Draft. This text was prepared on the basis of a legal assessment; it will be reviewed by a lawyer before general availability. The Turkish version prevails.
This privacy notice explains, under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), how the personal data of Kira Takip users and of visitors to its website (kiratakip.tr) is processed. Version: 2026-11-03.
1. Data controller
E Pazaryeri Teknoloji Çözümleri Limited Şirketi, Merkez Mah. Firuze Sk. Dap Vadisi S Ofis No:5 İç Kapı No:59 Kağıthane/İstanbul. Contact: emediaturkiye@gmail.com.
For the data of tenants, guarantors and other persons recorded by organizations, the data controller is the relevant organization (the property owner); the Platform processes this data only on its instructions. These persons exercise their rights against the relevant organization.
2. Personal data processed
- Identity and contact: name, email address, language and time zone preference.
- Account security: a one-way hash of the password, two-step verification data, session and sign-in records (IP address, browser and device information), security events.
- Activity records: the audit log of changes you make in the app.
- Mobile device: if the mobile app is used, device information and the notification token.
- Billing: if you subscribe, billing details (for individuals name and Turkish identity number; for companies legal name, tax office and tax number; address, phone, billing email), payment and refund records, issued invoices and the pre-information form you approve before paying. Card details never reach us; they are entered in the payment institution's form and kept there.
- Consents: acceptance of the terms of service, presentation of this notice and the marketing email permission (with version and time).
- Website visitors: when you visit the website, your IP address, browser information, the requested address and the time are written to the server logs. The website uses no advertising or analytics cookies; if you choose a theme, your choice is kept only in a cookie that remembers it, which our server does not read or store (cookie policy).
- Correspondence: if you email us (for example to request early access), your email address, name and the content of your message.
3. Purposes and legal grounds
- Opening the account, providing the service and sending you notifications: conclusion and performance of the contract (KVKK Art. 5/2-c).
- Account security, prevention of abuse and audit logs: legitimate interest (Art. 5/2-f).
- Security of the website and servers, detection of attacks and errors (server logs): legitimate interest (Art. 5/2-f).
- Answering early access requests, questions and suggestions: directly related to the conclusion of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).
- Running the subscription, payments and refunds: conclusion and performance of the contract (Art. 5/2-c).
- Issuing invoices and keeping billing records (Tax Procedure Law, Turkish Commercial Code): legal obligation (Art. 5/2-ç).
- Product news and offer emails: only if you give explicit permission (Law No. 6563); you can withdraw it at any time in your account settings.
4. How data is collected
Your data is collected electronically through the registration form, your use of the app, visits to the website, the emails you send us and automatic records kept for security. The app uses only cookies that are strictly necessary for it to work and the cookie that remembers the theme you chose; the website uses only the theme cookie.
5. Transfers
Your data may be transferred to the service providers we use to provide the service (sub-processors) and, where required by law, to competent authorities:
- Hosting: the app, the website and the database run on Hostinger's server in Germany.
- Email: account, notification and reminder emails are sent through Google's email service (Gmail); emails you send us are also kept there.
- Backup: the off-server copy of the database and document backups is kept encrypted on Google Drive; we hold the key, and Google cannot read the content of the backup.
Because these providers are located abroad, the transfer is made under KVKK Art. 9 with the standard contract set by the Personal Data Protection Board. The current list of sub-processors is published on the website.
If you subscribe, your data is transferred to the payment institution (iyzico) for payment, to the accounting software (Paraşüt) for invoicing and, through it, to the Revenue Administration as an e-invoice or e-archive invoice. The mobile notification service may be located abroad; in that case that transfer is also made with the safeguards of KVKK Art. 9.
6. Retention
- Account information is kept while the account is open; when the account is deleted, personal fields are anonymized.
- Session and sign-in records are kept for 1 year after the session ends; account security records for 2 years.
- Server logs (IP address, browser information, address and time of requests to the website and the app) are kept for 90 days.
- Marketing permission records are kept for 3 years after the permission ends.
- Billing records (subscription, payments, refunds, invoices and the pre-information approval) are kept for 10 years even if the organization is deleted, and then deleted.
- Backups are kept for at most 35 days; deleted data may remain in backups for this period.
7. Your rights
Under KVKK Art. 11 you have the right to learn whether your data is processed, to request information, to request correction or deletion, to learn to whom it is transferred, to object and to claim compensation for damage. You can send your requests to emediaturkiye@gmail.com; they are answered within 30 days at the latest.