KVKK Privacy Notice

Effective Date: March 2026

1. Data Controller

Your personal data is processed by AHT Apps / XchangeTR as the data controller.

Contact: [email protected]

2. Processed Personal Data

The following personal data may be processed through our application:

Data Category	Data	Collected From?
Identity	Name, surname	Shop owners, registered users
Contact	E-mail address, phone number	Shop owners, registered users
Location	GPS location data (approximate and precise)	All users (if permission granted)
Business	Business name, address, tax ID, verification documents	Shop owners
Device & Technical	IP address, device ID, operating system, usage data	All users
Financial	Subscription plan info, payment history (card info is not stored)	Paid plan users
Visual	Business photos (for the storefront visual)	Shop owners
User Content	Exchange/gold prices, comments, ratings, margin spreads	Shop owners, registered users

3. Purposes of Processing Personal Data

• Provision and maintenance of the application service
• User account creation and management
• Shop ownership verification and security processes
• Providing location-based exchange office listing services
• Execution of price alarm and notification services
• Protection of application security and integrity
• Fulfilling legal obligations
• Measuring and improving service quality

4. Legal Basis for Processing Personal Data

Your personal data is processed wholly or partly by automatic means based on the following legal grounds within the scope of Article 5 of the KVKK:

Processing Purpose	Legal Basis (KVKK Art. 5)
Service provision, account management	Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract (Art. 5/2-c)
Application security and fraud prevention	Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f)
Legal claims, official authority notifications	Data processing is mandatory for the data controller to fulfill its legal obligation (Art. 5/2-ç)
Location data usage, notifications and international transfer	Explicit consent of the data subject (Art. 5/1)

5. Data Transfer and International Transfer

Your personal data may be transferred to the following parties in accordance with Articles 8 and 9 of the KVKK:

• Infrastructure and Analytics Providers: Google Play Services, Firebase Analytics, Firebase Crashlytics.
• Data Providers: NosyAPI (Technical integration for market data).
• Authorized Public Institutions and Organizations: In case of legal dispute or legal obligation, to legally authorized institutions.

International Transfer: As our application uses globally standardized secure cloud infrastructure (e.g. Google/Firebase), system data may be stored on servers located outside of Turkey. This transfer is carried out based on your explicit consent or the legal safeguards provided by the KVKK.

6. Data Retention and Destruction

Pursuant to the KVKK and relevant legislation, the retention periods for your data are as follows:

• Contract Acceptance Records: 10 years. (For legal dispute resolution and legal audit purposes)
• Consent Date and IP Address: 2 years. (Due to the obligation pursuant to Law No. 5651)
• Price and Location Data: As long as your account is active.

Deletion Request: If you wish to delete your account and data, you can send an email to our support team ([email protected]) or use the in-app "Delete My Account" option. Your request will be finalized within a maximum of 30 days (typically within 24 hours).

Data Breach Notification: In the event of unauthorized access or data breach, the Personal Data Protection Board will be notified within 72 hours at the latest, and you will be informed as soon as possible (via email or push notification).

7. Age Restriction

You must be at least 18 years old to use this application. Personal data from individuals under 18 is not knowingly collected. If it is discovered that an individual under 18 has provided personal data, the relevant data will be deleted immediately.

8. Your Rights Under KVKK (Article 11)

Pursuant to Article 11 of the KVKK, you have the right to learn whether your data has been processed, to know whether it is being used in accordance with its purpose, to request correction of incomplete or incorrectly processed data and notification thereof to third parties, to request deletion of data, to object to results arising from automated analysis, and to demand compensation for damages.

9. Application Method

To exercise your rights under the KVKK, you can contact us through the following channels with information verifying your identity:

• E-mail: [email protected] (Must be sent from the email address registered in our system)

Your applications will be answered free of charge within 30 days at the latest. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.

10. Security and Cookies

Necessary technical and administrative measures are taken to protect your information. We use Google reCAPTCHA to ensure the security of our application interfaces and prevent spam and bot activities. FCM (Firebase Cloud Messaging) tokens and your local preferences are stored on your device for application notifications.

11. Changes

This notice may be updated in line with legislative changes or application updates. Significant changes will be notified within the application.