us for a copy of the safeguards. How data leaves Türkiye under Turkish law is explained in International Data Transfers.
7. How long we keep data
Enquiries in the Site's records are anonymised 24 months after we receive them; other periods are in our Data Retention and Destruction Policy.
8. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your personal data and get a copy (Art. 15);
- have it corrected (Art. 16) or erased (Art. 17);
- restrict its processing (Art. 18);
- receive it in a portable format, where processing rests on consent or contract and is automated (Art. 20);
- object at any time to processing based on legitimate interests, and always to direct marketing (Art. 21);
- withdraw your consent at any time, without affecting earlier processing (Art. 7(3)).
Write to info@roicool.com or to our representative. We answer within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity.
9. Complaints
You can complain to a supervisory authority, in particular in the EU or EEA country where you live or work or where you think the infringement happened (Art. 77 GDPR), or, in the UK, to the Information Commissioner's Office (ico.org.uk). We would welcome the chance to address your concern first.
10. Changes
We update this notice when our processing changes; the current version and its date are on this page. All our legal texts are on Legal.