Privacy Policy and Personal Data Protection Notice

1. Data controller

The data controller is DBR Yapı (jettadilat). Contact details:

The site's technical infrastructure and card payment collection are operated on behalf of, and under the instructions of, the data controller by Agrirossa Mühendislik Ziraat Enerji İthalat İhracat Turizm ve Teknolojik Danışmanlık A.Ş. acting as data processor:

2. Which personal data do we process?

• Identity and contact: full name, phone number and (for members) e-mail address.
• Order and job details: items in your cart, delivery/installation address, the province and district where the work will be done, appointment preference, order notes, work order number, job photos and correspondence.
• Invoice details: company name, tax office and tax number for corporate invoices; full name and address for individual invoices.
• Payment details: payment method, amount, transaction date and the transaction reference issued by the payment institution. Your card number, expiry date and security code are never stored on our site; they are entered only on the licensed payment institution's own secure page.
• Reviews: the rating and comment you give for a completed job.
• Account details: account type (customer/tradesperson/store), an irreversible hash of your password (the password itself is not stored), and for tradesperson and store accounts the trade, service areas, profile and job photos.
• Site usage data: pages visited, IP address, city-level location estimated from the IP address; only if you allow analytics in your cookie preferences, Google Analytics data and, if your browser grants it, the location it shares.

3. Why do we process it?

• To receive your survey, quotation, order, delivery and installation requests, contact you and schedule appointments.
• To assign installation/renovation work to a suitable tradesperson, track the job through its work order and keep you informed.
• To collect payment, reconcile it with the payment institution, issue invoices and meet accounting and tax obligations.
• To handle warranty, return, withdrawal and complaint procedures.
• To evaluate tradesperson and store applications and publish approved profiles.
• To keep the site secure, prevent abuse (such as spam orders) and monitor visit statistics.

4. Legal basis (KVKK art. 5 · GDPR art. 6/1)

For visitors covered by the GDPR these correspond respectively to GDPR art. 6/1-b (contract), 6/1-c (legal obligation), 6/1-f (legitimate interest) and 6/1-a (consent).

• Processing directly related to the conclusion or performance of a contract (KVKK art. 5/2-c) — orders, surveys, installation, warranty.
• Compliance with a legal obligation (art. 5/2-ç) — invoicing, tax and consumer legislation.
• Establishment, exercise or protection of a right (art. 5/2-e) — disputes.
• Our legitimate interests, provided your fundamental rights and freedoms are not harmed (art. 5/2-f) — site security, basic visit logging, measuring service quality.
• Your explicit consent (art. 5/1) — analytics cookies and browser location sharing; you may withdraw consent at any time.

5. Who do we share it with?

Some of these providers host their servers abroad. International transfers are made in line with KVKK art. 9 and, for analytics and location data, on the basis of your explicit consent.

• The approved tradesperson assigned to or chosen for your job — only the name, phone, address/neighbourhood and scope needed to do the work.
• If your cart contains a member store’s product, that store — to prepare and deliver the order.
• Our accountants/financial advisers and authorised public authorities (on request, as required by law).
• Payment collection and technical infrastructure: Agrirossa (data processor) for developing the site, managing hosting and collecting card payments on behalf of the seller; for card payments, the payment institution licensed under Law No. 6493 that receives card data directly, and the relevant banks — solely to execute the transaction, perform 3D Secure verification and prevent fraud.
• Infrastructure providers we use: the server hosting the site (Hetzner, Germany), content delivery and security (Cloudflare), city estimation from IP address (ip-api.com), the administrator notification service (ntfy.sh), Google Analytics / Google Tag Manager if you consent, and WhatsApp (Meta) if you message us there.

6. How we collect it

Data is collected electronically or physically through the cart, "Call me back", survey and sign-up forms on the site, WhatsApp and phone conversations, in-person contact at the store, the tradesperson and store panels, and cookies and similar technologies.

7. Retention

• Order, payment, invoice and accounting records: for the period required by law (generally 10 years under tax legislation; order and contract records at least 3 years under Law No. 6563).
• Account details: while your account is open, and for at most 1 year after you close it (subject to disputes and legal requirements).
• Warranty and work order records: for the warranty period and the limitation period for potential disputes.
• "Call me back" requests left without ordering: at most 1 year after the request is resolved.
• Visit logs (IP, page, city): at most 1 year.
• Expired data is deleted, destroyed or anonymised.

8. Your rights (KVKK art. 11 · GDPR art. 15–22)

• To learn whether your personal data is processed and, if so, to request information about it,
• To learn the purpose of processing and whether it is used in line with that purpose,
• To know the third parties to whom it is transferred in Turkey or abroad,
• To request correction of incomplete or inaccurate data, deletion or destruction where the conditions are met, and notification of these actions to third parties,
• To object to a result against you arising from analysis solely by automated systems,
• To claim compensation for damage caused by unlawful processing.
• If you are covered by the GDPR you may also request restriction of processing (art. 18), receive your data in a portable format (art. 20), object to processing based on legitimate interest (art. 21) and lodge a complaint with the supervisory authority in your country.

9. How to apply

You may submit requests regarding your rights in writing, together with information identifying you, to İnönü Mah. 677/19 Sok. No:87B, Otokent 6. Sanayi Sitesi, Buca / İzmir. Requests are answered free of charge within 30 days at the latest. If your request is refused or the answer is inadequate you may complain to the Turkish Personal Data Protection Board. You can change your cookie preferences on the Cookie Policy page.