Privacy Policy

This policy explains what data the Arenda service (the “Service”) processes, why, where it is stored and how you can control it. The operator of the Service is the company named at the end of this document (the “Operator”). Data is processed with regard to Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

1. The Operator's two roles

Your account data. For the data of management-company staff who register and log in to the Service, the Operator is the data controller (veri sorumlusu).

Data you enter into the Service. Information about owners, tenants, leases and transactions is entered by the management company — the customer of the Service. For that data the management company is the data controller, and the Operator processes it on the company's behalf (as data processor, veri işleyen) solely to run the Service. The management company is responsible for having a lawful basis to enter this data and for informing its owners and tenants.

2. What data and why

Data	Purpose	Basis
Company name, staff member's name and e-mail, chosen language and plan	Creating the account, logging in, service e-mails (address confirmation, password recovery, payment reminders), invoicing	Entering into and performing the contract
Password	Logging in. Stored only as an irreversible hash (scrypt); the password itself is never stored	Performance of the contract, security
Server logs: IP address, time and address of the request	Security, protection against password guessing, troubleshooting	Operator's legitimate interest
Activity log of the company account: which employee changed, sent or downloaded what and when (no IP addresses, no document contents); one-time login codes	Security of the company's data, resolving disputes; the log is visible only to administrators of that company	Performance of the contract, legitimate interest of the client and the Operator
Data entered by the customer: owners (name, contact, e-mail, statement language), tenants (name, contact), apartments, leases, transactions, statements	Calculations and owner statements on the customer's instruction; sending statements to the owner's e-mail at the customer's command	Customer's instruction (processing on its behalf)
“Ask a question” form: name, e-mail, message	Replying to the question	Your request

The Service neither receives nor stores bank card data: payment is made by invoice.

3. Cookies and statistics

The Service uses only necessary cookies: the login session (arenda_session), the chosen language (site_lang) the colour theme (theme), the month selected in the application (period, 30 days) and the “do not ask for a login code in this browser” mark (arenda_trust, set only if you choose so, for 30 days). There are no advertising or tracking cookies.

Visits to public pages are counted by our own anonymous counter: how many times a page was opened per day and which site visitors came from. IP addresses and browser details are not stored in these statistics. If a third-party analytics tool is connected, this policy will be updated before it is switched on. The Operator sees aggregate usage counters for each company: the number of logins, actions and records entered — without their contents.

4. Where data is stored and who receives it

• Hosting: servers of the provider Beget, data centre in Astana (Kazakhstan). The database, documents uploaded by the company (receipts and contracts as PDF/JPG/PNG), saved versions of sent statements and backups are located there.
• Off-site backups: an encrypted copy of the database and uploaded documents is saved daily to Google Drive cloud storage (Google). Files are encrypted before upload; only the Operator holds the encryption key, so Google cannot read their contents.
• E-mail: service e-mails and statements are sent through the Timeweb mail service (Russia). The recipient's address and the message content, including the PDF statement, pass through it.

Data is therefore stored and processed outside Turkey. By registering you confirm that you have been informed of this. Data is not shared with anyone else, sold or used for advertising. It may be disclosed only where the law makes this mandatory.

5. How data is protected

• the connection to the Service is encrypted (HTTPS);
• each management company has its own separate data space — staff of other companies have no access to it;
• passwords are stored as hashes; changing a password ends all other sessions; login attempts are limited;
• company administrators log in in two steps: a password and a one-time code sent by e-mail; employees are given roles with different levels of access; actions in the account are recorded in a log;
• the Service's pages do not load scripts, styles or fonts from third-party servers;
• a database backup is made every night and kept for 60 days — on the server and, in encrypted form, in separate cloud storage.

6. Retention

Account data and the data you enter are kept for as long as the company's account exists. At the request of the company administrator the account and all its data are deleted within 30 days; they disappear from backups as those rotate — no later than 60 days after deletion. Questions sent through the website form and the activity log are kept for up to 12 months, one-time login codes for up to 30 days. Server logs are kept for up to 3 months.

7. Your rights

Under Article 11 of the KVKK you may learn whether your data is processed, request information about it, demand its correction or deletion, object to processing and claim compensation for damage caused by unlawful processing. Send your request to the Operator's e-mail; we reply within 30 days. You may also complain to the Turkish Personal Data Protection Board (KVKK Kurulu).

If you are an owner or a tenant and your data was entered by a management company, please contact that company first: it decides what data is entered and how long it is kept. We will help it fulfil your request.

8. Changes

If this policy changes materially, company administrators are notified by e-mail at least 14 days in advance. The current version and date are shown at the top of the document.

Operator and contact

The details of the operating company will be published here. Until then, for any question including personal-data requests, write to arenda@finexpert66.ru