KVKK / GDPR COMPLIANCE

Subprocessors

TapuGezgini relies on the following third-party service providers for service delivery. Each provider's purpose, the data categories it accesses, and its hosting region are listed. Published as data controller under KVKK Article 8 and GDPR Article 28.

Last updated: June 15, 2026

Provider	Purpose	Data categories	Hosting region
Amazon Web Services (AWS)	Application hosting, database (RDS), object storage (S3), secrets (Secrets Manager)	· All application data · Uploaded files · Encrypted sensitive fields	eu-west-1 (Ireland)
Amazon Simple Email Service (SES)	Transactional emails (signup, password reset, receipts) + marketing campaigns	· Email address · Name · Content template variables	eu-west-1 (Ireland)
NetGSM	SMS delivery (verification codes, listing alerts, marketing)	· Phone number · Message content	Türkiye
Meta Platforms (WhatsApp Business Cloud API)	WhatsApp messaging (customer communication, notifications)	· Phone number · Message content · Template variables	Ireland + USA
Garanti BBVA Sanal POS	Primary payment processing (3D Secure card payments)	· Order amount · Transaction reference · Card data (held by Garanti, not transmitted to TG)	Türkiye
Iyzico	Backup payment provider (enabled via feature flag)	· Order amount · Transaction reference	Türkiye
Stripe	International backup payment provider (enabled via feature flag)	· Order amount · Transaction reference	Ireland + USA
Finansbank E-Fatura	E-invoice / e-archive issuance + GİB dispatch (UBL-TR XML)	· Invoice line items · VKN/TCKN · Address · Amount	Türkiye
Anthropic (Claude API)	AI content generation (operator-triggered blog/SEO content)	· Operator-supplied prompt + sample text	USA
OpenAI (GPT API)	Alternative AI content generation when configured by operator	· Operator-supplied prompt + sample text	USA
Google Maps Platform	Map rendering + location verification (at the moment of use only)	· Listing coordinate · Browser IP (logged by Google)	Global
Google E-Devlet (entegrasyon)	Turkish identity verification (during registration, with user consent)	· Turkish national ID number	Türkiye (Government)
Tapu Kadastro Genel Müdürlüğü API	Property ownership verification (prior to listing publication, with user consent)	· Land registry data · Turkish national ID (matching)	Türkiye (Government)
Upstash / ElastiCache (Redis)	Sessions + rate limiting + idempotency + SSE pub/sub	· Opaque session tokens · Transient counter data	eu-west-1 (Ireland)

Notification mechanism

Active enterprise customers receive email notification at least 30 days before a subprocessor is added or changed. To be added to the notice list, write to our compliance team.

DSAR and data portability

Under KVKK Article 11 (data-subject rights) you may request a copy of your data or its deletion. Account → Data Export lets you trigger the request, or you can ask for account deletion.