1. Identity of the data controller
Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, the data controller with regard to your personal data processed in the Niğde App mobile application, the nigdeapp.com website and the attached panels (the "App") is identified below.
- Contact for requests: destek@sosyalsehir.com
The App is installed for one city only; this installation serves Niğde. This notice is not a summary of the Privacy Policy but the minimum information the law requires; the details are in the Privacy Policy, and the two are read together.
2. Categories of personal data processed
Depending on the features you use, personal data in the following categories is processed in the App. The data of a module you do not use is never created.
- Identity: name, username, date of birth, gender, profession (only the name is required).
- Contact: e-mail address, phone number, saved delivery addresses.
- Account and transaction security: password hash, session token, IP address, device and browser information, verification records, consent records, push token.
- Visual and audio records: profile photograph, the photographs and videos you upload, SAHNE contest photograph. No audio recording is processed; in a spoken question only the text your phone transcribes is received.
- User content: posts, comments, listings, messages, reviews, poll answers, confessions, questions asked to the assistant, game scores, game table messages.
- Location: location rounded to an area of about 500 metres on the GALA live map; exact location at check-in and during a taxi trip.
- Listing verification data (only when the city administration has turned EİDS on and you place a listing that requires verification): your verified first name and surname and your EİDS user code received from the Ministry of Trade's Electronic Listing Verification System (EİDS); your verified phone number and, where the listing is placed for a legal person, its tax identification number, which are sent to the Ministry; on a vehicle listing, the licence plate and the make, trade name, model year and listing authorisation end date returned by the Ministry; on a real-estate listing, the property number and the province, district, neighbourhood, block (ada) and parcel shown on the title deed, and the listing authorisation end date. Your Turkish identity number is neither collected nor stored.
- Customer transaction records: food and flower orders, taxi requests, tradesman requests, store purchase receipts, and for businesses card payment transaction records (excluding card data).
- Marketing and usage: content viewed, profile visits, videos swiped, the marketing consent you gave.
- Technical measurements: aggregated performance counts and scrubbed error records that carry no identity.
Special categories of personal data (health, religion, biometric data and the like) are not collected as profile data.
3. Purposes of processing
Your personal data is processed for the following purposes:
- Creating your account, verifying your identity and securing the account.
- Providing the services of the modules you choose: showing news and events, forwarding an order or taxi request to the relevant business or driver, publishing listings, messaging, community and contest features.
- Sending in-app notifications and, according to your preference, marketing messages.
- Content moderation, review of reports, prevention of abuse and application of sanctions, including moderators seeing a reported message together with its report, the review of direct message contents (including taken-back and view-once messages) to examine reports and keep the platform safe (for example against fraud, harassment or threats to child safety), or at the request of a competent authority, only by the city administrator and behind a separate review password, every review being recorded, the review of game table messages, with who sat at the table, in the same way and for the same purposes, and moderators reading the conversation of a community room that is the subject of a report, every reading being recorded.
- Recognising the digital entitlements you bought and tracking their duration; for businesses, running payment and invoicing processes.
- Measuring the service, fixing its errors and improving it.
- On vehicle and real-estate listings, fulfilling the verification obligation that the legislation places on listing service providers: verifying the advertiser's identity through EİDS, querying the Ministry of Trade for the authority to list the vehicle or property concerned, taking the listing down when that authority ends or when the Ministry reports that it was revoked, and publishing on the listing, in a form that cannot be changed, the information the legislation requires a listing to show.
- Responding to requests from competent authorities and fulfilling legal obligations.
- Establishing, exercising and protecting rights in disputes.
4. Legal bases
Under Article 5/2 of the KVKK your personal data is processed on the following legal bases without explicit consent:
- Formation or performance of a contract (Art. 5/2-c): the account, orders, taxi requests, purchases and business membership.
- Compliance with a legal obligation (Art. 5/2-ç): financial records, requests from competent authorities, statutory retention periods; EİDS identity and listing-authority verification on vehicle and real-estate listings, the transfer to the Ministry of Trade this requires, and the publication of the information the legislation requires a listing to show (Regulation on Real Estate Trade, Art. 14/2-i; Regulation on the Trade of Second-Hand Motor Land Vehicles, Arts. 21/1-a and 22/1-ç).
- Establishment, exercise or protection of a right (Art. 5/2-e): moderation, report and audit records.
- Legitimate interests of the controller (Art. 5/2-f): account security, prevention of abuse, security review of messages, measuring and sustaining the service.
Processing outside these — location sharing on the GALA live map, marketing messages, and transfers abroad to AI, spoken-reply and notification providers — rests on your explicit consent under Articles 5/1 and 9 of the KVKK. Explicit consent is obtained separately and freely on the relevant screens in the App; if you do not give it only that feature does not work, the rest of the App does. You can withdraw your consent at any time.
5. Transfer of personal data
Your personal data is transferred to the following groups of recipients only to perform the relevant function and only to the extent that function requires:
- Service providers (processors): object storage (the installation's own server or Cloudflare R2), notification delivery (Google Firebase Cloud Messaging), SMS (Netgsm), e-mail (Resend), weather (Open-Meteo; the city's fixed coordinate only), AI models for the city assistant (Google Gemini, Groq, Anthropic Claude — those the city administration enables), spoken reply (Google Cloud Text-to-Speech), store purchase management (RevenueCat, if the city administration chooses it), payment institutions for businesses' card payments (iyzico or PayTR).
- Stores: the Apple App Store and Google Play, as the merchant in in-app purchases.
- Platform services: your phone's operating system (Apple or Google) for speech recognition in a spoken question; Apple Maps or Google Maps for map tiles.
- Other users and businesses: the content you share, your profile, your name, contact phone and delivery address on an order (to the relevant business), and on a taxi request your name, pickup point and — unless you chose "Hide my number" in the taxi module — your verified phone number (to the accepting driver, while the ride lasts). In the Listings module, and only on listings where you have explicitly allowed it, your verified phone number is shown in the app and on the website to anyone who presses that listing's contact button. On the website an individual seller's name is shown shortened to the first letter of the surname.
- Ministry of Trade (EİDS): if the city administration has turned EİDS on and your listing requires verification: for identity verification, the single-use authorisation code issued by the Ministry, your verified phone number and, for a legal person, its tax identification number; for the listing-authority query, your EİDS user code, the listing number, the tax identification number where the listing is placed for a legal person, and, on a vehicle listing, the licence plate or, on a real-estate listing, the property number. The e-Devlet sign-in takes place on the Ministry's page; your Turkish identity number and e-Devlet password never reach Niğde App. The transfer is domestic and rests on a legal obligation under Article 8/2-a of the KVKK.
- People viewing the listing: on a vehicle listing verified through EİDS the make, trade name and model year, and on a real-estate listing the province, district, neighbourhood, block (ada) and parcel on the title deed, together with the fact that the listing was verified through EİDS, are shown publicly. Your name, surname, EİDS user code, the licence plate and the property number are not shown on the listing.
- Competent public institutions: where legislation requires it.
Some of the providers above are established abroad; to that extent data is transferred abroad within the meaning of Article 9 of the KVKK. This transfer rests on your explicit consent or on the other conditions the law provides.
6. Method of collection
Your personal data is collected electronically, by fully or partly automated means: directly from you when you fill in registration and profile forms, share content, place orders, send messages and use the App's features; automatically through your device's operating system permissions (location, notifications, microphone); through the receipt returned by Apple and Google on store purchases; and through the transaction result returned by the payment institution on business card payments. The App uses no third-party advertising or analytics trackers.
When you verify through EİDS, your first name, surname and EİDS user code, the make, trade name, model year and authorisation end date of a vehicle, and the province, district, neighbourhood, block (ada) and parcel on a title deed with its authorisation end date are obtained electronically from the Ministry of Trade's Electronic Listing Verification System.
7. Retention periods
Data is kept for as long as necessary for the purpose it is processed for and for the retention periods legislation requires. The periods of automatically deleted records (live-map shares and stories 24 hours, profile visits 90 days, post views up to 180 days, swipe records 45 days, backups 14 days, performance totals 8 days, error records 30 days) and the anonymisation applied 30 days after account deletion are set out in detail in the Privacy Policy. For EİDS records: your EİDS identity verification is kept while your account remains open and must be renewed once the period set by the city administration (365 days by default) has passed or when your phone number changes; when your account is deleted it is taken out of use at once and deleted 2 years after the deletion. The licence plate, property number and title-deed details held in the verification record are deleted 180 days after the listing ended or was deleted; on a land listing, the block (ada) and parcel taken from the title deed stay with the listing as part of it. The technical log of calls to the Ministry contains no personal data and is kept for 90 days.
8. Your rights under Article 11 of the KVKK
By applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used in accordance with that purpose,
- know the third parties to whom it is transferred domestically or abroad,
- request correction if it is incomplete or incorrectly processed,
- request erasure or destruction under the conditions of Article 7 of the KVKK,
- request that correction, erasure and destruction be notified to the third parties it was transferred to,
- object to a result against you produced by analysing the processed data exclusively through automated systems,
- claim compensation if you suffer damage due to unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller you can send your requests in writing to destek@sosyalsehir.com, or by registered electronic mail (KEP) or from the e-mail address registered in the App to destek@sosyalsehir.com. Your application must contain your name and surname, your signature if it is in writing, your Turkish identity number for citizens of the Republic of Türkiye or your nationality and passport number or identity number if any for foreigners, your address for service, your e-mail address and phone number for notification if any, and the subject of your request.
Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature; if the operation requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, your right to lodge a complaint with the Personal Data Protection Board is reserved.
The name, surname, vehicle and title-deed details received from EİDS are data of the Ministry and of the official registers concerned; if any of it is wrong, it is corrected at the institution that keeps that register, and Niğde App cannot change these fields. If you ask for your EİDS record to be deleted while a listing that requires verification is live, the listing may be taken down until verification is done again; records that must be kept under a legal obligation are kept until the end of their retention period.
You can correct your profile details, make your account private, switch off profile-view tracking, turn off notifications and delete your account yourself from within the App without making an application. For general support use destek@sosyalsehir.com.