KVKK Privacy Disclosure (TRNC Personal Data Protection Notice)

Last updated: May 15, 2026

This Privacy Disclosure has been prepared by Evlek as data controller under the TRNC Personal Data Protection Law (89/2007) and Republic of Türkiye Personal Data Protection Law No. 6698 ("KVKK"). For more comprehensive data processing information, please consult our Privacy Policy.

1. Data Controller

Entity: Evlek — Sole Proprietorship Address: Meşale Sok. Karaoğlanoğlu No:9, Girne, TRNC Email: hello@evlek.app Phone: +90 533 833 88 98 Platform: evlek.app (web), Evlek (iOS/Android — app.evlek.mobile) As data controller, we implement all measures required by KVKK and TRNC Law 89/2007 in processing your personal data.

2. Categories of Personal Data Processed

The following categories of personal data are processed when you use our platform: • Identity Data: Name, surname, date of birth (during KYC) • Contact Data: Email, phone number (E.164), WhatsApp number • Customer Transaction Data: Listing records, favorites, search history • Transaction Security Data: Password (hashed), session tokens, IP address • Marketing Data: Cookie preferences, anonymous analytics • Visual Data (KYC): ID document photo, selfie — only with explicit consent • Financial Data: Subscription records (via Apple IAP / Google Play, payment details not processed) • Location Data: Listing location (user-declared)

3. Purposes of Personal Data Processing

Your personal data is processed for the following purposes: • Account creation and management • Providing property listing publication and browsing services • Identity verification (KYC) and fraud prevention • Management of customer requests and complaints • Fulfillment of legal obligations (TRNC 89/2007 art. 5) • Platform security • Statistical analysis and service improvement (anonymous) • Providing AI search and recommendations (see /legal/ai)

4. Legal Basis for Processing

Your personal data is processed based on the following legal grounds: • Explicit consent (TRNC 89/2007 art. 5/1-a): Account creation, KYC, AI chatbot use • Performance of a contract (art. 5/2-c): Subscription services, payment processing • Legal obligation (art. 5/2-ç): Tax and accounting records, regulatory compliance • Legitimate interest (art. 5/2-f): Platform security, fraud prevention, service improvement

5. Method of Personal Data Collection

Your personal data is collected through the following channels: • Forms and membership registrations on the website (evlek.app) • Registration and interaction on the mobile app (iOS/Android) • Documents and selfie photos uploaded during identity verification • OAuth information via third-party identity providers (Google, Apple) • SMS phone verification and WhatsApp contact number record • Cookies and similar technologies via web browser

6. Transfer of Personal Data

Your data is transferred to the following third-party service providers, only to the extent necessary for service delivery: • Supabase Inc. (USA) — Database and file storage (SOC 2 Type II) • Vercel Inc. (USA) — Web hosting infrastructure • Twilio Inc. (USA) — SMS phone verification • Google LLC (USA) — Analytics (anonymous), OAuth, Gemini AI service • Apple Inc. / Google LLC — In-app purchases (via RevenueCat) Your data may be processed abroad, but all providers comply with GDPR and SOC 2 standards. Your data is not sold and is not shared with third parties for marketing purposes.

7. Rights of the Data Subject

Under the TRNC Personal Data Protection Law (89/2007) and KVKK 6698 art. 11, you have the following rights: • Learn whether your personal data is being processed • Request information about your processed data • Learn the purpose of processing and whether data is used appropriately • Know third parties to whom data has been transferred domestically or abroad • Request correction of incomplete or inaccurate data • Request deletion of your data under legal conditions (right to be forgotten) • Request notification of correction or deletion operations to third parties • Object to results that may arise to your detriment from automated processing • Request compensation for damages suffered due to unlawful processing Application: To exercise your rights, send a written request to hello@evlek.app. Your request will be answered within 30 days.

8. Data Security and Retention Periods

The following technical and administrative measures are taken to secure your data: • Row-Level Security (RLS) in PostgreSQL database for row-level access control • SSL/TLS encryption for data transmission • Hashing of passwords with bcrypt (plain text not stored) • Regular security audits and Sentry error tracking • Role-based admin access Retention Periods: • Account data: While account is active + 30 days after deletion request • Listing data: While listing is active + 90 days after deletion • KYC ID photos: Automatically deleted within 90 days after verification • Selfie photos: Processed at verification moment and immediately deleted • Payment/subscription records: 5 years (legal obligation) • Log data: 1 year • AI chat history: For session duration, deleted at session end

9. Explicit Consent and Changes

By registering on our platform and using our services, you provide explicit consent to the processing of your personal data within the scope specified in this Disclosure. This text may be updated as needed. Significant changes are announced through in-platform notifications or email. The current version is always accessible at evlek.app/legal/kvkk.

10. Application and Contact

To apply to the data controller: Email: hello@evlek.app (with subject "KVKK Application") Web: evlek.app/contact Mail: Meşale Sok. Karaoğlanoğlu No:9, Girne, TRNC You must clearly state your identity information, the subject of your request, and contact details in your application. Applications are concluded within 30 days. For detailed data processing information, please refer to our Privacy Policy: evlek.app/legal/privacy