Data Processing Agreement

This agreement sets out how third-party data that real estate businesses using the BodrumdaBirEv Pro app and a professional account record on the platform is processed by Royalyat Turizm Gıda Sanayi ve Ticaret Limited Şirketi under Personal Data Protection Law No. 6698 (the "Law"). It is an annex to the Professional Account Agreement.

1. Parties

• Data controller: The real estate business using the professional account and the Pro app (the "Professional User"). For personal records not shared with the office, the agent who added the record is also bound by this agreement as data controller, as explained in Section 14 of the Disclosure Statement.
• Data processor: Royalyat Turizm Gıda Sanayi ve Ticaret Limited Şirketi ("Royalyat"), the operator of the BodrumdaBirEv platform.

2. Subject, Data and Purpose

• Data categories: Names, phone numbers, e-mail addresses and notes of the people in the contact book; links between people and portfolios and the notes on these links; portfolio documents (title deed, authorisation agreement, occupancy permit, ID copy, building fee letter and similar); portfolio notes and the private details of portfolios (commission, owner price, key location, viewing note and contract end date).
• Data subjects: Owners, prospective buyers and tenants, tenants, other people the Professional User records in its contact book and people named in documents.
• Purpose: Only the Professional User's management of its portfolios and client relations. Royalyat does not use this data for its own purposes; it does not show it on public listing pages, does not use it for marketing or product measurement and does not send it to the artificial intelligence service provider.

3. Instructions

• Royalyat processes the data only on the Professional User's instructions. Recording, changing, sharing with the office and deleting in the Pro app and on the platform count as the Professional User's instructions.
• If Royalyat considers an instruction to breach the Law, it informs the Professional User without delay and may decline to carry it out.
• Royalyat may disclose the data to competent authorities on their lawful request; unless prohibited by law, it informs the Professional User.

4. Confidentiality

• Royalyat and its staff with access to the data do not disclose the personal data they learn and do not use it outside the purpose of processing (Article 12(4) of the Law). This obligation continues indefinitely after the agreement ends.
• Royalyat staff may access the data only as far as needed to provide the service, support and security.

5. Security Measures

• Phone numbers, e-mail addresses and notes of contacts, notes on contact links, portfolio notes, key location and viewing note and document files are stored encrypted.
• Access is limited by office rules: contacts not shared with the office are visible only to the agent who added them, and contacts shared with the office to the office's active members. Portfolio documents, notes and private details are visible only to users with rights on the portfolio.
• Documents open only for an authorised user through a short-lived signed link. Every document access is logged.
• Connections between the platform and the app are encrypted. Details such as phone numbers, e-mail addresses and notes are masked or removed in system and error logs.
• For documents that may contain special categories of data, such as ID copies, the Professional User covers fields that are not needed (for example the religion field on old-style ID cards) before uploading.

6. Sub-processors

• Royalyat uses the following services to process this data: server (hosting) service; the content delivery and security network the platform and app traffic passes through (Cloudflare, which also has servers abroad); an error tracking service (Flare, which may be abroad; only error records with personal fields masked or removed). Contact book, document and note contents are not sent to e-mail, SMS or notification (push) services or to the artificial intelligence service provider.
• By accepting this agreement, the Professional User instructs Royalyat to use these sub-processors.
• Before adding a new sub-processor or replacing an existing one, Royalyat announces it on this page and to the registered e-mail address. The Professional User may object within a reasonable time; if the objection is not resolved, it may terminate the agreement.

7. Data Breaches

• When Royalyat learns of a breach affecting this data, it informs the Professional User without delay so that the notification to the Board can be made in time. The notice states the nature of the breach, the data categories affected, the known number of people and the measures taken and proposed. Notifying the Board and data subjects is the data controller's duty; Royalyat provides the information needed.

8. Data Subject Requests

• Requests about this data that reach Royalyat are forwarded to the Professional User. Records can be corrected and deleted in the Pro app; Royalyat provides reasonable technical support for answering requests.

9. Obligations of the Professional User

• The Professional User informs the people it records under Article 10 of the Law (within a reasonable time if the data was not obtained from the person), has a legal basis for the processing, obtains explicit consent where required and registers with the Data Controllers' Registry (VERBİS) if obliged to.
• The Professional User records only the data needed to manage portfolios and does not include personal data of third parties in listing photos, titles or descriptions.

10. Retention, Return and Deletion

• Contacts are kept until the Professional User deletes them. Portfolio private details, notes, documents and contact links are kept until the listing is permanently deleted or 30 days have passed since it was moved to the trash. Document access logs are kept for 365 days.
• When an office closes (the office owner deletes the account and no other active member remains, or the platform deletes the office), contacts shared with the office and the private details, notes, documents and contact links of office listings are deleted after 30 days; if the office reopens within this period, they are not deleted. The Professional User should copy the records it needs to its own records before closing its account.

11. Audit

• On the Professional User's written request, Royalyat provides within a reasonable time the information and documents that show compliance with this agreement. In investigations by the Board, the parties provide each other with the information needed.

12. Liability

• Under Article 12(2) of the Law, the parties are jointly responsible for data security measures. If one party pays an administrative fine or compensation because of the other party's breach of this agreement, it may recover the amount paid from the other party in proportion to fault.

13. Effect and Changes

• This agreement takes effect together with the Professional Account Agreement and stays in effect until deletion is complete after the account closes.
• Royalyat may change this agreement. Changes against the Professional User are announced on this page and to the registered e-mail address a reasonable time before they take effect. A Professional User who does not accept a change may terminate the agreement until the effective date. Continued use of the services after the effective date counts as acceptance of the change to the extent the law allows; where the law requires express acceptance, separate approval is asked for.