Privacy Policy (GDPR & KVKK)

The controller within the meaning of the GDPR and the data controller (veri sorumlusu) under the KVKK is:

• Company: BCN İnşaat ve Gayrimenkul Ltd. Şti.
• Address: Soğucak Mah. 881. Cad. No: 18/A (Yaylaköy Kavşağı), Kuşadası / Aydın, Türkiye
• Email: info@bcninsaat.com
• Phone: +49 1577 217 95 11 · +90 532 488 84 09 · +90 256 612 82 85
• Trade registry: [TO BE ADDED: trade registry office and registration number]
• MERSİS no.: [TO BE ADDED: MERSİS number]
• Authorised representative(s): [TO BE ADDED: managing director(s)]
• VERBİS: [TO BE ADDED: assessment of the registration obligation in the Turkish Data Controllers Registry and registration details, if applicable]

As our website is also directed at persons in the European Union, a representative established in the EU must be designated pursuant to Art. 27 GDPR.

[TO BE ADDED: name, address and contact details of the EU representative. Will be published here once appointed.]

Personal data is collected exclusively through the following channels, electronically and partly by automated means:

• Contact form: full name, phone number, email address, area of interest (topic), message text, KVKK consent status, page of submission, time of submission and selected language. This information is forwarded via our server by email to our sales team's mailbox.
• Server logs: when the site is accessed, the hosting provider briefly processes the IP address and technical request data for secure operation. For form submissions, the IP address is used only transiently in memory for abuse prevention (rate limiting) and is not stored permanently.
• Cloudflare Turnstile (bot protection): on the contact page, browser and device information may be processed by Cloudflare for the security check.
• Google Maps: on the location pages we embed Google Maps maps, which are loaded only after your consent via the cookie banner or the "Load map" button. When the map loads, Google processes data (e.g. your IP address) under its own responsibility (provider: Google Ireland Ltd. / Google LLC, USA). Without consent only a placeholder is shown; in addition we link to Google Maps in a new tab.
• Language preference ("lang" cookie and localStorage): your language selection is stored in a first-party cookie (12 months) and in localStorage. The cookie is technically transmitted to our server with each request to enable the homepage language redirect; it is not shared with third parties.
• Consent storage ("cookie-consent" localStorage): your decision on embedding Google Maps is stored exclusively locally in your browser and is not shared with third parties (valid for 12 months); you can change it at any time via the cookie settings in the footer.

We process your data for the following purposes on the legal bases indicated:

• Responding to your enquiry, providing information and offers, arranging appointments or viewings. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) and KVKK Art. 5/2-c.
• Secure and error-free operation of the website, bot and abuse prevention. The legal basis is Art. 6(1)(f) GDPR (legitimate interest) and KVKK Art. 5/2-f.
• Compliance with legal obligations (Art. 6(1)(c) GDPR and KVKK Art. 5/2-a).
• Embedding Google Maps maps on the location pages. The legal basis is your consent (Art. 6(1)(a) GDPR and KVKK Art. 5/1); it can be withdrawn at any time with future effect via the cookie settings in the footer.

Your data is shared only for the stated purposes and to the extent necessary with the following categories of recipients; it is never sold or rented for marketing purposes:

• Hosting provider for the technical operation of the website. [TO BE ADDED: final provider; currently Vercel Inc. (USA) and/or İHS Telekom A.Ş. (Türkiye)].
• Cloudflare, Inc. (USA) for bot protection of the contact form (Turnstile).
• Email service provider for the delivery of form notifications. [TO BE ADDED: email/SMTP provider].
• Google Ireland Ltd. / Google LLC (USA) for displaying the location maps, exclusively after your consent.
• Public authorities, only where a legal obligation exists.

As the controller is established in Türkiye, data submitted from the EU is transferred to and processed in Türkiye. Some of the service providers listed above (Cloudflare, Vercel, Google) are headquartered in the USA.

Transfers to US providers rely on their certification under the EU-US Data Privacy Framework and/or on EU standard contractual clauses (Art. 46 GDPR). Following the 2024 amendment of KVKK Art. 9, transfers from Türkiye abroad are primarily based on adequacy decisions or appropriate safeguards (in particular standard contracts notified to the Turkish Data Protection Authority).

[TO BE ADDED: confirmation of the safeguard mechanism used under KVKK Art. 9 (e.g. notified standard contract).]

Contact enquiries are retained until your request has been dealt with and thereafter for [TO BE ADDED: retention period, e.g. ... years] in the email mailbox, after which they are deleted; statutory retention obligations remain unaffected.

The IP information used for rate limiting is held only in memory for a maximum of 10 minutes. Technical access logs of the hosting provider are subject to its usual short retention periods.

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time. Under KVKK Art. 11 you additionally have, in particular, the following rights:

• To learn whether your personal data is processed and to request information about it,
• To learn the purpose of processing and whether the data is used in line with that purpose,
• To know the third parties to whom the data is transferred in Türkiye or abroad,
• To request rectification of incomplete or inaccurate data,
• To request erasure or destruction under KVKK Art. 7 and notification of recipients,
• To object to a result produced exclusively by automated analysis to your detriment,
• To claim compensation for damage caused by unlawful processing.
• Right to lodge a complaint: with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurulu) and, for persons in the EU, with the supervisory authority of your place of residence.

You may submit requests in writing to the address above or, with information verifying your identity, by email to info@bcninsaat.com (procedure under the Turkish Communiqué on application to the data controller).

Requests are answered free of charge within 30 days at the latest; a fee under the Authority's tariff may apply only where the process incurs additional costs.

Data is transmitted over TLS-encrypted connections; access is restricted to authorised persons and the infrastructure is operated with up-to-date security measures. Form submissions are protected by automated abuse prevention (Turnstile and rate limiting).

No automated decision-making or profiling takes place on this website; no analytics or advertising trackers are used.

This notice will be updated as processing activities or the legal situation change; the current version is always available on this page.