This notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 ("KVKK"). Full details of how your data are processed are set out on the Privacy and Security Policy page.
1. Data Controller
Ebtnet Bilişim ve İnternet Hizmetleri Limited Şirketi Esenyalı Mah. Yanyol Cad. Varyap Plaza No:61 İç Kapı No:247, Pendik / İstanbul MERSİS: 0323141039100001 Application address: kvkk at citiveo.com
2. Personal Data Processed
- Identity: name (provided optionally).
- Contact: e-mail address; optionally provided and verified telephone number.
- Transaction security: password hash, session records, IP-based rate-limiting counters (not stored permanently); encrypted verification key for two-factor authentication, irreversible hashes of recovery codes, and remembered-device records.
- Website usage data (only with explicit consent): pseudonymous online identifiers via Google Analytics 4, pages viewed, device and browser information. IP address is anonymised.
- Customer transaction: coupon requests and redemptions, points movements, saved content and reviews.
- Visual records: photographs uploaded by the user (location data stripped).
- Professional/commercial: business-ownership claim applications and verification documents; city-partner application information and, for active city partners, IBAN, tax identification details and service-fee records required for payment.
- Financial: subscription amount, currency, invoice records and card references generated by the payment provider. Card numbers are not processed.
3. Purposes of Processing
Creation of membership registration and identity verification; provision of the service (coupon, review, save, route, passport); verification of business ownership; conclusion, collection and invoicing of the subscription agreement; prevention of misuse and information security; handling of requests and complaints; operation of the city-partner programme and payment of service fees; sending of commercial electronic messages where explicit consent has been given; measurement of website usage via Google Analytics 4 where explicit consent has been given; fulfilment of retention and disclosure obligations arising from applicable legislation.
4. Legal Bases (KVKK Art. 5)
- Art. 5/2(c) necessity for the establishment or performance of a contract: account, subscription, coupon.
- Art. 5/2(ç) legal obligation: invoice and accounting records.
- Art. 5/2(e) establishment, exercise or protection of a right: dispute records.
- Art. 5/2(f) legitimate interest: security, prevention of misuse, anonymised usage statistics.
- Art. 5/1 explicit consent: marketing communications, optional addition of a telephone number, and measurement of website usage via Google Analytics 4.
5. Parties to Whom Data Are Transferred (KVKK Arts. 8–9)
Payment institution (iyzico), e-mail delivery provider (Resend), bot-protection provider (Cloudflare), AI translation and assistant provider (Anthropic), hosting and content-delivery providers; competent public authorities and institutions upon request. Some are established abroad and transfers are made within the framework of KVKK Art. 9. A detailed list is set out in the Privacy Policy.
Google Analytics 4. Where you have given explicit consent, your website usage data are transferred to the analytics service provider Google and processed on Google's servers in the United States. This cross-border transfer is based on your explicit consent within the scope of KVKK Art. 9. You may withdraw your consent at any time by disabling the Analytics category via the "Cookie preferences" link at the bottom of every page.
6. Method of Collection
Personal data are collected through electronic means and partly by automated methods, via forms on the website, account transactions, file uploads, automated system logs and — solely for the categories you have permitted — cookies.
7. Your Rights (KVKK Art. 11)
To learn whether your personal data are being processed; if so, to request information regarding such processing; to learn the purpose of processing and whether data are used in accordance with that purpose; to know the third parties to whom data are transferred domestically or abroad; to request rectification if data are incomplete or inaccurately processed; to request erasure or destruction; to request that third parties to whom data have been transferred be notified of rectification or erasure; to object to a result that is detrimental to you arising solely from analysis by automated systems; to claim compensation for damage suffered as a result of unlawful processing.
Both the right of access and the right to erasure may be exercised directly within the product: from your profile page you may download your data and submit an account deletion request (with a 30-day reversal period).
8. How to Submit a Request
You may submit your request to kvkk at citiveo.com from the e-mail address registered to your account, or in writing to Esenyalı Mah. Yanyol Cad. Varyap Plaza No:61 İç Kapı No:247, Pendik / İstanbul. Your request will be concluded within at most 30 days. If you are not satisfied with the outcome, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).