1. Identity of the Data Controller
The data controller for the purposes of the KVKK is:
Phone: +90 535 793 72 98 · Email: enisgumus1@gmail.com
GMS Home is a real-estate advisory business based in Alanya, Turkey, providing property search, sale, rental brokerage and after-sale support. Personal data collected through the website and its contact forms is processed within the scope of this activity.
2. Categories of Personal Data Processed
Through the website's forms (property enquiry and callback request), the following categories of data are processed:
- Identity data: first name (surname is not required).
- Contact data: phone number, messaging-app identifier (if provided), email (only for direct correspondence).
- Enquiry content: type of property sought, area, budget range, free-text comment.
- Processing-security data: the page the form was submitted from, the submission timestamp, and technical browser data (used to detect bots and abuse).
- Legal-action data: the time and scope of consent checkboxes ticked (consent record).
The site does not process online payments, identity verification or location tracking; special categories of personal data (KVKK Art. 6) are not collected.
3. Purposes of Processing
- Responding to and evaluating your enquiry (information request, callback, property matching);
- Preparing advisory support, formulating an offer and communicating with you as a client;
- Preventing abuse of the forms (spam, automated submissions) and maintaining website security;
- Fulfilling record-keeping and disclosure obligations arising from the Real Estate Trading Regulation and other applicable legislation;
- Resolving potential legal disputes and meeting obligations towards competent authorities, where applicable.
4. Legal Basis for Processing
Your personal data is processed on the basis of the following legal grounds under Article 5(2) of the KVKK:
- point (c): processing is directly related to the establishment or performance of a contract — for the data necessary to handle your enquiry and potentially establish an advisory/brokerage relationship;
- point (ç): processing is mandatory for the controller to fulfil a legal obligation — for record-keeping and disclosure duties;
- point (f): processing is necessary for the controller's legitimate interests, provided this does not harm your fundamental rights and freedoms — for abuse prevention and website security.
For any processing not covered by the grounds above — in particular direct marketing or any purpose not listed in this notice — your separate, explicit consent is requested (see the Açık Rıza Metni).
5. Recipients of Personal Data
Collected data may be shared with the following categories of recipients, strictly to the extent necessary for the purposes above and in accordance with Article 8 of the KVKK:
- Service providers (data processors): the website's hosting provider; the messaging infrastructure provider used to forward submitted enquiries (see Section 6, Telegram LLC).
- Competent public authorities: only where required by law and upon an official request.
- Professional advisers (legal, accounting): to the extent necessary to render their services and subject to confidentiality obligations.
Your data is never sold or rented to third parties for marketing purposes.
6. Cross-Border Data Transfer (KVKK Art. 9)
Enquiries submitted through the website's forms are forwarded, to speed up handling, as a message via the Telegram Messenger infrastructure (Telegram FZ-LLC / Telegram Messenger Inc.). This provider's servers may be located outside Turkey; accordingly, this transfer constitutes a cross-border transfer of personal data within the meaning of Article 9 of the KVKK.
This transfer is carried out on the basis of your explicit consent and is limited to the minimum data set of your name, phone number and enquiry content. Depending on the location of the website's hosting provider, technical log data may also be processed abroad.
A formal assessment of the legal basis for this cross-border transfer under KVKK Art. 9 (adequate safeguards / undertaking) and, if required, notification to Turkey's Personal Data Protection Authority should be carried out separately by legal counsel — this document only transparently describes the current factual situation.
7. Retention Period
Your personal data is retained for as long as necessary for the purpose of processing, and in any event no longer than the limitation periods set out in applicable law (generally up to 10 years under the Turkish Code of Obligations and the Turkish Commercial Code). If no advisory/brokerage relationship is established and no other legal basis arises, data relating to your enquiry is deleted, destroyed or anonymised no later than 12 months after it has been answered. On expiry of the period, or upon your request, deletion, destruction or anonymisation is applied.
8. Your Rights Under KVKK Article 11
By applying to the data controller, you have the right to:
- learn whether your personal data is being processed;
- request information about such processing, if any;
- learn the purpose of processing and whether the data is used in accordance with that purpose;
- know the third parties to whom your data is transferred, domestically or abroad;
- request rectification of incomplete or inaccurate data;
- request deletion or destruction of data where the grounds for processing no longer apply;
- request that any rectification, deletion or destruction be notified to third parties to whom the data was transferred;
- object to a result that is to your detriment arising solely from automated analysis of your data;
- claim compensation for damages arising from unlawful processing of your data.
9. How to Submit a Request
To exercise the rights above, complete the Data Subject Request Form or send a written request, together with identity-verifying documents, to enisgumus1@gmail.com. Your request will be answered free of charge within a maximum of 30 days, depending on its nature; if fulfilling it requires additional cost, a fee set by the Personal Data Protection Board's tariff may apply.
If your request is rejected, the response is considered insufficient, or no response is given within the statutory period, you have the right to lodge a complaint with Turkey's Personal Data Protection Board within 30 days of learning the response, and in any event within 60 days of your original request.
Effective date: 30 August 2026.