KVKK Disclosure Notice

1. Identity of the data controller

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, the data controller with regard to your personal data processed in the Eskişehir Sosyal Şehir mobile application, the eskisehircebinde.com website and the attached panels (the "App") is identified below.

• Data controller: […]
• Address: […]
• Registry / tax details: […]
• Contact for requests: […]

The App is installed for one city only; this installation serves Eskişehir. This notice is not a summary of the Privacy Policy but the minimum information the law requires; the details are in the Privacy Policy, and the two are read together.

2. Categories of personal data processed

Depending on the features you use, personal data in the following categories is processed in the App. The data of a module you do not use is never created.

• Identity: name, username, date of birth, gender, profession (only the name is required).
• Contact: e-mail address, phone number, saved delivery addresses.
• Account and transaction security: password hash, session token, IP address, device and browser information, verification records, consent records, push token.
• Visual and audio records: profile photograph, the photographs and videos you upload, SAHNE contest photograph. No audio recording is processed; in a spoken question only the text your phone transcribes is received.
• User content: posts, comments, listings, messages, reviews, poll answers, confessions, questions asked to the assistant, game scores.
• Location: location rounded to an area of about 500 metres on the GALA live map; exact location at check-in and during a taxi trip.
• Customer transaction records: food and flower orders, taxi requests, tradesman requests, store purchase receipts, and for businesses card payment transaction records (excluding card data).
• Marketing and usage: content viewed, profile visits, videos swiped, the marketing consent you gave.
• Technical measurements: aggregated performance counts and scrubbed error records that carry no identity.

Special categories of personal data (health, religion, biometric data and the like) are not collected as profile data.

3. Purposes of processing

Your personal data is processed for the following purposes:

• Creating your account, verifying your identity and securing the account.
• Providing the services of the modules you choose: showing news and events, forwarding an order or taxi request to the relevant business or driver, publishing listings, messaging, community and contest features.
• Sending in-app notifications and, according to your preference, marketing messages.
• Content moderation, review of reports, prevention of abuse and application of sanctions.
• Recognising the digital entitlements you bought and tracking their duration; for businesses, running payment and invoicing processes.
• Measuring the service, fixing its errors and improving it.
• Responding to requests from competent authorities and fulfilling legal obligations.
• Establishing, exercising and protecting rights in disputes.

4. Legal bases

Under Article 5/2 of the KVKK your personal data is processed on the following legal bases without explicit consent:

• Formation or performance of a contract (Art. 5/2-c): the account, orders, taxi requests, purchases and business membership.
• Compliance with a legal obligation (Art. 5/2-ç): financial records, requests from competent authorities, statutory retention periods.
• Establishment, exercise or protection of a right (Art. 5/2-e): moderation, report and audit records.
• Legitimate interests of the controller (Art. 5/2-f): account security, prevention of abuse, measuring and sustaining the service.

Processing outside these — location sharing on the GALA live map, marketing messages, and transfers abroad to AI, spoken-reply and notification providers — rests on your explicit consent under Articles 5/1 and 9 of the KVKK. Explicit consent is obtained separately and freely on the relevant screens in the App; if you do not give it only that feature does not work, the rest of the App does. You can withdraw your consent at any time.

5. Transfer of personal data

Your personal data is transferred to the following groups of recipients only to perform the relevant function and only to the extent that function requires:

• Service providers (processors): object storage (the installation's own server or Cloudflare R2), notification delivery (Google Firebase Cloud Messaging), SMS (Netgsm), e-mail (Resend), weather (Open-Meteo; the city's fixed coordinate only), AI models for the city assistant (Google Gemini, Groq, Anthropic Claude — those the city administration enables), spoken reply (Google Cloud Text-to-Speech), store purchase management (RevenueCat, if the city administration chooses it), payment institutions for businesses' card payments (iyzico or PayTR).
• Stores: the Apple App Store and Google Play, as the merchant in in-app purchases.
• Platform services: your phone's operating system (Apple or Google) for speech recognition in a spoken question; Apple Maps or Google Maps for map tiles.
• Other users and businesses: the content you share, your profile, your name and delivery address on an order (to the relevant business), your name and pickup point on a taxi request (to the accepting driver).
• Competent public institutions: where legislation requires it.

Some of the providers above are established abroad; to that extent data is transferred abroad within the meaning of Article 9 of the KVKK. This transfer rests on your explicit consent or on the other conditions the law provides.

6. Method of collection

Your personal data is collected electronically, by fully or partly automated means: directly from you when you fill in registration and profile forms, share content, place orders, send messages and use the App's features; automatically through your device's operating system permissions (location, notifications, microphone); through the receipt returned by Apple and Google on store purchases; and through the transaction result returned by the payment institution on business card payments. The App uses no third-party advertising or analytics trackers.

7. Retention periods

Data is kept for as long as necessary for the purpose it is processed for and for the retention periods legislation requires. The periods of automatically deleted records (live-map shares and stories 24 hours, profile visits 90 days, post views up to 180 days, swipe records 45 days, backups 14 days, performance totals 8 days, error records 30 days) and the anonymisation applied 30 days after account deletion are set out in detail in the Privacy Policy.

8. Your rights under Article 11 of the KVKK

By applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used in accordance with that purpose,
• know the third parties to whom it is transferred domestically or abroad,
• request correction if it is incomplete or incorrectly processed,
• request erasure or destruction under the conditions of Article 7 of the KVKK,
• request that correction, erasure and destruction be notified to the third parties it was transferred to,
• object to a result against you produced by analysing the processed data exclusively through automated systems,
• claim compensation if you suffer damage due to unlawful processing.

9. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller you can send your requests in writing to […], or by registered electronic mail (KEP) or from the e-mail address registered in the App to […]. Your application must contain your name and surname, your signature if it is in writing, your Turkish identity number for citizens of the Republic of Türkiye or your nationality and passport number or identity number if any for foreigners, your address for service, your e-mail address and phone number for notification if any, and the subject of your request.

Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature; if the operation requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, your right to lodge a complaint with the Personal Data Protection Board is reserved.

You can correct your profile details, make your account private, switch off profile-view tracking, turn off notifications and delete your account yourself from within the App without making an application. For general support use destek@eskisehircebinde.com.