Privacy Policy

Disclosure Text on Protection and Processing of Personal Data

Effective Date: October 17, 2025

This Disclosure Text, as Royalyat Turizm Gıda Sanayi Ticaret Limited Şirketi (data controller), aims to inform about the processing and transfer of personal data obtained during the use of Bodrumdabirev.com website and any mobile applications in accordance with Article 10 of Law No. 6698.

1. Data Controller and Contact

• Company Name: Royalyat Turizm Gıda Sanayi Ticaret Limited Şirketi
• Address: Arnavutköy Mahallesi Eğlence Sokak No:14/1 Beşiktaş / İstanbul
• Tax Office: Beşiktaş Vergi Dairesi
• Tax No: 8590549659
• Mersis No: 0859054965900011
• Trade Registry No: 747173
• Phone: 0850 307 77 77
• Email: info@bodrumdabirev.com
• KEP Address: royalyatturizmgidasanayi@hs01.kep.tr
• This service provider is registered with ETBİS.

2. Scope

This text applies to individual and corporate users and other third parties visiting the Portal. The Portal is a real estate listing and communication platform.

3. Personal Data Categories Processed

• Identity and contact data: Name, surname, T.R. ID number (when mandatory, front page of ID document), date of birth, company name, tax number, tax office, email, phone, address, billing information.
• Account and authentication data: Username, password, two-factor authentication information, trusted devices, e-government verification status and GUID generated by e-government, to the extent necessary.
• Customer transaction data: Listing contents, listing history, authorization certificates and power of attorney documents, title deed or representation authority documents (when necessary, uploaded with masking so that non-personal data sections are visible), rejection reasons, store and sub-user relationships, notification preferences, favorites, comments and ratings, call center history, profile photo if any.
• Communication and messaging data: In-Portal messages, questions and answers, notification records, call center voice recordings, support requests and feedback.
• Transaction security data: IP records, device and browser information, session records, access logs, and traffic records within the scope of Law No. 5651.
• Location data: On the site, if the user prefers, approximate location and data used to verify listing location. In the BodrumdaBirEv Pro app, when an agent creates a portfolio and has allowed location access, the device's precise location is saved as the property's location and the district and neighbourhood are derived from it. The location is taken only at that moment; no location is collected in the background and no location history is kept. It is kept until the portfolio is deleted; the site shows a hidden-location listing at an offset position.
• Room scan data (Pro): On iPhones with LiDAR, a floor scan saves the room measurements and floor plan geometry derived from the property's walls, doors and windows on the server. The raw scan, camera images and AR map stay on the device. This data is kept until the portfolio or the floor plan is deleted.
• App usage data: Events in the mobile apps are stored with the user ID to measure the product: in the Pro app the event name and limited measurements (for example a portfolio draft's duration and photo count), in the customer app only the event name and time. Events carry no name, phone number, e-mail or listing content and are not used for advertising or tracking. They are deleted after 180 days, and at once when the account is deleted.
• Error and diagnostic data: App error reports (error message, screen context, app version) and crash and performance summaries are sent with e-mail addresses, phone numbers, Turkish ID numbers and session data removed. They are kept in the system logs for at most 90 days. The error tracking service (Flare) receives only the user's ID number, never the name or e-mail; it keeps reports for the service's retention period.
• Notification data (mobile apps): When notifications are allowed, the device's push token is saved with the session: on iPhone the Apple Push Notification service (APNs) token, on Android the Google Firebase Cloud Messaging (FCM) token. Notifications reach the device through these services; their text carries no contact name, phone number or e-mail address. The token is deleted on sign-out or 24 hours after the session expires. No advertising identifier is collected.
• Payment and billing data: When paid services are used, invoice information, collection and receipt information, transaction numbers.
• Marketing data: If explicit consent is given, commercial message permissions, campaign participation information and interactions.
• Cookie data: Usage data obtained through cookies and similar technologies. Details are in the Cookie Policy and Management Panel.

4. Collection Methods

Data is obtained through Portal forms and messaging areas, call center and support channels, e-government integration, log records and cookies, and from payment institutions for paid services.

5. Processing Purposes

• Account creation and user verification: Establishment and performance of the contract, identity verification, secure login and authorization controls.
• Listing and moderation: Creating, editing, publishing listings, auditing compliance with standards, preventing suspicious transactions.
• Communication and customer relations: Managing requests and complaints, informational messages, support services, satisfaction studies.
• Security and fraud prevention: Obligations under 5651, system security, risk and compliance audits, bot and abuse detection.
• Billing and collection: Providing paid services, collection and refund processes, accounting transactions.
• Marketing and personalization: Campaign notifications, user segmentation and measurement if explicit consent is given. Consent can be withdrawn at any time.
• Analysis and product development: Usage statistics, measuring experience, improving service quality.
• Legal obligations: Storage, audit, reporting, mandatory notification and responding to requests.

6. Legal Grounds

Personal data is processed pursuant to Article 5 of the Law for establishment and performance of the contract, where explicitly provided by laws, fulfilling the data controller's legal obligation, establishing, exercising or protecting a right, and when necessary for our legitimate interests. Commercial electronic messages and marketing activities are conducted only with explicit consent. Special categories of personal data are not processed; in mandatory cases, they are processed in compliance with legal requirements and limited.

7. Transfers

• IT and infrastructure providers: Hosting, cloud, backup, and security service providers.
• Customer relations and support providers: Call center, live chat, email, and ticketing system providers.
• Payment institutions and financial service providers.
• Legal, financial consulting, independent audit, and consultancy: Persons and organizations from whom services are obtained.
• Authorized public institutions: Courts, enforcement offices, and regulatory authorities.
• Printing and promotional suppliers: Limited data sharing for providing printed materials ordered at user request.
• Error tracking service provider (Flare): Masked error records used to fix site and app errors; the provider may be located abroad (section 8).
• Notification services (Apple, Google): The device's push token and the notification text, to deliver the mobile apps' notifications; the providers may be abroad (section 8).
• Artificial intelligence service providers: Only the information listed in section 15, for photo editing and listing text suggestions started by the user in the Pro app; the providers' servers are abroad (section 15).

8. International Transfers

Support may be received from suppliers located abroad for services such as hosting, storage, call centers, marketing, and analytics. In such cases, transfers are made within the scope of standard contracts announced by the Board pursuant to Article 9 of the Law or with your explicit consent. Transfer basis and supplier information will be provided upon request.

9. Retention Periods

Account and transaction data may be retained for the general statute of limitations period from the end of the contractual relationship. Traffic records under Law No. 5651 are retained for at least one year, and accounting and commercial records for up to ten years under the Tax Procedure Law and the Turkish Commercial Code. As a listing platform we are required to keep the following records for 10 years from the transaction: your identity details verified through e-Devlet (name, surname, Turkish ID number, mobile phone), the authority and listing checks made through e-Devlet and their results, listing records with their change and price history, and complaint records. The legal basis is Article 12(2) of the Regulation on Real Estate Trade and Article 33(6) of the Regulation on Electronic Commerce Intermediary Service Providers and Electronic Commerce Service Providers under Law No. 6563; the processing condition is Article 5(2)(ç) of the KVKK (legal obligation) and Article 5(2)(e) (establishing, exercising or defending a right). Only our authorised administrators can access these records; where the law requires, they may be disclosed on request to competent public authorities, in particular the Ministry of Trade. While your account and listings are active, a live listing page is public. Once you delete your account or a listing, these records are shown nowhere else and are kept until the end of the period. When you delete your account, your profile and contact details, profile photo, favorites, saved searches, contact book, notes, documents and the Pro videos of your portfolios are deleted; your listings are taken off the site and marked as deleted. At the end of the period the data is deleted, destroyed or anonymised.

Listing records and their change history (the previous and new values of changed listing fields, price changes, the account that made the change and the time) are stored; the values in the change history are encrypted. Only our authorised administrators can see the change history; it is not shown to the listing's owner or editors. These records are kept for 10 years from the transaction, or from the listing's deletion when that is later; before that period ends, listings and their history are not permanently deleted, including when you delete your account.

10. Rights and Application Procedure

Pursuant to Article 11 of the Law, you have the right to learn whether your data is processed, request information if processed, learn the purpose of processing and whether it is used appropriately, know third parties to whom it is transferred domestically or abroad, request correction if processed incompletely or incorrectly, request deletion or destruction, object to adverse results from automated systems analysis, and claim compensation if you suffer damage. Applications can be submitted in Turkish in writing by mail or to info@bodrumdabirev.com with secure electronic signature. Applications are finalized within thirty days at the latest. Responses are free for up to ten pages; the Board tariff applies for each additional page. Information and documents to verify your identity may be requested.

12. Third-Party Links

The Portal may contain links to third-party sites. We are not responsible for the privacy practices of these sites. We recommend that you review the policies of those sites separately.

13. Updates

This Disclosure Text may be updated in parallel with service and regulatory changes. The new version takes effect on the date it is published on the Portal.

1. Introduction

As BodrumdaBirEv ("we", "us", "our"), we respect the privacy of our users ("you", "your") and are committed to protecting your personal data. This Privacy Policy is intended to inform you about the information we collect, use, and protect when you use our website.

This policy has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK") and related legislation.

2. Data Collected

We may collect the following information when you use our website:

• Personal Information: Name, surname, email address, phone number
• Contact Information: Address, city, postal code
• Account Information: Username, password (encrypted)
• Transaction Information: Search history, favorite listings, messages
• Technical Information: IP address, browser type, operating system, visit durations
• Cookie Information: Site usage preferences, session information

3. Purposes of Data Use

We use the data we collect for the following purposes:

4. Data Security

The measures we take to protect your personal data include:

• Encrypted connection with SSL certificate
• Secure data storage systems
• Regular security updates
• Limited access authorizations
• Notification within 72 hours in case of a data breach

5. Cookies

The types of cookies used on our website are:

When you are signed in, your cookie choice (whether you allow functional, performance and marketing cookies, and when you chose) is saved to your account and applied on the other devices where you sign in. You can change it at any time with the "Cookie Settings" link at the bottom of the page.

6. Your Rights

You have the following rights under the KVKK:

7. Contact

You can contact us for questions about our privacy policy: