KVKK Privacy Notice

From the enquiry form: your name, email address, the calling code and telephone number you enter, which are combined into one international number, and, where you choose to give them, your nationality, the kind of purchase you are interested in, your budget band, and your message.

From the page you enquired from: the project or page you were reading, and, where you used the Match tool, the purchase timeframe and household size taken from the brief you built. The brief sentence itself is not stored; only those two answers are.

From the link that brought you here: any campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and any Google click identifier (gclid) present in the address.

From your choices: the site language you were reading in, recorded as an English label, and whether you ticked the newsletter box. An unticked box is never recorded against you as a refusal.

From the request itself, for security only: a short one-way hash of the address your request arrived from, salted with a value that exists only for the life of the server process, together with a count of recent requests. This is described in the next section.

Not collected: the form carries two anti-spam fields that no visitor sees or fills in. A submission that trips either one is discarded before anything is stored or sent anywhere.

Special-category data (health, belief, biometric, and the other categories listed in Article 6) are not requested at any point. Please do not put them in the free-text message. If they reach us incidentally, they are restricted and deleted unless a condition in Article 6 applies. The company operates this as a rule of handling; it does not screen free text automatically, and this notice does not claim that it does.

To answer the enquiry you sent and take the steps before a contract that you asked for. Article 5/2(c): processing necessary for the establishment or performance of a contract. This covers your name, contact details, nationality, interest, budget, message, project context, purchase timeframe and household.

To manage the resulting record and follow it up proportionately. Article 5/2(f): legitimate interest, after weighing your rights and freedoms.

To understand which campaign or link brought an enquiry. We treat this within the same legitimate interest under Article 5/2(f). Whether attribution measurement is a distinct purpose that needs its own written balancing assessment is under review by the company, and this notice does not claim that assessment is complete.

To answer you in the language you were reading in. The language label travels with your enquiry as part of handling it, under the same bases as the enquiry itself.

To keep the enquiry form from being abused. Article 5/2(f). The mechanism is a per-process, in-memory count that holds a salted hash for ten minutes and is lost when the server restarts. Nothing is written to a disk or a database, and the company holds no key that would turn the hash back into an address. Whether this constitutes processing of personal data at all is arguable; we describe it here rather than rely on that argument.

To send you marketing messages, if you asked for them. Only where you have ticked the newsletter box. This rests on your explicit consent under KVKK and on the separate rules for commercial electronic messages in Law No. 6563. You can withdraw that consent at any time using the contact details below, and the rest of your enquiry is unaffected.

To meet legal, accounting and record-keeping obligations, and to establish or defend a legal claim. Articles 5/2(ç) and 5/2(e).

Maps. On pages that show a map, your browser contacts Mapbox directly, and Mapbox may receive your address, browser identification and interaction with the map. We treat this under Article 5/2(f) as a necessary part of showing the page. The full set of what Mapbox stores in the production configuration is still being confirmed, and this notice states only what has been confirmed.

3D tours. On a project or collection page that has a Matterport tour, the tour loads automatically once it comes near your view, without a click, and your browser then contacts Matterport (my.matterport.com) directly; Matterport may receive your address, browser identification and interaction with the tour. We treat this under Article 5/2(f) on the same footing as the map above. Whether this should instead require a click before it loads, the way the project film does below, is under review, and this notice does not claim that review is finished.

Project film. Where a project has a video, it is either hosted by us or, for some projects, by the developer; if it plays through YouTube, the player is YouTube's privacy-enhanced mode (youtube-nocookie.com) and loads only once you press play, not before. At that point your browser contacts YouTube, or the developer's host, directly, and that provider may receive your address and browser identification. We treat this under Article 5/2(f) as a necessary part of showing content you asked for.

Chat. The Zoho SalesIQ chat is not loaded when you arrive and is not active. No chat data are being processed, so no basis is claimed for it here. If the chat is switched on, this notice changes before that happens, not afterwards.

Appearance. If you change the site's appearance, your browser stores that choice locally under the key icb-theme. It is not sent to us and we do not read it. It stays until you or the site clears it.

Directly from you, through the enquiry form on this site; from the address of the page you arrived on, for the campaign parameters; and from the request your browser makes, for the security data described above. Collection is by automated and electronic means.

Within the company, authorised staff and the company's professional advisers.

Outside the company: Zoho CRM, which holds the enquiry record, on Zoho's European data centre (zohoapis.eu and accounts.zoho.eu); the hosting and email providers needed to serve the site and carry our replies; Mapbox, on map pages, as described above; Matterport, on project pages with a 3D tour, as described above; YouTube (Google), or the relevant project's developer host, when a project film plays, as described above; WhatsApp and Meta, only if you choose to open a WhatsApp conversation with us, in which case that service processes the connection under its own terms and we receive what you send; and public authorities where the law requires disclosure.

Transfer abroad (Article 9). The enquiry record is held on Zoho's European infrastructure, which is outside Türkiye. A transfer of this kind requires a basis under Article 9 in addition to the Article 5 basis for the underlying purpose. The company's position, as at the date of this notice, is that the transfer is continuing and that the appropriate-safeguard documentation for it is in progress: a data processing agreement with the provider was initiated on 3 September 2026 and is awaiting signature. This notice does not claim that the Article 9 safeguard is already in place. It is stated here because a visitor is entitled to know both the destination of their data and the current state of the paperwork behind it. This section is updated when the position changes.

Five years after the last contact with you. This is the company's binding commitment, decided by the owner on 3 September 2026 and stated here so that it can be held to.

Where a longer period is required by a statutory retention or limitation rule, the longer period applies to the records that rule covers, and only to those. The security data described above are an exception in the other direction: they expire ten minutes after the request and are lost on any restart.

How to apply: in writing to the registered address above, or by email to info@icanbuyinturkey.com. Once the company registers a KEP address, that channel is added here.

How long we take: as soon as possible, and in any case within thirty days of the application.

You may also complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

If the General Data Protection Regulation applies to a particular processing under its Article 3, the corresponding rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal, and the right to complain to a supervisory authority, apply to that processing. This notice does not assert that the site being reachable from the European Union is by itself enough to make that Regulation apply.

This notice carries its own version date, shown at the head of this page. It is changed before a change in what we do, not after it, and that date moves forward whenever this notice is updated.