Base jurídica KVKK y RGPD

What this covers

ShelfTap collects company contact information that has already been published by the company itself — on its website, in a business directory, on a map listing or in a trade register. Most of it is not personal data at all. Some of it is: a named person on a "contact us" page, a personal-format mailbox, a direct line. This page sets out why we believe we may process that subset, under Article 6(1)(f) GDPR (legitimate interests) and Article 5(2)(d) and 5(2)(f) of Türkiye's KVKK (data made public by the data subject; legitimate interest of the controller).

1. Purpose test — is the interest legitimate?

Yes. Business-to-business supplier and buyer discovery is a lawful commercial activity. Exporters need to know which companies in a market plausibly use their product before they spend money approaching them. The interest is our own and our customers'. It is not speculative: the same information is what a salesperson would collect manually from the same public pages.

2. Necessity test — is processing necessary?

Yes, and it is minimised. A company cannot be contacted without a contact route, and there is no less intrusive way to produce a contactable shortlist than to read the contact page the company published. We therefore restrict what we store:

• We prefer role mailboxes (info@, export@, satis@) over named individuals, and we label which is which rather than presenting a generic mailbox as a decision-maker.
• We store the source URL for every fact, so any entry can be traced and challenged.
• We do not collect special-category data, consumer data, private telephone numbers or home addresses.
• We do not buy or ingest purchased contact lists.
• Where a person's name is recorded, it is recorded in their professional capacity only.

3. Balancing test — does our interest override their rights?

Factors that favour processing:

• The data was published by the company for exactly this purpose — to be contacted about business.
• The context is professional, not private. There is no processing of an individual's personal life.
• The impact of appearing in a B2B index is low: a business email about a product they may buy.
• Nothing is used for automated decisions with legal effect about an individual.
• Nothing is sold on. Data is shared only with the sub-processors listed on the Subencargados del tratamiento page.

Factors that weigh against, and what we do about them:

• The individual did not choose to be in our index. We therefore accept opt-out, correction and deletion requests from anyone, without requiring an account, proof of legal interest or a stated reason — see Eliminar o corregir la ficha de una empresa.
• Aggregation increases impact. We limit stored fields to what is needed to contact and qualify a company, and publish the retention windows on the Conservación de Datos page.
• Data can be wrong. Every published row carries its evidence and verification status, and a correction route is one click from the listing.
• Scraping can be intrusive. Our crawler respects robots.txt, is rate limited, is capped by page count and byte size, and never attempts authentication.

On balance we consider the processing proportionate for professional contact data that the company published itself. Where an individual objects, we do not re-run the balancing test against them — we remove the entry.

4. Transparency

Because the data is not collected from the data subject, Article 14 GDPR applies. This page and the Política de Privacidad are the notice: they name the controller, the purpose, the legal basis, the recipients, the retention period and the rights, and they are reachable from every page of the site. Where we send a first outreach email ourselves, we identify the source of the contact in that message.

5. Rights and how to use them

Objection, erasure, restriction and rectification requests are handled through Eliminar o corregir la ficha de una empresa or by writing to privacy@shelftap.com. Türkiye-based data subjects may also apply to us under KVKK Article 11 and, if unsatisfied, complain to the KVKK Board. EEA and UK data subjects may complain to their supervisory authority or the ICO.

6. Review

This assessment is reviewed whenever the collection scope changes and at least once a year. The review date is the "last updated" date at the top of this page.