Bu Gizlilik Politikası, APTHUB platformunun kullanıcı verilerini nasıl topladığını, kullandığını ve koruduğunu açıklamaktadır.
1 Introduction
Welcome to APTHUB ("we", "our", "us"), operated by APTHUB Gayrimenkul Teknolojileri A.Ş., registered in Istanbul, Turkey. We are committed to protecting your personal data and your right to privacy.
This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website at apthub.com.tr, use our mobile application, or interact with our services. It applies to all users — property seekers, landlords, real estate consultants, and visitors.
Governing Law
This policy is governed by the Kişisel Verileri Koruma Kanunu (KVKK) — Turkey's Law on the Protection of Personal Data (Law No. 6698) — and where applicable, the European Union's General Data Protection Regulation (GDPR).
1.1 Definitions
Throughout this policy, the following terms apply:
- Personal Data — any information relating to an identified or identifiable natural person.
- Data Controller — APTHUB, determining the purposes and means of processing personal data.
- Data Processor — any third party processing data on our behalf.
- KVKK — Kişisel Verileri Koruma Kanunu (Turkish Personal Data Protection Law No. 6698).
- DPO — Data Protection Officer, our designated privacy contact.
2 Data We Collect
We collect personal data only to the extent necessary to provide our services. The categories of data we collect are:
2.1 Data You Provide Directly
- Account Information: Full name, email address, phone number, profile photo, and password (stored encrypted).
- Property Listings: Property address, description, price, photos, floor plans, and documents you submit.
- Identity Verification: For consultants — T.C. Kimlik Numarası (Turkish National ID) or foreign passport number, professional licence details.
- Communications: Messages sent via our contact form, support tickets, and WhatsApp integrations.
- Payment Data: Transaction references only; full card data is processed by our PCI-DSS certified payment provider (Iyzico / PayTR). We do not store card numbers.
2.2 Data Collected Automatically
- Usage Data: Pages visited, search queries, listing views, time on site, click patterns.
- Device & Technical Data: IP address, browser type and version, operating system, screen resolution, referring URL.
- Location Data: Approximate city-level geolocation derived from IP address (not precise GPS unless you grant permission).
- Cookies & Tracking: Session cookies, preference cookies, and analytics identifiers. See Section 4 for full cookie details.
2.3 Data From Third Parties
- Social login providers (Google, Apple) may share your name, email, and profile photo if you sign in via those services.
- Real estate portals or business partners may share verified consultant licence information.
3 How We Use Your Data
We process your personal data on the following legal bases under KVKK Article 5 and GDPR Article 6:
3.1 To Provide and Improve Services Contract Performance
- Creating and managing your user account.
- Displaying property listings and processing search queries.
- Facilitating communication between landlords, seekers, and consultants.
- Processing payments and issuing transaction records.
3.2 For Safety and Legal Compliance Legal Obligation
- Verifying consultant identity and licence validity.
- Detecting and preventing fraud, scams, and policy violations.
- Complying with Turkish regulatory requirements and court orders.
- Maintaining audit logs for dispute resolution.
3.3 With Your Consent Consent
- Sending marketing emails, SMS notifications, or push notifications about new listings, price drops, or promotions.
- Personalising search results and homepage recommendations based on your browsing behaviour.
- Sharing anonymised usage statistics with analytics providers.
Right to Withdraw Consent
You may withdraw marketing consent at any time via your Account Settings → Notifications, or by clicking "Unsubscribe" in any email. Withdrawal does not affect the lawfulness of prior processing.
4 Cookies Policy
Cookie Consent
By continuing to use APTHUB, you consent to our use of essential cookies. Optional analytics and marketing cookies are only activated after you click "Accept All" in our cookie banner.
4.1 Essential Cookies Always Active
- sessionid — Django session identifier. Expires when browser closes.
- csrftoken — CSRF protection token. Expires after 1 year.
- apthub_consent — Stores your cookie preference. Expires after 365 days.
4.2 Analytics Cookies Opt-in
- _ga, _gid — Google Analytics 4. Tracks page views and user journeys (anonymised). Expires 2 years / 24 hours.
- _apthub_session — Internal session analytics. Expires after 30 days.
4.3 Marketing Cookies Opt-in
- fbp — Facebook Pixel for ad re-targeting. Expires 90 days.
- _gcl_au — Google Ads conversion tracking. Expires 90 days.
4.4 Managing Cookies
You can block or delete cookies via your browser settings at any time. Note that disabling essential cookies will prevent login and core functionality.
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Preferences → Privacy & Security
- Safari: Preferences → Privacy
- Edge: Settings → Cookies and Site Permissions
5 Data Sharing
We do not sell your personal data to third parties. We may share data only in the following circumstances:
5.1 Service Providers (Data Processors)
- Cloud Hosting: Hetzner Cloud (Germany/Finland) — servers hosting our application and database, bound by EU Standard Contractual Clauses.
- Email Delivery: Mailgun — transactional emails (registration confirmations, password resets). Data processed in EU.
- SMS / WhatsApp: Netgsm (Turkey) — notification delivery.
- Payment Processing: Iyzico / PayTR — licensed Turkish payment gateways regulated by BDDK.
- Analytics: Google Analytics 4 — anonymised usage statistics (with IP anonymisation enabled).
- Maps: Google Maps API — property location display. Subject to Google's Privacy Policy.
5.2 Between Platform Users
Your display name, city, and profile photo are visible to other authenticated users. Your phone number and email are only shared with other users upon your explicit request.
5.3 Legal Obligations
We may disclose personal data to Turkish courts, law enforcement, or regulatory bodies (including the KVKK Authority) when required by law, court order, or to protect the rights, property, or safety of APTHUB, our users, or the public.
International Transfers
Where data is transferred outside Turkey, we ensure adequate protection through Standard Contractual Clauses (SCCs) or equivalence decisions, as required by KVKK Article 9 and GDPR Chapter V.
6 Your Rights (KVKK & GDPR)
Under KVKK Article 11 and the GDPR, you have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data ("Right to Be Forgotten"), subject to legal retention requirements.
Right to Restrict Processing
Limit how we process your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format (JSON or CSV).
Right to Object
Object to processing based on legitimate interests or for direct marketing at any time.
6.1 How to Exercise Your Rights
Submit a data subject request via:
- Account Portal: Settings → Privacy → Data Requests (fastest method, resolved within 72 hours).
- Email: privacy@apthub.com.tr — we respond within 30 days as required by KVKK.
- Written Request: APTHUB Veri Sorumlusu, Levent Mah. Büyükdere Cad. No:1, Beşiktaş, Istanbul 34330.
6.2 Right to Complain
If you believe your rights have been violated, you may lodge a complaint with the Kişisel Verileri Koruma Kurumu (KVKK):
- Website: kvkk.gov.tr
- Address: Nasuh Akar Mah. Ziyabey Cad. No:1452, 06520 Balgat, Ankara
- Phone: +90 312 216 50 00
7 Data Retention
We retain personal data only for as long as necessary for the purpose it was collected, or as required by Turkish law. Our retention schedule:
| Data Category |
Retention Period |
Legal Basis |
| Account data | Duration of account + 3 years | Turkish Commercial Code Art. 82 |
| Transaction records | 10 years | Turkish Tax Procedure Law Art. 253 |
| Property listings | Active + 2 years after deletion | Dispute resolution |
| Communication logs | 2 years | KVKK legitimate interest |
| Analytics data | 14 months (anonymised) | Consent |
| Support tickets | 3 years | Legitimate interest |
After the retention period, data is either permanently deleted from our systems and backups, or anonymised so that it can no longer be linked to an individual.
8 Security Measures
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:
8.1 Technical Measures
- Encryption in Transit: All traffic encrypted via TLS 1.3 / HTTPS. HTTP requests are automatically redirected to HTTPS.
- Encryption at Rest: Database backups and sensitive fields (passwords, ID numbers) encrypted using AES-256.
- Password Security: Passwords hashed using Django's PBKDF2-SHA256 (100,000 iterations). We never store plain-text passwords.
- Two-Factor Authentication: Available for all accounts; mandatory for consultant and administrator accounts.
- Access Controls: Role-based access control (RBAC); staff access logged and audited quarterly.
- Vulnerability Management: Regular dependency updates, automated security scanning via GitHub Dependabot, annual penetration testing.
8.2 Organisational Measures
- Data minimisation — we collect only what is strictly necessary.
- Staff privacy training conducted annually.
- Signed Data Processing Agreements (DPAs) with all third-party processors.
- Documented incident response plan with 72-hour breach notification commitment under KVKK.
Security Incident Reporting
If you suspect a security vulnerability or unauthorised access to your account, contact us immediately at security@apthub.com.tr. We operate a responsible disclosure programme.
9 Contact Our Data Protection Officer
Our Data Protection Officer (Veri Koruma Sorumlusu) is responsible for overseeing compliance with this policy and applicable data protection laws. You may contact our DPO directly for any privacy-related queries:
APTHUB Data Protection Officer
APTHUB Gayrimenkul Teknolojileri A.Ş.
- Email: privacy@apthub.com.tr
- Address: Levent Mahallesi, Büyükdere Caddesi No:1, Beşiktaş, Istanbul 34330, Turkey
- Phone: +90 212 555 0199
- Response Time: Within 30 calendar days (KVKK Art. 13)
9.1 Policy Updates
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you via email and a prominent banner on the platform at least 30 days before the changes take effect.
Your continued use of APTHUB after the effective date constitutes acceptance of the updated policy. We encourage you to review this page periodically. The "Last Updated" date at the top of this page indicates when the policy was last revised.
