KVKK Information Notice

Effective date: [DATE]

Draft for lawyer review. Company details will be added before launch.

Article 1 – Who we are

This policy covers personal data of people who use the EventSpy mobile app ("the App") to discover events ("Explorers") and of business account holders who publish events ("Businesses"). It is given under Article 10 of Turkish Law No. 6698 ("KVKK") and Article 13 of the GDPR.

Controller: [COMPANY NAME], [ADDRESS], [email protected].

Article 2 – Explorers' data

Account: The App is for people aged 18 and over. Explorers don't create an account. We don't ask for your name, email or phone number.
Saved events and reminders: stored on your device only, never sent to our servers. Reminders are local notifications created by your device.
Views and reports: when you open an event, its total view count goes up by one; when you report an event, it is marked for our review. Neither is linked to you or your device.
Location: your device's location while the map is open, if you allow it. It is used only on your device to show nearby events; it is never sent to or stored on our servers.
Advertising and device data: processed by Google AdMob: advertising ID (if you allow it), device model, operating system, language, approximate location from your IP address.
App verification: technical attestation data from Apple App Attest and Firebase App Check, used to confirm requests come from the genuine EventSpy app. It doesn't identify you.

Article 3 – Businesses' data

Business name, contact phone and the phone number used to log in;
Business address, city and the map location of its events;
Tax number (to verify the business);
Published events, photos and view counts;
Account approval, change requests and moderation records.

Passwords are handled by Google Firebase Authentication; EventSpy cannot see them.

Article 4 – Why we process it

To show events near you on a map and in lists;
To create reminders for events you save (done on your device);
To verify and approve business accounts and contact businesses;
To moderate and remove inappropriate, misleading or unlawful content;
To clearly label adults-only (18+) events;
To block fake views and reports and keep the App secure;
To show ads in the App;
To fix errors and improve the App;
To meet our legal obligations.

Article 5 – Legal bases and collection

Data is collected electronically through the App, from what you enter and automatically. Legal bases:

Contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): business accounts and publishing events.
Legal obligation (Art. 5/2-ç; GDPR Art. 6(1)(c)): requests from authorities.
Legitimate interests (Art. 5/2-f; GDPR Art. 6(1)(f)): view counts, moderation, security and app verification, fixing errors, non-personalised ads.
Consent (Art. 5/1; GDPR Art. 6(1)(a)): personalised ads. In the EEA, the UK and Switzerland we show Google's consent form; your advertising ID is only used if you allow tracking when iOS asks. Location and notifications are asked through your device's permission screens. [Lawyer: is a separate consent screen needed for users in Türkiye?]

Article 6 – Who receives your data

Google (Firebase; data and photos stored in the EU, in Frankfurt) for infrastructure, Google (AdMob) for ads, Apple (App Attest) for app verification, and public authorities where the law requires. Transfers abroad follow KVKK Art. 9 using [standard contracts], notified to the Turkish Data Protection Board within 5 business days of signing.

Business names, contact phones, addresses, locations and published events are public to all users. Explorers' reports are not shared with businesses, and saved events never leave the device; businesses see only total view counts.

Article 7 – How long we keep it

Explorers: no account. Saved events stay on the device and are removed when the App is deleted.
Business accounts: while active. When an account is deleted, its profile, private details, events and photos are deleted.
Past events and their photos: 6 months after the event ends.
Report and moderation records: 2 years.

Article 8 – Your rights and requests

You have the rights in KVKK Art. 11 (access, information, purpose, recipients, correction, deletion, notifying recipients, objecting to automated decisions, compensation) and, under the GDPR, restriction, portability and complaint to your data protection authority. Businesses can delete their account at once in Business settings > Danger Zone > "Delete account and all events". Explorers have no account; deleting the App removes their saved events. For anything else, use the Data Subject Request Form below and send it to [email protected]. We reply within 30 days, free of charge.

Article 9 – Security and breaches

Data is sent over encrypted connections and access is limited by permission rules. App Check blocks fake requests. If a breach occurs, we notify the Board within 72 hours and inform those affected.

Article 10 – Changes

This policy may be updated; important changes are announced in the App. If the Turkish and English versions differ, the Turkish version prevails.

Data Subject Request Form

Use this form for your rights under Article 11 of Law No. 6698 and the GDPR. We reply within 30 days, free of charge.

Full name
Phone number registered on the business account (if any)
Account type (Explorer / Business)
Email or postal address for our reply
Date and signature

Your request:

☐ Confirm whether my data is processed
☐ Information about, and a copy of, my data
☐ The purpose of processing
☐ Who my data was shared with
☐ Correction
☐ Deletion or destruction
☐ Tell recipients about the correction or deletion
☐ Object to an automated decision
☐ Restriction / portability (GDPR)
☐ Compensation
☐ Other:

Details:

Send to: [email protected]. EU/UK users may also complain to their data protection authority.