Privacy Policy and KVKK Notice

1. PURPOSE AND SCOPE
This notice explains how personal data is processed when you use the EmlakDiyo mobile app, emlakdiyo.com, the web panel, or the EmlakDiyo Quick Portfolio browser extension. It is not a blanket consent form. Where consent is required, it is requested separately before the relevant processing starts; refusing consent does not prevent access to core features that do not rely on consent.

2. DATA CONTROLLER AND CONTACT
Tolgahan Sönmez
Eroğlan Mah. İbni Sina Cad., Edremit / Balıkesir, Türkiye
Email: info@emlakdiyo.com
Phone: +90 542 774 42 70
The activity is registered with Türkiye's Electronic Commerce Information System (ETBİS).

3. CONTROLLER / PROCESSOR ROLES
EmlakDiyo is the data controller for account, subscription, service-security, and product-operation data.

For client, seller, buyer, and prospect records entered by a real-estate agent or office, that agent or office is the controller and EmlakDiyo acts as its processor solely to provide the service and follow authorized instructions. EmlakDiyo does not use these records for its own marketing or create a shared cross-office contact pool. Listing/request sharing occurs only when an authorized user initiates it and within the selected visibility.

Agents and offices remain responsible for informing their own clients and establishing the applicable legal basis and permissions.

4. DATA WE PROCESS
4.1. Account and office data
- Name, email address, phone number, and profile photo
- Office/company details, membership, role, and permissions
- Professional authorization or TTBS verification details where required
- Subscription plan, store, product, transaction, and purchase-verification data

4.2. User-created business content
- Portfolio/listing details, descriptions, address, coordinates, photos, and video
- Client, buyer, seller, and prospect records; phone/email, notes, tags, and interaction history
- Contacts imported from the device only when the user selects them
- Appointments, tasks, reminders, follow-ups, sale-chain, and team records
- Office invitations, network/group posts, and interactions
- Contract, document, or file content where the feature is used
- If the finance module is used, voluntarily entered cash/bank account name, IBAN, current-account and transaction details, invoice/receipt number, and tax or Turkish ID number

4.3. Technical, security, and usage data
- IP address, request time, device/operating system, app, and browser version
- Session tokens and authentication/refresh records
- Push-notification device token where permission is granted
- Error, performance, security, abuse-prevention, and rate-limit records
- If public-site analytics consent is granted: page, referrer, basic interaction, browser/device, and approximate location information

4.4. Location, maps, radar, and valuation
- Coordinates/address may be processed when you grant location permission or select a listing location. The app does not continuously track background location.
- To display maps and search addresses, coordinates, search text, visible map region, and limited device/request information may be sent to Apple Maps. If the fallback map is used, tile requests and the IP address may reach OpenStreetMap infrastructure.
- When Location Radar is started, the selected or device location is sent to EmlakDiyo's server-side radar engine to calculate nearby school, health, park, transport, coast, and similar measurements.
- When Property Valuation is started, only property characteristics required for the estimate (for example region/location, type, attributes, area, rooms, and building details) are sent to the server-side valuation engine. Contacts, client notes, and payment information are not part of the valuation request.
- Radar and valuation results are approximate decision-support outputs, not an official appraisal, land-registry/cadastral record, or legal opinion.

4.5. Caller ID and device permissions
- Contacts access is used only with permission to import selected contacts into CRM or add a contact to the device address book.
- If Android Caller ID is separately enabled, CRM phone numbers and labels selected by the user are placed in a local matching list on the device. Incoming numbers are compared locally. EmlakDiyo does not record call audio, block calls, or upload call history for this feature.
- Camera, photo, and microphone permissions are used only when the user starts photo/video capture or selection. Notification permission is controlled in device settings.

4.6. Data we do not collect
EmlakDiyo does not collect credit/debit-card numbers, expiry dates, CVV codes, or online-banking credentials. It does not use advertising identifiers or advertising tracking.

4.7. Quick Portfolio browser extension
- The extension runs only when the user clicks its icon on a supported listing page; it does not monitor browsing history in the background.
- It may read the open page URL, portal listing ID, title, type/category, province/district/neighbourhood, property attributes, price, and description.
- This opens an editable draft in the web panel. It is not saved or shared until the user chooses to save it.
- Portal passwords, session cookies, payment information, personal address books, and listing photographs are not transferred by the extension.
- Draft data is carried in a URL fragment, which is not included in the first HTTP request, is removed from the address bar after reading, and is not stored persistently by the extension.

5. HOW DATA IS COLLECTED
Data is collected electronically through app/web forms, device permissions and user-initiated actions, store purchase verification, server security logs, authorized office-manager actions, and user-initiated extension drafts. Public-site analytics begins only after affirmative consent in the cookie panel.

6. PURPOSES AND LEGAL BASES
- Provide accounts, office membership, portfolio, CRM, appointments, team, network, radar/valuation, and support features: contract formation/performance (Turkish Law No. 6698, Art. 5/2-c)
- Verify subscriptions and store purchases: contract performance and legitimate interests in fraud prevention (Art. 5/2-f)
- Security, authentication, bot/abuse prevention, access logging, and continuity: legitimate interests and, where applicable, legal obligations
- Use location, contacts, and device features: the feature expressly initiated by the user and device permission; where consent is legally required, Art. 5/1
- Deliver notifications: service performance, subject also to operating-system permission
- Meet legal obligations and answer competent-authority requests: legal obligation
- Public-site analytics: explicit consent

7. RECIPIENTS AND SERVICE PROVIDERS
Personal data is not sold or shared for advertising. To the extent necessary to provide the service, data may be transferred to:
- Veridyen Bilişim Teknolojileri Sanayi ve Ticaret Limited Şirketi: server/hosting infrastructure in Türkiye. The database, authentication, file storage, and server functions run on infrastructure managed by EmlakDiyo; data is not sent to Supabase's cloud service.
- Netlen MailGuard / Tres Teknoloji A.Ş.: transactional email delivery in Türkiye (registration confirmation, password reset, email change, invitations, and account warnings).
- Google: Firebase Cloud Messaging; Google Play distribution, subscriptions, and purchase verification; Google Tag Manager/Analytics only after consent.
- Apple: App Store distribution, subscriptions, and purchase verification; Apple Maps/MapKit for maps and address search.
- Cloudflare: Turnstile bot and abuse verification.
- OpenStreetMap Foundation's public tile service: only for fallback map display when Apple mapping is unavailable.
- EmlakDiyo-controlled radar/valuation engine: user-initiated environment and approximate-price analysis.

Market/index data is retrieved from TÜİK and the Central Bank of the Republic of Türkiye/EVDS; EmlakDiyo does not intend to send user identity, contact records, or listing content to those sources. If the user opens land-registry/cadastral or third-party map links, the destination's own terms apply.

Data may also be disclosed to legally authorized public bodies when required, and to authorized office users according to role, ownership, and sharing settings. The system does not add client names or phone numbers to network request posts; users should not place personal data in free-text fields.

8. INTERNATIONAL TRANSFERS
The primary database, authentication, files, and transactional email are hosted in Türkiye. Use of global services such as Google/Firebase, Apple, Cloudflare, and OpenStreetMap may nevertheless result in limited data—such as IP address, device/request information, push token, store transaction information, map query, or coordinates—being processed abroad.

Regular transfers to such services must rely on a valid transfer condition and safeguard under Article 9 of Turkish Law No. 6698. If a standard contract is used, it must be executed and notified to the Turkish Data Protection Authority within five business days. Keeping a service enabled without the applicable transfer mechanism is not made lawful by this notice alone. An optional transfer that requires consent is not started before valid consent is obtained.

9. COOKIES AND SIMILAR TECHNOLOGIES
The web panel uses essential session and security technologies. Google Tag Manager/Analytics on the public website is loaded only after consent and is not loaded after rejection. The choice can be changed through “Cookie preferences.” Normal mobile-app screens do not use website cookies, but the Cloudflare Turnstile WebView opened for sign-in security may use cookies or local storage during verification. Details: emlakdiyo.com/en/cookies

10. RETENTION AND DELETION
- Account/profile data and user content are kept while membership and the relevant purpose continue.
- A warning is sent after 11 months without app/web activity. Personal content may be deleted only after 12 months of inactivity, successful warning delivery, and at least 30 days after the warning. New activity cancels the process. The login account, office membership, and shared office records are preserved in this automatic personal-content cleanup.
- Deleted personal portfolios may first be made inaccessible and permanently purged after 30 days.
- Field-scan history is purged after 90 days.
- Office invitation links last 24 hours; account-deletion confirmation lasts 5 minutes; sensitive-action reauthentication tokens last 10 minutes and are single-use. Expired/unused tokens are removed through cleanup processes.
- The device Caller ID list is removed when the feature is disabled, the user signs out, or device data is cleared.
- Push tokens are removed from the device registration on sign-out; provider-side deletion is subject to platform processing time.
- The account-deletion audit record is retained for at least 36 months. Store transaction identifiers are limited to the period necessary for duplicate/fraud prevention and legal obligations.
- Data remaining in inaccessible disaster-recovery backups may persist until the normal backup rotation expires.

Detailed periods and methods: emlakdiyo.com/saklama-imha

11. ACCOUNT DELETION
Delete an account in Settings > Delete Account or through emlakdiyo.com/delete-account. An owner of a multi-member office must transfer ownership first. Office portfolios remain with the authorized office account when an agent account is deleted. App Store/Google Play subscriptions must be cancelled separately in store settings.

12. SECURITY
- TLS in transit, role/permission checks, and database row-level security are used.
- Sensitive actions are verified server-side; rate limiting, bot protection, firewall controls, and access logs are used.
- Service secrets are not embedded in the client; store and map private keys remain on the server.
- Permissions are limited to what each feature requires.

No internet transmission can be guaranteed absolutely secure. Report suspected access or a data incident to info@emlakdiyo.com.

13. QUICK PORTFOLIO LIMITED USE
Data accessed by the extension is used only to provide and secure the user-initiated listing-draft feature. It is not used for advertising, profiling, credit assessment, unrelated purposes, or sale.

14. RIGHTS UNDER KVKK ARTICLE 11
You may ask whether your personal data is processed; request information; learn the purpose and whether it is used accordingly; learn domestic/foreign recipients; request correction; request deletion/destruction when conditions are met; request that corrections/deletions be notified to recipients; object to an adverse result produced solely by automated analysis; and seek compensation for unlawful processing.

Contact: info@emlakdiyo.com
After identity and scope verification, applications are answered within 30 days. A fee under the Authority's tariff may apply where the response creates an additional cost.

15. CHILDREN
The service is not directed to users under 18, and EmlakDiyo does not knowingly collect children's data.

16. CHANGES AND LANGUAGE
Material changes may be announced in the app, on the web, or by email. The current text is available in the app and at emlakdiyo.com/privacy-policy. If the Turkish and English texts conflict, the Turkish text prevails.