ImportantThis text covers only the processing purposes that require Explicit Consent. The processing operations that form the basis of the Service (membership, service provision, payment) rely on the exceptions in KVKK Article 5/2 and are explained in the Privacy Notice (disclosure under KVKK Art. 10).

1. Scope and Purpose

Under KVKK Article 5/1, the processing purposes listed below may only be carried out with the Data Subject's Explicit Consent. In line with decision no. 2018/90 of the Board (KVKK), this text is presented separately from the Privacy Notice and in a granular manner (a separate box for each purpose).

Explicit Consent statements can be managed during sign-up and afterwards from the My Account > Privacy & Consents page. The default value for each purpose is unticked (no consent).

2. Purposes for Which Explicit Consent Is Given

2.1. Marketing and Promotional Communications (Commercial Electronic Messages)

I agree to receive campaigns, new-feature announcements, discount offers and educational content from Bunayorumum through the email, in-app and web push channels. The SMS channel is not currently used; should it be added in the future, your consent will be obtained separately for it.

Commercial electronic messages are managed through Law No. 6563 and the İYS (İYS, Turkey's commercial-message management system) infrastructure: this consent is recorded in the İYS, and any opt-out request you make under Law No. 6563 is applied without delay.

Personal Data processed: email address, open/click metrics
Legal basis: KVKK art. 5/1 (Explicit Consent) + Law No. 6563 art. 6 (prior consent)
Retention period: for the duration of consent + 3 years after cancellation (for proof)

2.2. Web Push Notifications

I agree to the processing of my push token and to receiving notifications from Bunayorumum in order to receive instant notifications through my browser or device (for example, when an analysis is ready or when the price of a saved listing drops).

Personal Data processed: browser push subscription, which event triggered the notification
Legal basis: KVKK art. 5/1
Retention: for the duration of the subscription; deleted when cancelled

2.3. Personalized Recommendations and Profiling

I agree to the creation of a personalization profile from my on-site behaviour (analysis history, likes, market searches) and to being shown content, listing and report recommendations based on this profile (UserBehaviorEvent & UserPersonalizationProfile).

Personal Data processed: page views, search filters, likes, purchase journey
Legal basis: KVKK art. 5/1; profiling is subject to objection under KVKK art. 11/g
Retention: 12 months (automatic anonymization if not active)

Note: for price comparison ("emsal"), anonymized, aggregate comparable-price data is compiled from arabam.com (always) and, optionally, from sahibinden.com; no individual listing or seller identity is stored. For details, see the Privacy Notice (disclosure under KVKK Art. 10).

2.4. Analytics Cookies (PostHog)

I agree to the placement of analytics cookies belonging to the PostHog platform in my browser and to the recording of my session behaviour so that site usage can be analyzed for the purpose of product development.

Personal Data processed: page views, session duration, click maps (password/email fields are masked)
Legal basis: KVKK art. 5/1 + the KVKK Cookie Guidelines 2022 (opt-in mandatory)
Retention: 1 year, then automatic deletion

You can manage your cookie preferences through the Cookie Policy page or via the on-site cookie banner.

2.5. Marketing Cookies (Google Ads, Meta Pixel)

I agree to the placement of Google Ads and Meta Pixel cookies in my browser for the purpose of ad targeting and conversion measurement. These integrations are not currently active; they may be enabled in the future, and when enabled they will only be loaded with this consent.

Personal Data processed: cookie identifier, pages visited, conversion events
Legal basis: KVKK art. 5/1 + the KVKK Cookie Guidelines 2022 (opt-in mandatory)
Transfer: US-based providers (Google, Meta), under Standard Contractual Clauses (SCC)

3. Right to Withdraw Consent

You may withdraw the Explicit Consent you have given, with effect for the future, at any time, free of charge and without giving a reason. Ways to withdraw:

Unticking the relevant box on the My Account > Privacy & Consents page
For marketing emails, the "unsubscribe" link at the bottom of each email
For push notifications, your browser/device notification settings
For cookies, the preferences panel on the Cookie Policy page
Email: iletisim@bunayorumum.net

Following your withdrawal request, the relevant processing is stopped immediately; existing data is deleted or anonymized within the framework of Article 7 (KVKK).

4. Consequences of Not Granting Consent

Not granting Explicit Consent does not block your access to the Service. It only means:

Without consent to marketing communications: no campaign/announcement email is sent (transactional emails, such as password reset and invoicing, continue)
Without consent to push notifications: no browser/device notification is sent (the on-site notification bell still works)
Without consent to profiling: anonymous/generic recommendations are shown, no personalized recommendation is offered
Without consent to analytics cookies: PostHog is not loaded (no product-improvement data is collected)
Without consent to marketing cookies: Google Ads/Meta Pixel are not loaded (general advertising remains, targeted advertising does not)

Processing operations that do not require Explicit Consent (membership, analysis of car and motorcycle listings, payment, security) continue to be provided in all cases.

5. Explicit Consent for Cross-Border Transfers (Temporary Scenario)

Under KVKK Article 9 (the 2024 reform), Bunayorumum uses the route of Standard Contractual Clauses (SCC) announced by the Board. In incidental situations where this route cannot be used, it may be necessary to obtain separate Explicit Consent for the Cross-border (overseas) transfer. When such a situation arises, your consent will be requested separately.

The main overseas providers to which transfers are made and the categories of data transferred:

Anthropic (USA): analysis prompts and (when the Vision feature is on) listing photos
Google / Gemini (USA): the default analysis model (analysis prompts)
Resend (USA): transactional and informational emails
Sentry (USA): error and performance logs
PostHog (EU / Frankfurt): anonymous product analytics (only when consent is given)
Cloud hosting provider (infrastructure)

Since the preferred route for transfers to these providers is SCC, under normal circumstances no separate consent is requested for the Cross-border (overseas) transfer. Separate Explicit Consent is requested only for incidental situations where the SCC cannot be used.

Conditional Vision transfer: the Vision feature is off by default. When you enable this feature, up to 8 photos of the listing are transferred to Anthropic (USA) for damage/paint assessment; the license plate is masked and raw photos are not stored by us.

6. Consent Record and Proof

The consents you give are stored in our database with a timestamp:

The purpose for which consent was given
Which text was shown (version number)
The date of consent and the date of withdrawal (if any)
The IP address at the time of consent (for proof, 3 years)

These records are kept solely for the purpose of proof and may be submitted to the Authority (KVKK) in the event of an audit/complaint. They are anonymized after 3 years.

7. Contact

For any question, request or cancellation relating to Explicit Consent: iletisim@bunayorumum.net