Privacy Policy

1. Introduction

Asatoil ("Company," "we," "us," or "our") is committed to protecting your personal data and respecting your privacy.

As an international commodity trading company engaged in the trade of crude oil, petroleum products, natural gas, metals and agricultural commodities, we process personal data in the course of our commercial, contractual and regulatory activities.

2. Data Controller

The data controller responsible for your personal data is:

• Asatoil
• Registered Office: Şişli, Istanbul, Turkey
• Email: info@asatoil.com

3. Personal Data We Collect

We may collect, process, and store the following categories of personal data:

3.1 Information You Provide Directly

• Identity and contact information (name, title, date of birth, passport or ID details)
• Professional information (company name, position, business registration details)
• Financial and banking information for transaction processing
• Contractual and transaction records
• Communications and correspondence
• Due diligence and KYC (Know Your Customer) information
• Beneficial ownership information
• Anti money laundering (AML) documentation

3.2 Information Collected Automatically

• Website usage data (IP address, browser type, operating system, access times)
• Cookies and similar tracking technologies
• Device and connection information

3.3 Information from Third Parties

• Public registers and databases
• Credit reference and screening agencies
• Sanctions lists and watchlists
• Business partners and counterparties
• Regulatory and law enforcement authorities

4. Purposes of Processing

We process your personal data for the following purposes:

4.1 Primary Business Activities

• Conducting international commodity trading operations
• Executing purchase, sale, supply, and distribution agreements
• Transit trade, merchanting, and offshore trading activities
• Procurement, sourcing, and supply chain management
• Logistics coordination and transportation arrangements
• Contract negotiation, execution, and management
• Market research and analysis
• Price discovery and trading operations

4.2 Legal and Regulatory Compliance

• Compliance with Turkish Commercial Code and related legislation
• Anti money laundering (AML) and counter terrorist financing (CTF) obligations
• International sanctions screening and compliance
• Know Your Customer (KYC) and due diligence requirements
• Tax reporting and compliance
• Customs and trade documentation
• Regulatory reporting obligations

4.3 Business Operations

• Managing business relationships with producers, suppliers, distributors and traders
• Risk management and assessment
• Credit evaluation and financial controls
• Internal administration and record keeping
• IT system security and fraud prevention
• Business continuity and disaster recovery

4.4 Communications

• Responding to inquiries and requests
• Sending business related communications
• Marketing and promotional activities (with your consent where required)
• Industry updates and market intelligence

5. Legal Basis for Processing

Under KVKK and GDPR, we process personal data based on:

• 5.1 Legal Obligation: Compliance with Turkish law, international regulations, and applicable legal requirements.
• 5.2 Legitimate Interest: Pursuing our legitimate business interests as an international commodity trading company.
• 5.3 Contract Performance: Processing necessary for the performance of contracts.
• 5.4 Consent: Your explicit consent where required by law, particularly for specific processing activities.

6. International Data Transfers

As a global trading company operating across multiple jurisdictions, your personal data may be transferred to:

• Our offices in Turkey and the United Kingdom
• Business partners, suppliers, and counterparties in Africa, the GCC, Asia and Europe
• Third party service providers located in various countries
• Regulatory authorities and government agencies as required by law

We ensure appropriate safeguards are in place for international data transfers, including:

• Adequacy decisions by relevant authorities
• Standard contractual clauses
• Binding corporate rules where applicable
• Your explicit consent for specific transfers

7. Data Recipients

We may share your personal data with:

7.1 Internal Recipients

• Board of Directors and authorized signatories
• Employees, contractors, and agents with a need to know
• Group companies and affiliates

7.2 External Recipients

• Banks and financial institutions
• Logistics providers and shipping companies
• Inspection and certification agencies
• Legal and professional advisors
• Insurance companies
• Customs authorities and government agencies
• Regulatory bodies and compliance organizations
• IT service providers and data processors
• Auditors and accountants

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, taking into account:

• Duration of contractual relationships plus statutory limitation periods
• Compliance with legal, accounting, and reporting requirements (typically 10 years)
• AML/KYC obligations (minimum 5 to 10 years depending on jurisdiction)
• Tax and customs record keeping requirements
• Defense of legal claims

Upon expiration of retention periods, data is securely deleted or anonymized.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Secure data storage and backup systems
• Network security and firewalls
• Physical security measures
• Employee training and confidentiality obligations
• Regular security assessments and audits
• Incident response and breach notification procedures

10. Your Rights

Under KVKK and GDPR, you have the following rights:

• 10.1 Right to Information: Request information about whether your personal data is being processed.
• 10.2 Right to Access: Access your personal data and obtain information about processing.
• 10.3 Right to Rectification: Request correction of inaccurate or incomplete data.
• 10.4 Right to Erasure: Request deletion of your personal data under certain circumstances.
• 10.5 Right to Restrict Processing: Request limitation of processing activities.
• 10.6 Right to Data Portability: Receive your data in a structured, commonly used format.
• 10.7 Right to Object: Object to processing based on legitimate interests.
• 10.8 Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• 10.9 Right to Lodge a Complaint: File a complaint with the Turkish Personal Data Protection Authority or your local supervisory authority.

To exercise your rights, contact us at: info@asatoil.com

We will respond to your request within 30 days as required by KVKK, or within one month under GDPR.

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Ensure website functionality
• Analyze website usage and performance
• Enhance user experience
• Deliver relevant content and advertising

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

12. Third Party Websites

Our website may contain links to third party websites. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their privacy policies before providing them with personal data.

13. Children’s Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements or other factors. The date at the top of this page indicates when it was last revised, and any material changes will be communicated through this page.

15. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact:

For Turkish residents, you may also contact the Turkish Personal Data Protection Authority (KVKK Kurumu) at www.kvkk.gov.tr.

For EU residents, you may contact the relevant data protection supervisory authority in your EU member state.