Privacy Notice under the Personal Data Protection Law (KVKK)

1. Identity of the Data Controller

Your personal data is processed by the data controller whose details are set out below:

Name / Title	Kalkan Info (Berkay Elmastaş)
Address	Atatürk Cad. No:1, Kalkan / Kaş / Antalya, 07580
E-mail	info@kalkaninfo.com
Website	kalkaninfo.com
Server Location	European Union (Google Cloud — europe-west3, Frankfurt)

2. Personal Data Processed

When you register on the platform or use our services, the following personal data is processed:

Data Category	Data Items	Source
Identity Information	First name, last name	Member registration, social login
Contact Information	E-mail address	Member registration, social login
Visual Information	Profile photo (optional, transferred from social account only)	Google / Facebook OAuth
Transaction Security	Encrypted session data, IP address (for KVKK consent record), login date	System automatic
Usage Data	Review contents, business profile information, preferred language	User input
Consent Records	KVKK consent date and version, marketing preference	Member registration
Technical Data	Cookie data, browser type, device type, page view statistics	System automatic

3. Purposes of Personal Data Processing

• Creation, verification and management of membership accounts
• Ensuring secure access to the platform
• Creation and update of user profiles
• Provision of review, rating and business profile services
• Fulfilment of obligations under KVKK and retention of legal records
• Sending welcome e-mails and system notifications
• Where consent is given: delivery of campaign, update and content announcements
• Protection of the security and integrity of the platform
• Statistical analysis and improvement of service quality (using anonymous/aggregate data)

4. Legal Bases

Purpose	KVKK Legal Basis
Membership and identity verification	Art. 5/2(c) — Establishment and performance of a contract
Retention of KVKK records	Art. 5/2(ç) — Legal obligation
Security logs	Art. 5/2(ç) — Legal obligation / Art. 5/2(f) — Legitimate interest
Marketing notifications	Art. 5/1 — Explicit consent (optional tick-box)
Analytics / statistics	Art. 5/2(f) — Legitimate interest (anonymous data)

5. Transfer of Personal Data

Your personal data may be transferred to the following recipients and for the following purposes:

Recipient	Purpose	Location
Google Firebase / Firestore	Database and authentication infrastructure	EU (Frankfurt, europe-west3)
Google Analytics	Anonymous usage statistics	EU / USA (under SCCs)
E-mail infrastructure provider (SendGrid/Mailgun)	System and marketing e-mails	EU / USA (under SCCs)
Meta (Facebook/Instagram)	Social login (OAuth) — authentication only	USA (under SCCs)

International transfers are made in accordance with Article 9 of KVKK and the decisions of the Personal Data Protection Board, under Standard Contractual Clauses (SCCs) or to countries with an adequacy decision.

6. Retention Periods

Data Type	Retention Period
Account and profile information	For as long as the account is active + 30 days from deletion request
KVKK consent records	3 years from account deletion (legal obligation)
Transaction and security logs	2 years
Marketing e-mail records	3 years from unsubscription
Reviews and content	Anonymised or deleted upon account deletion

7. Rights of Data Subjects (KVKK Article 11)

Under Article 11 of KVKK you have the following rights:

• Right to be informed: To learn whether your personal data is being processed
• Right to request information: If processed, to request information in relation thereto
• Right to learn purpose: To learn the purpose of processing and whether it is used in accordance with that purpose
• Right to know recipients: To know the third parties to whom data is transferred domestically or abroad
• Right to rectification: To request correction of incomplete or inaccurate data
• Right to erasure / destruction: To request erasure or destruction where the conditions under KVKK Article 7 are met
• Right to notification: To request that rectification and erasure be notified to third parties to whom data was transferred
• Right to object: To object to a result that is to your detriment arising from analysis exclusively by automated systems
• Right to compensation: To claim compensation for damage suffered due to unlawful processing

8. How to Exercise Your Rights

You may use the following channels to exercise your rights:

• E-mail: info@kalkaninfo.com (subject: "KVKK Application")
• Post: Atatürk Cad. No:1, Kalkan / Kaş / Antalya, 07580 (wet-signed petition)
• Platform: Profile page

Your applications will be concluded within a maximum of30 days after identity verification. Where the application is subject to a fee, the tariff set by the Personal Data Protection Board shall apply.

Should your application be rejected, the response be found insufficient, or no response be provided within the statutory period, you may lodge a complaint with the Personal Data Protection Board (kvkk.gov.tr). şikâyette bulunabilirsiniz.

9. Cookies

The platform uses cookies for session management and analytics purposes. For details please refer to the Privacy Policy. 'na bakınız.

10. Updates

This privacy notice may be revised in line with legislative changes or service updates. Changes will be published on this page; material changes will be notified to registered users by e-mail.