PDPL Clarification Text

1. Principles and Legal Bases for Processing Personal Data

Apsiyon is an auxiliary platform that offers digital services for community association managers and management companies authorized by the community associations. Apsiyon provides comprehensive services to residents within the scope of the concluded service agreement with the community association managers and management companies authorized by the community associations.

The personal data of our clients and residents are processed in accordance with the relevant legislation, in particular the Constitution of the Republic of Turkey, as well as the provisions of the Law on the Protection of Personal Data No. 6698 (“PDPL”), the Law No. 6563 on the Regulation of Electronic Commerce, and the Turkish Penal Code.

Users' personal data are processed within the scope of the services offered by Apsiyon;

• In accordance with the law and the principle of honesty,
• Accurately and in an up-to-date manner,
• For clear and legitimate purposes, and
• As a part of our business activities, for limited purposes, and carefully.

Personal data is processed and stored for users to benefit from the services offered on the Apsiyon website and/or app. Depending on the product or service provided by Apsiyon, users' data may be collected by automatic or non-automatic methods, and in cases where Apsiyon, primarily the website and the app, mediates the services provided, the data may also be collected verbally, in writing, or electronically. For as long as users benefit from the products and services provided by Apsiyon and/or the contractual relationship continues between Apsiyon and association managers of the community in which users reside or the management company authorized by the respective community association, users' personal data may be processed as per the consent users gave before the effective date of the PDPL, the express consent users gave after the effective date of the PDPL, or within the framework of the terms and conditions specified in the PDPL.

2. Collection Methods of Personal Data and the Personal Data Collected

The data provided to Apsiyon by the community association managers and the authorized management companies of the community associations include personal data such as e-mail address, name, surname, T.R. identification number, identity details, home or work address, and phone number; demographic data such as postal code, age, gender, preferences, interests, and favorites; and in cases where payments are collected via the website and/or app, payment information, and these data are stored by Apsiyon. Here, we would like to state that Apsiyon does not store credit card data in its systems.

Additionally, Apsiyon may process the user activities on the system during their use of the services for improvement and statistical purposes. In such cases, data such as the Website that directed users to Apsiyon, the search engines and keywords users used to find Apsiyon, the pages users view on our website, and users' browser extensions and browser size can be processed. We use Website analysis tools to collect this data. We use technologies such as cookies and web beacons to collect data regarding the pages users view, the links users click, and their other activities on our website or app. Additionally, we may receive some standard data that users' browser sends to all websites visited, such as IP address, browser type and language, time of access, and linking Websites.

We may use web beacons, customized links, or similar technologies to determine whether the newsletter or promotional e-mail sent by Apsiyon has been opened and which links users have clicked.

Apsiyon collects and uses the personal data necessary to maintain operation and improve services. These uses may include conducting research and analysis in order to provide better service to customers, facilitate the use of applications and services by eliminating the need to re-enter the same information, and improve the Apsiyon app and the services it offers, as well as displaying customized content based on user interests and preferences.

We also use users' personal data to contact them. We may contact users as a part of several essential services such as welcoming via emails, dues and payment reminders, announcements by the community manager, survey and forum notifications, information about technical service issues, and privacy announcements.

When users fill out the forms on the Apsiyon Website and/or application, their personal data will be processed for limited purposes in line with the reason for submitting the form and for providing information about the services via e-mail or SMS provided that consent is given by users for receiving electronic messages of commercial nature.

The collected personal data are processed in compliance with the conditions laid out in the PDPL with the aims of taking the necessary actions to ensure easy and reliable performance by the products and services offered by Apsiyon, customizing the products and services to meet user demands, needs, and habits, determining and evaluating the commercial strategies of Apsiyon, and ensuring that the legal processes between the users and Apsiyon can be carried out quickly and properly. Accordingly, users' personal data are processed for the following purposes:

• Identifying and confirming the information regarding the contact using the Apsiyon Website and/or application,
• Recording the identity data, contact information, and other necessary data of the residents to be used in the provision of services,
• Issuing invoices in accordance with the applicable legislation,
• Offering personalized advertisements, campaigns, and other benefits with the explicit consent of the users,
• Segmenting users and performing data mining based on the data collected via the website and/or application; determining strategies on the basis of the ways users benefit the website and application,
• Evaluating and resolving users' requests, complaints, and suggestions,
• Fulfilling our rights and obligations arising from the applicable legislation.

Users' sensitive personal data (religion, sect, ethnicity, race, etc.) will not be requested and processed by Apsiyon without their express consent. To help prevent unauthorized access to personal data, users must log in with their own credentials (email address, mobile phone, and password) and not share their credentials with third parties. The Apsiyon profile, where login information can be updated and personal data can be accessed, and/or viewed can be accessed through the profile page.

The personal data to be processed may vary depending on the products and/or services offered by Apsiyon. Personal data collected verbally, in writing, or electronically by online and offline means are processed as per the consent users gave before the effective date of the Personal Data Protection Law No. 6698, the express consent users gave after the effective date of the PDPL, or within the framework of the terms and conditions specified in the PDPL throughout the period products and services provided by Apsiyon are used.

We also process personal data through cookies. For detailed information about cookies, please see our Cookie Policy .

3. Security of Personal Data

Apsiyon holds the ISO/IEC 27001 Certificate for Information Security Management Systems. Accordingly, Apsiyon stores all data in accordance with the security measures required by the ISO/IEC 27001 Certificate.

Protecting personal data is a priority for Apsiyon. We utilize a wide range of technologies and procedures to help protect users' personal data from unauthorized access, use, and disclosure. We store personal data in systems of computers located in controlled facilities to which access is limited. While transferring highly confidential data such as credit card numbers or passwords over the Internet, we use encryption methods such as the Secure Login Layer (SSL) protocol to protect these data.

If accounts and personal data are password-protected, it is the users' responsibility to keep their passwords confidential. The password must not be shared with others. In cases where users share a computer with others, it is of great importance to log out before leaving a website or a service in order to ensure that the next users cannot access login information.

Apsiyon, as the data supervisor as per the applicable legislation and in compliance with contracts concluded with the community association managers and the authorized management companies of the community associations, has undertaken the responsibility to create the necessary organization to ensure data confidentiality and integrity, as well as to take and adapt the necessary technical measures. The processing and storage of users' personal data are carried out only by authorized and trained personnel and in areas where data security can be ensured.

The users' personal data will be collected only within Apsiyon's scope of activity and for specific purposes, stored for as long as required by the reasons for processing this data and/or for the period stipulated in the applicable legislation and they will not be processed in a manner that is contrary to the provisions of the PDPL, and in cases where there is no reason requiring the processing of these data, apart from the cases where there is an obligation to store such data as per other applicable legislation, they will be deleted, destroyed or anonymized upon the request of the user or ex officio.

4. Transfer of Personal Data

In transferring data, Apsiyon operates in compliance with the PDPL, particularly Article 8, as well as decisions taken by the Personal Data Protection Board and relevant legislation. In principle, personal data is not transferred to third parties without the explicit consent of the persons concerned, in compliance with the provisions of the PDPL and the purposes specified in this Clarification Text.

However, in line with the purposes of processing personal data and with the condition that necessary security measures are taken, the collected personal data may be disclosed to domestic and foreign third parties, our business partners, our associates, payment service organizations, and, in line with our purpose of service and activity or in cases stipulated by the relevant legislation, to regulatory and supervisory institutions and official authorities.

Personal data will not be shared with third parties except for the cases stated in this Clarification Text. Personal data will not be shared with third parties for commercial purposes; however, instead, the users are given the option to decide whether they consent to Apsiyon sending messages on behalf of its business partners about the special offers of the said partners (without disclosing personal data to third parties). In some cases, we may establish contractual relationships with third parties in line with applicable legislation for these third parties to perform certain limited services on behalf of Apsiyon, such as processing and delivering mail, providing customer support services, hosting websites, conducting business transactions, or performing statistical analysis regarding our services. These service providers may need only the data required to provide their services. In such cases, the use of such data for purposes other than its intended use is prohibited and the said service providers must maintain the confidentiality of the respective data.

5. Determination of Responsibility

Apsiyon is a platform designed to provide assistance to the community association managers and management companies authorized by community associations for the provision of quality service to residents; so Apsiyon bears no responsibility for data entered into its systems by the community association managers and management companies authorized by community associations without being subject to Apsiyon's approval and/or evaluation processes.

Accordingly, Apsiyon will not interfere with the personal data entered into the Apsiyon Website and/or application by the community association managers and management companies authorized by community associations as a part of the platform provision service. Therefore, in some cases, it may not be possible to meet user demands regarding the rights stipulated in Article 11 of the PDPL, which are also stated below. In such cases, as Apsiyon, we accept, declare, and undertake that we will inform, upon your request, the relevant community association management and the management company authorized by the community association.