KVKK Privacy Disclosure (TRNC Personal Data Protection Notice)

Last updated: August 26, 2026

This Privacy Disclosure has been prepared by Evlek as data controller under the TRNC Personal Data Protection Law (89/2007) and Republic of Türkiye Personal Data Protection Law No. 6698 ("KVKK"). For more comprehensive data processing information, please consult our Privacy Policy.

1. Data Controller

Data controller: Onur Dokuzoğlu — individual service provider trading as Evlek Registered address: Etiler Mah. 875 Sk. Coburlar No:24 İç Kapı No:4, 07010 Muratpaşa, Antalya, Türkiye Email: hello@evlek.app Phone: +90 533 844 40 84 Platform: evlek.app (web), Evlek (iOS/Android — app.evlek.mobile) As data controller, we implement all measures required by KVKK and TRNC Law 89/2007 in processing your personal data.

2. Categories of Personal Data Processed

The following categories of personal data are processed when you use our platform: • Identity Data: Name, surname, date of birth (during KYC) • Contact Data: Email, phone number (E.164), WhatsApp number • Customer Transaction Data: Listing records, favorites, search history • Transaction Security Data: Password (hashed), session tokens, IP address • Marketing Data: Cookie preferences, anonymous analytics • Identity and document data: Identity and professional-authority documents supplied during an application. Selfies are not collected; biometric facial matching and AI/OCR document review are disabled • Financial and subscription data: Apple IAP / Google Play product and subscription records; once web payments are enabled, transaction ID, product, amount, currency, tax, status, and invoice/refund records. Evlek does not receive or store full card details • Location Data: Listing location (user-declared)

3. Purposes of Personal Data Processing

Your personal data is processed for the following purposes: • Account creation and management • Providing property listing publication and browsing services • Identity verification (KYC) and fraud prevention • Management of customer requests and complaints • Fulfillment of legal obligations (TRNC 89/2007 art. 5) • Platform security • Statistical analysis and service improvement (anonymous) • Providing AI search and recommendations (see /legal/ai)

4. Legal Basis for Processing

Your personal data is processed based on the following legal grounds: • Explicit consent (TRNC 89/2007 art. 5/1-a): Account creation, KYC, AI chatbot use • Performance of a contract (art. 5/2-c): Subscription services, payment processing • Legal obligation (art. 5/2-ç): Tax and accounting records, regulatory compliance • Legitimate interest (art. 5/2-f): Platform security, fraud prevention, service improvement

5. Method of Personal Data Collection

Your personal data is collected through the following channels: • Forms and membership registrations on the website (evlek.app) • Registration and interaction on the mobile app (iOS/Android) • Documents uploaded during identity and professional verification • OAuth information via third-party identity providers (Google, Apple) • SMS phone verification and WhatsApp contact number record • Cookies and similar technologies via web browser

6. Transfer of Personal Data

Your data is transferred to the following third-party service providers, only to the extent necessary for service delivery: • Supabase Inc. (USA) — Database and file storage (SOC 2 Type II) • Vercel Inc. (USA) — Web hosting infrastructure • Twilio Inc. (USA) — SMS phone verification • Google LLC (USA) — Analytics (anonymous), OAuth, Gemini AI service • Apple Inc. / Google LLC — In-app purchases (via RevenueCat) • Web payment provider — once web payments are enabled, payment, tax, invoice, fraud-prevention, subscription, and refund processing Your data may be processed abroad depending on the feature used. Any required permission, contract, or other transfer safeguard is assessed for the specific data flow. Your data is not sold and is not shared with third parties for marketing purposes.

7. Rights of the Data Subject

Under the TRNC Personal Data Protection Law (89/2007) and KVKK 6698 art. 11, you have the following rights: • Learn whether your personal data is being processed • Request information about your processed data • Learn the purpose of processing and whether data is used appropriately • Know third parties to whom data has been transferred domestically or abroad • Request correction of incomplete or inaccurate data • Request deletion of your data under legal conditions (right to be forgotten) • Request notification of correction or deletion operations to third parties • Object to results that may arise to your detriment from automated processing • Request compensation for damages suffered due to unlawful processing Application: To exercise your rights, send a written request to hello@evlek.app. Your request will be answered within 30 days.

8. Data Security and Retention Periods

The following technical and administrative measures are taken to secure your data: • Row-Level Security (RLS) in PostgreSQL database for row-level access control • SSL/TLS encryption for data transmission • Hashing of passwords with bcrypt (plain text not stored) • Regular security audits and Sentry error tracking • Role-based admin access Retention Periods: Data is retained for as long as reasonably needed to provide the account and service, preserve security or dispute records, and meet legal or accounting duties. The period varies by data category, account and listing status, potential disputes, and applicable obligations. Contact hello@evlek.app to ask about retention or deletion of a specific data category.

9. Explicit Consent and Changes

This notice provides information about data processing. Where a feature requires explicit consent, consent is requested separately and freely before the relevant data is collected; registration alone is not treated as explicit consent to every processing activity. This text may be updated as needed. Significant changes are announced through in-platform notifications or email. The current version is always accessible at evlek.app/legal/kvkk.

10. Application and Contact

To apply to the data controller: Email: hello@evlek.app (with subject "KVKK Application") Web: evlek.app/contact Mail: Etiler Mah. 875 Sk. Coburlar No:24 İç Kapı No:4, 07010 Muratpaşa, Antalya, Türkiye You must clearly state your identity information, the subject of your request, and contact details in your application. Applications are concluded within 30 days. For detailed data processing information, please refer to our Privacy Policy: evlek.app/legal/privacy