Privacy and Personal Data Protection Policy

This policy covers the procedures and principles for obtaining, recording, storing, updating and transferring personal data within the scope of the Law, whether by automated or non-automated means, and for other processing activities.

The policy concerns the authorized representatives and employees of agencies subscribing to the platform, visitors who view our listings and become members, persons who contact us through our website, and all natural persons who use the platform.

EmlakBase is the data controller for the data you share directly with us in membership, communication and support processes.

For the personal data that subscribing agencies enter into the platform about their own customers, portfolios and contracts, the relevant agency is the data controller; EmlakBase acts as a data processor providing hosting and technical processing services for this data. The obligations to inform data subjects and to obtain consent for this data rest with the relevant agency.

Within the scope of our activities, we may process your data in the following categories: identity (first and last name), contact (e-mail, phone), customer transactions (subscription and usage records), transaction security (login records, IP address, log records), finance (invoice and payment information) and, where you have given explicit consent, marketing.

The categories of data processed vary according to the purpose of the activity and are determined in line with the principle of data minimization.

Your personal data is processed for the purposes of creating and managing your platform membership, establishing and performing the subscription contract, providing and improving the service, responding to support requests, carrying out invoicing and collection processes, ensuring information security, fulfilling our legal obligations, responding to requests from authorized institutions and organizations, and carrying out marketing and information activities for which you have given explicit consent.

Your data is collected through channels such as registration and contact forms, records generated while you use the platform, and e-mail correspondence, on the legal grounds set out in Article 5 of the Law: the establishment and performance of a contract, compliance with a legal obligation, legitimate interest and explicit consent.

Where processing is based on explicit consent, you have the right to withdraw your consent at any time.

Our website and platform use cookies and similar browser storage technologies for three purposes: (1) Strictly necessary cookies — to maintain your session, ensure security, and remember your language, theme and cookie preferences; they are required for the service to work, so they do not depend on your consent and are always on. (2) Analytics cookies — to measure how the site is used with Google Analytics, with your IP address truncated. (3) Marketing cookies — to measure ad performance and show relevant ads with Google Ads.

Analytics and marketing cookies are activated only with your explicit consent and are not used until you make a choice. On the banner shown at your first visit, rejecting is as easy as accepting, and in the "Cookie Settings" window you can switch each category on or off separately. You can withdraw your consent at any time via the "Cookie Settings" link at the bottom of the page. The preference you give or withdraw is recorded with the date, text version, IP address and browser information as evidence.

Data obtained through analytics and marketing cookies may be processed abroad (USA/EU) by our service provider Google; this transfer is carried out in accordance with Article 9 of the Law. Retention periods for cookie data and consent records are listed in the "Personal Data Processing Inventory" section at the end of this page.

You can delete or block cookies in your browser settings; however, if strictly necessary cookies are blocked, you may not be able to sign in to the platform.

Within the limits set by the legislation, your personal data may be transferred to the hosting, database and e-mail infrastructure providers we work with to provide the service, to the relevant financial institutions in payment and invoicing processes, and to authorized public institutions and organizations and courts.

The platform infrastructure runs on servers hosted in the European Union (Frankfurt) region. Where a transfer abroad is required, the safeguards and contractual measures set out in the Law are applied.

Your data is protected by technical and administrative measures, including access authorization, encrypted communication (TLS), agency-level data isolation and regular backups.

Your personal data is retained for the period required by the relevant legislation or by the purpose of processing; at the end of these periods, it is deleted, destroyed or anonymized.

The full list of processing activities, retention periods by category and data processors are published in the "Personal Data Processing Inventory" section at the end of this page; expired records are destroyed automatically every night. Members can download all data linked to their account from the My Account page, and agency owners can download agency data under Settings > Agency, in machine-readable (JSON) format.

Members (of the EmlakBase listings app and www.emlakbase.com/hesap) can permanently delete their own accounts through the "Delete Account" step on the My Account page by confirming their password. Upon deletion, the account and login information, first and last name, phone number, favorites, saved searches, comparison list and notification preferences are destroyed immediately. Questions, messages and appointment requests sent to agencies remain in the relevant agency's records in a form separated from identity (anonymized) and cannot be linked back to the person.

Agency employees (EmlakBase Pro and the web panel) close their accounts through the "Delete My Account" step under Settings > My Account by confirming their full name; the property, customer, contract and task records they created are agency data and are therefore not deleted but transferred to the agency owner. The agency owner closes the business through the "Delete Business" step under Settings > Subscription; agency data is kept in a recoverable state for 7 days and is then permanently destroyed. Invoice and subscription records subject to statutory retention obligations are kept for the period required by the legislation.

Users who cannot access their accounts can open a request in the "Account Deletion Request" category at www.emlakbase.com/support or write to iletisim@emlakbase.com from their registered e-mail address; after identity verification, the account is deleted within 7 business days at the latest. A step-by-step explanation is available at www.emlakbase.com/hesap-silme.

Under Article 11 of the Law, you have the right to learn whether your personal data is processed, to request information about the processing activities, to learn whether it is used in accordance with its purpose, to know the third parties to whom it is transferred in Turkey or abroad, and to request its correction if it has been processed incompletely or inaccurately.

You also have the right to request the deletion or destruction of your data under the conditions set out in the Law, to request that these operations be notified to the third parties to whom the data has been transferred, to object to any outcome against you resulting from analysis exclusively by automated systems, and to claim compensation if you suffer damage.

You can submit requests regarding your rights in writing to iletisim@emlakbase.com from your registered e-mail address, or by other methods that verify your identity.

In accordance with the Law, your applications are concluded free of charge within thirty days at the latest.

This policy may be updated when necessary; the current version takes effect as soon as it is published on our website.

You can always access the most current version of the policy on this page.