KVKK Privacy Notice

1. Data Controller Information

2. Personal Data Processed

The following categories of personal data are processed via the KeyBrox platform:

2.1. Identity Data

First name, surname, Turkish ID number (T.C. kimlik no — only for contractual and accounting transactions), date of birth, gender, profile photo.

2.2. Contact Data

Phone number, e-mail address, business address, WhatsApp contact information.

2.3. Location Data

GPS coordinates (panic button, viewing report/zabıt, AR price analysis), IP-based approximate location, property visit locations.

2.4. Financial Data

Commission amounts, turnover figures, stakeholder split ratios, invoice details (VAT-inclusive/exclusive), payment history, bank account details (only for offices with active accounting integration).

2.5. Professional Data

Real-estate consultancy licence information, office assignment, performance metrics (XP, badges, assist chain, turnover leaderboard rank), viewing records, customer portfolio, listing information.

2.6. Digital Trace Data

Session information (JWT token metadata), browser/device information (user agent), application usage statistics, push notification subscription records (OneSignal subscription ID), cookie data, IP address.

2.7. Visual and Audio Data

Profile photo, virtual-tour panoramic images, the signature image (base64) in the viewing report/zabıt, mediation evidence (images, audio recordings, screenshots).

2.8. Special Categories of Personal Data

No special categories of personal data (race, ethnic origin, political opinion, philosophical belief, health data, etc.) are processed across the platform. Such data may appear in content voluntarily shared by the parties during a mediation process; in that case, the explicit-consent mechanism under KVKK Article 6 applies.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

1. Service delivery: Platform access, CRM operations, commission calculation, portfolio matching, management of customer relationships.
2. Contractual obligations: Fulfilment of the membership agreement, data processing agreement and SLA commitments.
3. Legal obligations: Tax legislation (VUK), the Turkish Commercial Code, MASAK regulations, requirements of the Turkish Code of Obligations No. 6098.
4. Security: Emergency notification via the panic button, location sharing, escalation chain; platform security audits and access controls.
5. Performance and gamification: Data processing for motivation modules such as XP, badges, assist chain, goal wheel, hall of fame and cheer wall.
6. Communication: Push notifications (OneSignal), e-mail notifications, SMS (optional), in-app messaging.
7. Analytics and reporting: Office performance reports, market pulse, regional analysis, turnover leaderboard, agent performance evaluation.
8. Dispute resolution: Mediation board, evidence collection, timeline creation, data processing for the broker’s decision.
9. Product development: Platform improvement based on anonymous usage statistics (no individual identification is performed).
10. Marketing (with explicit consent): Promotional notifications, feature announcements, satisfaction surveys. Applied only to users who have given explicit consent.
11. Protection of legal rights: Retention of data as evidence in potential disputes.

4. Legal Bases for Processing Personal Data

The following legal bases under KVKK Article 5/2 apply:

5. Method of Collecting Personal Data

Your personal data is collected through the following channels:

• Directly: Platform registration form, profile update, transaction entry, viewing record, mediation application.
• Automatically: Cookies, device information, IP address, GPS (where the user has granted permission), push notification subscription records.
• Third parties: Agent information entered by the broker/office manager, real-estate listing data, OneSignal notification metrics.

6. Transfer of Personal Data

6.1. Domestic Transfer

Personal data may be transferred to the following parties under KVKK Article 8:

• Broker office manager: In the multi-tenant structure, each broker can access the performance and transaction data of their own agents (joint data controllership).
• Authorized public authorities: Upon a court order, prosecutor’s request or legal obligation (MASAK, Tax Office, SGK).
• Business partners: The payment processor Paddle.com Market Limited (acting as Merchant of Record for billing and cross-border tax handling), SMS/e-mail providers.

6.2. International Transfer

Under KVKK Article 9, data is transferred to the following technical infrastructure providers:

For international data transfers, EU Standard Contractual Clauses and additional technical measures (encryption, pseudonymization) are applied to meet the adequate-protection conditions set out in KVKK Article 9. Content transferred to the AI assistant (Google / Gemini) is not used by the provider for model training.

7. Multi-Tenant Data Controllership Structure

• ASTRAL GAYRİMENKUL DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ (Platform Operator): Responsible for technical infrastructure, data security, backups, access control and platform-wide data processing. Acts as the “Data Processor” under KVKK.
• Broker Offices (Tenants): Primarily responsible for processing the personal data of the agents and customers within their own virtual office. Act as the “Data Controller” under KVKK.
• Joint Data Controllership: For platform-wide gamification data (leaderboard, XP, hall of fame), evidence data consolidated during mediation, and inter-office matching operations, ASTRAL GAYRİMENKUL DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ and the relevant broker office act as “Joint Data Controllers”. In that case, the allocation of responsibilities between the parties is determined by the Data Processing Agreement.

8. Data Retention Periods

Personal data whose retention period has expired is deleted, destroyed or anonymized within the periodic destruction process (in six-month cycles). Upon termination of membership, data is irreversibly destroyed within 90 days at the latest; items that are legally required to be retained are archived for the applicable statutory periods.

9. Rights of the Data Subject

Pursuant to KVKK Article 11, data subjects whose personal data is processed have the following rights:

1. To learn whether their personal data is being processed
2. To request information if their personal data has been processed
3. To learn the purpose of processing and whether the data is used in accordance with that purpose
4. To know the third parties to whom personal data is transferred, domestically or abroad
5. To request rectification where personal data has been processed incompletely or inaccurately
6. To request erasure or destruction of personal data under KVKK Article 7
7. To request that rectification and erasure operations be notified to the third parties to whom the data was transferred
8. To object to a result against the person arising from analysis of the processed data solely by automated systems
9. To claim compensation for damage suffered due to unlawful processing of personal data

10. How to Exercise Your Rights

Pursuant to KVKK Article 13, you may use one of the following methods to exercise the rights listed above:

10.1. Application Methods

10.2. Application Process

• Identity verification is carried out for the application (a copy of the Turkish ID or platform authentication).
• Applications are answered free of charge within 30 days at the latest (KVKK Article 13/2).
• If the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
• If your request is rejected, you have the right to file a complaint with the Personal Data Protection Board within 30 days of notification of the decision.

11. Data Security Measures

The following technical and administrative measures are applied to protect your personal data:

11.1. Technical Measures

• Encryption of data in transit with TLS 1.3
• Session cookie encryption with AES-256-GCM
• Hashing of passwords with bcrypt (never stored in plaintext)
• Encryption at the database level (encryption at rest)
• JWT (JSON Web Token) based authentication (15-min access, 30-day refresh)
• Role-based access control (RBAC) — broker, agent, admin
• Multi-tenant data isolation (separation by user_id + office_id)
• Cloudflare WAF and DDoS protection
• Daily automated backups (7-day retention) and 4-hourly incremental backups
• Vulnerability scanning (periodic)

11.2. Administrative Measures

• KVKK awareness training for employees
• Confidentiality agreement (all personnel)
• Data processing inventory (VERBIS classification)
• Data breach response plan (24-hour processor-to-controller, 72-hour regulator notification)
• Access authorization matrix (data minimization principle)
• Periodic internal audit (every six months)

12. Cookie Policy

For detailed information about the use of cookies, please review our Cookie Policy page.

13. Changes to This Privacy Notice

This privacy notice may be updated in line with legal regulations and platform developments. For material changes you will be informed via in-app notification and/or e-mail. The updated text is effective as of its publication date.

14. Personal Data Protection Board Contact