Bosphorus Brokers - Real Estate in Turkey

Privacy Policy and KVKK Information Notice

Last updated:

This notice explains how your personal data is processed when you visit bosphorusbrokers.com, contact us, or use our real estate brokerage, property management and citizenship-by-investment support services. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform, and, for visitors in the European Economic Area, our notice under Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").

1. Data controller

Burak Ünal, sole proprietor (şahıs işletmesi), operating under the registered trademark Bosphorus Brokers. Licensed real estate broker: authorisation certificate no. 3408704, issued by the Republic of Türkiye Ministry of Trade under the Regulation on Real Estate Trade. Address: Merkez Mahallesi, Hasat Sokak No:12/2, 34384 Şişli, İstanbul, Türkiye. Istanbul Chamber of Commerce (İTO) registration no. 235779-5. Email: contact@bosphorusbrokers.com. Telephone: +90 533 140 04 96.

Bosphorus Brokers is not a separate company. It is the registered trademark under which Burak Ünal carries on his licensed real estate brokerage as a sole proprietor, so he is personally the data controller and answers your privacy requests himself.

2. Personal data we process

  • Identity: name and surname, nationality, date of birth, passport or Turkish identity number, and the tax number needed for a title deed transfer.
  • Contact: email address, telephone and WhatsApp number, country of residence and postal address.
  • Enquiry and customer transaction data: what you are looking for (budget, area, property type, timing), viewings, offers, the written brokerage agreement, invoices and payments of our fee.
  • Property data: for owners, landlords and tenants: title deed details, address, photographs of the property, lease terms and rental payments we manage.
  • Financial and compliance data: bank transfer receipts, foreign currency sale certificates and source-of-funds information where a purchase or a citizenship file requires them, and the customer identification records that real estate brokers must keep under anti-money-laundering law.
  • Special categories of personal data: we do not ask for them on this website. If your citizenship or residence file needs a criminal record certificate or health insurance details, they are processed only as described in section 4.
  • Transaction security and technical data: IP address, browser and device information, request logs and, only with your consent, analytics cookie data (see the Cookie Policy).
  • Records of your choices: the date, time and version of the notice you acknowledged on our forms, your cookie choice, and your consent to receive our newsletter.

3. How we collect it

Partly by automated means (the website forms, cookies and server logs) and partly by non-automated means: email, telephone, WhatsApp, video calls, documents you send us, meetings at our office or at a property, and information we receive from the other side of your transaction, developers, banks, valuation companies and public authorities while we work on your file.

4. Purposes and legal bases

  • Answering your enquiry, preparing a shortlist and arranging viewings: directly related to the conclusion of a contract, including steps you ask us to take before one (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
  • Providing our brokerage and management services (the written brokerage agreement, negotiation, coordinating the title deed transfer, tax number, bank account and utility subscriptions, letting and managing your property, coordinating a citizenship or residence file you ask us to support): performance of a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)).
  • Legal obligations: the written agreement and record keeping required by the Regulation on Real Estate Trade, customer identification and record keeping under the Law on the Prevention of Laundering Proceeds of Crime No. 5549, commercial, tax and accounting records, and requests from authorities (KVKK Art. 5/2(ç); GDPR Art. 6(1)(c)).
  • Establishing, exercising or protecting a right (KVKK Art. 5/2(e); GDPR Art. 6(1)(f)).
  • Website security, keeping records of notices and choices, and improving our services: our legitimate interests, provided this does not harm your fundamental rights and freedoms (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
  • Showing public Google reviews with the reviewer's public name, as published on Google: data made public by the data subject (KVKK Art. 5/2(d)) and our legitimate interest.
  • Analytics cookies, our newsletter and other commercial electronic messages, and publishing your testimonial, photograph or video: only with your explicit consent, which you can withdraw at any time without affecting earlier processing (KVKK Art. 5/1; Law No. 6563 on Electronic Commerce; GDPR Art. 6(1)(a)).
  • Special categories (a criminal record certificate or health insurance details for a citizenship or residence file): only where the file requires them, under KVKK Art. 6 (your explicit consent given on a separate form, or where processing is necessary to establish, exercise or protect a right) and GDPR Art. 9.

We do not make decisions about you by automated means alone, and we do not sell personal data.

5. Recipients

Each recipient receives only the data it needs for the purposes above:

  • the other party to your transaction (seller, buyer, developer, landlord or tenant), to arrange viewings, offers and contracts;
  • land registry offices, notaries, sworn translators, licensed valuation companies, banks, insurers (including compulsory earthquake insurance) and utility providers, when your transaction needs them;
  • for a citizenship or residence file you ask us to support: the land registry, the Presidency of Migration Management, the General Directorate of Population and Citizenship Affairs, and the licensed bank, pension company or portfolio manager you choose;
  • independent lawyers and accountants, where you or we instruct them;
  • public authorities and courts where the law requires, including the Financial Crimes Investigation Board (MASAK);
  • our IT service providers: website hosting and delivery of form emails (Amazon Web Services, servers in Frankfurt, Germany), our email and office software provider, and, only with your consent, Google (Google Analytics);
  • Google (Maps and YouTube) only when you choose to load a map or play a video, and Meta (WhatsApp) if you choose to contact us on WhatsApp.

6. Transfers abroad

Some recipients are located outside Türkiye (for example our hosting provider in Germany, Google and Meta), and you may yourself be abroad when you contact us. Personal data is transferred abroad only in line with KVKK Article 9 as amended by Law No. 7499: on the basis of an adequacy decision, appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority within five business days of signature, or, for incidental transfers, one of the exceptions in Article 9/6, including your explicit consent or where the transfer is necessary for a contract with you. Transfers out of the EEA follow Chapter V of the GDPR.

7. Retention

  • Enquiries that do not lead to a service: 2 years after our last contact.
  • Brokerage agreements, transaction and management files: for the duration of the service and then 10 years (Turkish Commercial Code and Turkish Code of Obligations).
  • Customer identification records under anti-money-laundering law: 8 years from the transaction (Law No. 5549, Article 8).
  • Accounting and tax records: the periods set by commercial and tax law.
  • Newsletter: until you unsubscribe; the record of your consent and its withdrawal is kept for 3 years, as commercial electronic message rules require.
  • Website server logs: up to 30 days, unless needed to investigate a security incident.
  • Published testimonials, photographs and videos: until you withdraw your consent.

When a period ends, or the reason for processing no longer exists, we delete, destroy or anonymise the data under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, at the latest in the next periodic destruction cycle.

8. Security

We use encrypted connections (HTTPS), access limited to the people who need it, confidentiality obligations for anyone who works with us, reputable providers bound by data protection terms, and secure storage. We do not ask for passport scans or bank details through this website. If personal data is obtained by others unlawfully, we notify the Personal Data Protection Board within 72 hours and the persons concerned as soon as possible.

9. Your rights

Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that third parties to whom data was transferred are notified of a correction or deletion; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your supervisory authority.

10. How to apply

Use our KVKK application form and send it in writing to the address in section 1, by email to contact@bosphorusbrokers.com from the email address registered with us, with a secure electronic or mobile signature, or by registered electronic mail (KEP). We reply free of charge within 30 days at the latest (a fee under the Board's tariff may apply only if the reply involves an extra cost). If you are not satisfied with the reply, or receive none in time, you may complain to the Personal Data Protection Board (www.kvkk.gov.tr) within the periods in KVKK Article 14.

11. Children

Our services are for adults. We do not knowingly collect personal data from children through this website; children's details are processed only when a parent provides them for a family citizenship or residence file.

12. Versions and changes

We may update this notice; the date of the current version is shown at the top of the page. Translations are provided for convenience; if they differ, the Turkish version prevails: Gizlilik Politikası ve KVKK Aydınlatma Metni.