EvSkor
Disclosure Notice on the Processing of Personal Data
Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK)
Version 1.2 | May 2026
1. Identity and Contact Information of the Data Controller
Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the data controller whose identity and contact information are set out below:
| Field | Information |
|---|---|
| Data Controller Name/Title | Nur Sultan Şeyhanlıoğlu |
| Address | Canakkale / Turkiye | | E-mail | info@evskor.net |
| Platform | EvSkor mobile application and website |
Note: Accessibility of the data controller is mandatory pursuant to decisions of the Personal Data Protection Board ("Board"). The contact information above will be kept up to date at all times.
2. Categories of Personal Data Processed
Depending on how you use the Platform, personal data in the following categories may be processed:
| Data Category | Data Processed |
|---|---|
| Identity and Contact | Name, surname, e-mail address, phone number (if provided), account identifiers |
| Location and Usage | Data related to map selections or address searches; technical logs related to application and website usage |
| Content Data | Review text, ratings; masked names displayed to other users (e.g. N*** S*** format). Masked names do not constitute anonymous data and are considered personal data within the scope of KVKK. |
| Verification Data | Temporary processing of uploaded documents (documents are deleted after review); verification status and document hash are retained |
| Security and Legal Compliance | IP address, timestamps, session and activity logs (reviews, logins, document uploads) |
2.1 Special Categories of Personal Data
Content shared by users on the Platform may include special categories of personal data within the meaning of Article 6 of KVKK (e.g. health status, ethnic origin, religious information, statements containing criminal accusations). As data controller, EvSkor:
- Does not deliberately request such data,
- Processes it only to the extent strictly necessary when shared at the user's own initiative,
- Removes content identified as unlawful or containing such data,
and makes this declaration accordingly. Special categories of personal data shall not be processed without explicit consent as a rule (KVKK Art. 6/2-3).
3. Purposes and Legal Bases for Processing Personal Data
Pursuant to Article 5 of KVKK, your personal data is processed for the following purposes and on the following legal bases:
| Purpose of Processing | Legal Basis | Relevant KVKK Article |
|---|---|---|
| Account creation and management | Performance of contract | Art. 5/2-c |
| Publication and display of tenant/landlord experiences | Performance of contract | Art. 5/2-c |
| Security, abuse prevention, AI-assisted pre-screening and human-supervised content moderation | Legitimate interest | Art. 5/2-f |
| Compliance with legal obligations (under Law No. 5651) | Explicitly provided by law | Art. 5/2-a |
| Establishment, exercise or protection of legal rights | Legitimate interest | Art. 5/2-f |
| Support and communication services | Performance of contract / Legitimate interest | Art. 5/2-c / 5/2-f |
| Logging of IP and traffic data and sharing with competent authorities | Explicitly provided by law | Art. 5/2-a |
Note: For processing activities based on legitimate interest, a balancing test is conducted to ensure that the fundamental rights and freedoms of data subjects are not prejudiced, and the results are documented and retained by the data controller.
3.1 Processing Operations Requiring Explicit Consent
The following activities shall only be carried out where you have provided explicit consent:
- Use of analytical and marketing cookies
- Transfer of data abroad (in the absence of an adequacy decision)
- Sending of commercial electronic communications and marketing notifications (where applicable)
- Push notification delivery (subject to your permission)
4. Recipients of Personal Data and Purposes of Transfer
4.1 Domestic Transfers
Your personal data may be shared with the following parties within the framework of the legal bases indicated:
- Competent public institutions and authorities: Upon lawful requests by competent authorities pursuant to Law No. 5651 and applicable legislation (KVKK Art. 8/2-a)
- Cloud service providers: For hosting and data storage services, only to the extent necessary for the provision of services (KVKK Art. 8/2-c)
- E-mail and notification service providers: For user notifications and communications, under contracts subject to confidentiality obligations (KVKK Art. 8/2-c)
- Security and logging infrastructure providers: For abuse prevention and content moderation purposes, subject to data protection obligations (KVKK Art. 8/2-c)
4.2 International Transfers
Your personal data is primarily stored in Turkey. In the event that an international transfer becomes necessary, such transfer shall be carried out with appropriate safeguards pursuant to Article 9 of KVKK — such as an adequacy decision, standard contractual clauses, or your explicit consent — and this notice will be updated accordingly.
5. Retention Periods for Personal Data
Your personal data is retained for the periods specified below; upon expiry of these periods, it is deleted, destroyed, or anonymised:
| Data Category | Retention Period | Rationale |
|---|---|---|
| IP address and traffic data | 2 years | Mandatory obligation under Art. 5 and 6 of Law No. 5651 |
| Account data | 3 years from account deletion | For resolution of potential disputes and protection of legal rights |
| Review and content data | 3 years from content removal | For legal disputes and evidentiary purposes |
| Document hash and verification status | Duration of active account + 3 years | To maintain the integrity of the verification process |
| Session and activity logs | 1 year | Within the scope of information security and audit processes |
6. Methods and Sources of Personal Data Collection
Your personal data is collected through the following methods and sources:
- Information provided directly by you: Through account creation, sharing reviews, uploading documents, and the contact form
- Automatically collected data: Through technical systems during your use of the application or website (IP address, browser information, session logs)
- Verification process: Temporarily from the documents you upload
7. Your Rights Under KVKK
Pursuant to Article 11 of KVKK, you have the following rights regarding your personal data:
- To learn whether your personal data has been processed
- If processed, to request information in this regard
- To learn the purposes of processing and whether your data is used in accordance with those purposes
- To learn the third parties to whom your personal data has been transferred, domestically or abroad
- To request rectification if your data is incomplete or incorrectly processed
- To request deletion or destruction of your personal data where the conditions under Article 7 of KVKK are met
- To request notification of rectification and deletion operations to third parties to whom data has been transferred
- To object to a result arising to your detriment through analysis exclusively by automated systems (including AI-assisted moderation decisions; you may request human review)
- To claim compensation for damages arising from unlawful processing of your personal data
How to Submit a Request
You may submit your request through any of the following channels:
| Channel | Details |
|---|---|
| Website form | evskor.net/en/contact |
| info@evskor.net | |
| Written application | Address set out in Section 1 |
| KEP | KEP is not used at this time; this notice will be updated if a legal obligation arises. |
Your request will be responded to within a maximum of 30 (thirty) days pursuant to Article 13 of KVKK, following verification of your identity. Applications are free of charge; however, where processing requires an additional cost, the fee schedule determined by the Board may apply.
8. Right to File a Complaint with the Personal Data Protection Board
If your application to the data controller is rejected, if you find the response inadequate, or if no response is given within the prescribed period, you may file a complaint with the Personal Data Protection Board within 30 (thirty) days from the date you learn of the response and in any case within 1 (one) year from the date you become aware of the subject matter of the complaint.
9. Cookies and Similar Technologies
Cookies may be used on our website for session management, user preferences, and analytical purposes.
| Cookie Type | Legal Basis | Management |
|---|---|---|
| Essential / Session cookies | Performance of contract (KVKK Art. 5/2-c) | Cannot be disabled; required for the service to function |
| Analytical and preference cookies | Explicit consent (KVKK Art. 5/1) | Can be managed via browser settings or the cookie preference panel |
Refusing analytical cookies may limit certain features.
10. VERBIS Registration
The data controller shall fulfil its registration obligations with the Data Controllers' Registry Information System (VERBİS) should the scale of its activities and applicable legal conditions so require.
11. Updates to This Disclosure Notice
This disclosure notice may be updated in line with legislative changes or changes in data processing activities. In the event of material changes, users will be notified at least 7 (seven) days in advance via an in-app notification or e-mail. The current version will always be accessible on the Platform.
This notice has been prepared pursuant to Article 10 of Law No. 6698 (KVKK) and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
EvSkor | Version 1.2 | May 2026