KVKK
Privacy Notice
Privacy notice regarding personal data processing activities of the Karşılaş application under the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Data Controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data may be processed by Parevo as the data controller within the scope described below.
Data Controller: Parevo
Email: [email protected]
Address: Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy / Istanbul, Turkey
2. Categories of Personal Data Processed
| Data Category | Description | Requirement |
|---|---|---|
| Identity | Name, surname, date of birth, gender | Required |
| Contact | Email address | Required |
| Account | Username, password (hashed) | Required |
| Profile | Profile photo, bio, city/country | Optional |
| Location | GPS coordinates | With explicit consent |
| Music | Spotify listening data, compatibility score | With explicit consent |
| Interests | Event preferences, social media links | Optional |
| Communication Content | Messages, match requests, group chats | Within scope of service |
| Events | Participation, saved events, listings | Within scope of service |
| Technical | Device information, IP, push token, usage logs | Automatic |
3. Purposes of Processing Personal Data
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Performance of contract (Art. 5/2-c) |
| Profile creation and personalization | Performance of contract (Art. 5/2-c) |
| Displaying nearby events | Explicit consent (Art. 5/1) |
| Calculating music compatibility score | Explicit consent (Art. 5/1) |
| Matching and messaging services | Performance of contract (Art. 5/2-c) |
| Sending push notifications | Explicit consent (Art. 5/1) |
| Platform security and abuse prevention | Legitimate interest (Art. 5/2-f) |
| Fulfilling legal obligations | Expressly provided by law (Art. 5/2-a) |
| Service analytics and improvement | Legitimate interest (Art. 5/2-f) |
4. Methods of Collecting Personal Data
Your personal data is collected electronically through application registration forms, OAuth providers (Google, Apple, Spotify), device permissions, automatic collection during app usage, and information entered directly by you.
5. Transfer of Personal Data
Your personal data may be transferred to the following recipient groups for the purpose of providing the service:
| Recipient | Purpose of Transfer | Location |
|---|---|---|
| Google (Firebase, Sign-In) | Infrastructure and authentication | USA/EU |
| Apple (Sign-In) | Authentication | USA |
| Spotify | Music profile integration | EU/USA |
| Expo | Push notifications | USA |
| Ticketmaster | Event data (no user data shared) | USA |
| Authorized public authorities | Legal obligation | Turkey |
- Cross-border data transfers are carried out under KVKK Art. 9 to countries declared to offer adequate protection by the Personal Data Protection Authority, or through written undertakings/Standard Contractual Clauses.
6. Retention Period of Personal Data
Your personal data is retained for as long as required by the processing purpose and applicable statutory limitation periods. Upon an account deletion request, your data is permanently deleted within 30 days; legal retention obligations are reserved.
7. Processing Requiring Explicit Consent
Your separate explicit consent is obtained for the following processing activities:
- Location data: To display nearby events and map features
- Spotify connection: To calculate music taste compatibility scores
- Push notifications: For event reminders, messages, and match notifications
- You may withdraw your explicit consent at any time through app settings or device permissions
8. Your Rights as a Data Subject (KVKK Art. 11)
- To learn whether your personal data is being processed
- To request information if your personal data has been processed
- To learn the purpose of processing and whether data is used accordingly
- To know third parties to whom your personal data is transferred domestically or abroad
- To request correction if your personal data is incomplete or inaccurate
- To request deletion or destruction under the conditions set out in KVKK Art. 7
- To request notification of correction and deletion to third parties
- To object to results arising solely from automated processing that are adverse to you
- To claim compensation for damages arising from unlawful processing of your personal data
9. Application Method and Timeline
To exercise the rights listed above, you may apply to [email protected] together with information verifying your identity.
Your applications will be concluded free of charge within 30 (thirty) days at the latest. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Authority.
If your application is rejected, the response is found insufficient, or no response is given within the required period, you may lodge a complaint with the Personal Data Protection Authority within thirty days following notification of the response, and in any event within sixty days from the date of application.