Privacy Policy
Effective Date: 05.11.2026
This Privacy Policy explains how your personal data is collected, for what purposes it is used, with whom it is shared, and how it is protected on ERSA İNŞAAT PROJE TURİZM SANAYİ VE TİCARET ANONİM ŞİRKETİ operated by https://primeistanbulresidences.com It clarifies the handling of your personal information on the site.
The scope of this policy is limited to the services actually provided on our site; sections related to unused services are not included in this text.
1. Data Controller
| Title | ERSA İNŞAAT PROJE TURİZM SANAYİ VE TİCARET ANONİM ŞİRKETİ |
| Company Type | Joint Stock Company |
| Address | Yenibosna Merkez, Zübeyde Hanım Cad. A No: 4A, Bahçelievler / İstanbul |
| Tax Office / No | Yenibosna Vergi Dairesi / 3680247978 |
| MERSIS No | 0368024797800015 |
| iletisim@primeistanbulresidences.com | |
| Phone | +90 554 579 06 43 |
2. Personal Data We Process
The following data is always processed for the core operation of the site:
- Identity and contact information: name, surname, email address and phone number information you have provided to us
- Transaction security: IP address, session logs, browser and device information, mandatory cookie data
- Request records: the content and history of communications you have had with us
Any other data processed is only included below if the relevant service is active on this site.
3. Our Processing Purposes
- Fulfillment of your requests and applications
- Ensuring account and session security
- Compliance with legal obligations (tax, trade, consumer legislation)
- Prevention of fraud and misuse
- Measurement and improvement of site performance
4. Legal Bases (KVKK Article 5)
- It is mandatory for the formation or performance of a contract
- It is explicitly provided for by law and is necessary for the fulfillment of a legal obligation
- Data processing is mandatory for the establishment, exercise, or protection of a right
- Our legitimate interests, provided that they do not harm your fundamental rights and freedoms
- Your explicit consent (for commercial communications, cookie-based marketing, etc.)
5. Who do we share with?
Your data is limited solely to the relevant purpose, and is shared with IT infrastructure and hosting providers, financial and legal advisors, and authorized public institutions and organizations upon request. The scope of data sharing for each additional service active on the site (such as payment, shipping, marketplace, messaging, measurement, etc.) is also specified in the relevant section below. In cases where data transfer abroad is required, the conditions stipulated by KVKK are complied with.
6. Retention Periods
- Commercial ledgers and documents: 10 years (Turkish Commercial Code)
- Tax and invoice records: 5 years (Tax Procedure Law)
- Membership and communication records: a reasonable period after the relationship ends
- Commercial communication consent records: 3 years from the withdrawal of consent
- Traffic records (IP address, connection date and time, requested page and request details): at least 1 and at most 2 years (Law No. 5651)
- Security records of logins and administrative actions: at least 1 year
Your data will be deleted, destroyed, or anonymized at the end of these periods.
7. Data Security
Your data is protected by administrative and technical measures such as authorized access, encryption, secure connection (SSL/TLS), logging, and regular backups. Our staff is bound by confidentiality obligations.
8. Cookies
The full list of cookies used on the site, the service they belong to, and their retention periods are published on the Cookie Policy page; that list is also generated from the services that are actually active on this site. Non-essential cookies only operate with your consent, and you can change your preferences at any time.
9. Membership and Account Data
When you create an account on the site, your full name, email, phone number, and an irreversible hash of your password are processed. Login logs, IP address, and device information are retained for account security and to prevent abuse. You can view and edit your account and the information in it from the dashboard, as well as request the deletion of your account; upon a deletion request, records subject to legal retention obligations are stored in a limited manner until their retention period expires.
10. Two-Factor Authentication
When you protect your account with two-step verification, the secret key that matches your verification app and — if used — the phone number to which the verification code is sent are processed. Recovery codes are stored irretrievably. This data is used only to verify your identity and prevent unauthorized access to your account; it is not used for marketing purposes.
11. Reservation and Appointment Data
When creating a reservation or appointment, your full name, contact information, date/time, number of guests, and any special requests are processed. This data is used to establish the reservation, send reminders, provide the service, and handle cancellation or modification requests. For group reservations, only the participant information strictly necessary to provide the service is processed.
12. Reservation Channels (Booking, Airbnb, etc.)
Our accommodation and availability information is also published on online reservation channels. For reservations made through these channels, the guest's name, contact information, accommodation dates, and payment status transmitted by the channel are forwarded to us and recorded in our system. The channel through which you made the reservation is also a data controller within the scope of its own privacy policy; the conditions of that channel also apply to cancellation and change rules.
13. Accommodation and Identity Declaration
Accommodations comply with the Identity Declaration Law No. 1774, recording your identity/passport details and reporting them to law enforcement units. This reporting is a legal requirement. This reporting is a legal requirement.The accommodation is not based on consent and cannot be provided without prior notice. Identity data is stored only for this purpose and for the period specified by law; it is not used for marketing purposes.
14. Dues, Meter and Site Management Data
Within the scope of residence/site management, the name, contact information, section number, aidat accrual and collection records of the independent section owner or tenant are processed. Meter readings are necessary for sharing accounts based on consumption and are only used for this purpose. If there are common area security records, their duration and purpose are also announced.
15. Form and Request Data
When you fill out the contact, offer, and application forms on the website, the name, contact information, and message content you share are processed for the purpose of evaluating your request, responding to you, and tracking the history of your request. We recommend that you do not write any sensitive information (ID number, health information, card details) that is not required in the form's message field. Unless you have specifically indicated your consent to receive commercial communications, your form data will not be used for marketing purposes.
16. Reviews and Ratings
When you submit a review, rating, or evaluation, your visible name, comment text, uploaded images (if any), submission date, and IP address are processed. Your comment's visible name and content are publicly accessible once it is published. Submitted content is filtered before publication; comments containing illegal material, insults, or advertisements are not published. You may request the removal of your comment.
17. Notification Preferences
From your account's notification settings, you can individually enable or disable optional notification types such as campaigns and discounts, stock and price updates, comments and question answers, as well as membership and subscription notifications via email, SMS, instant notifications, and WhatsApp channels. Your preferences are saved and checked before each transmission. Order, shipping, return, and security notifications are necessary for the performance of the contract and the security of your account; therefore, they cannot be disabled. Disabling notification types does not automatically revoke your consent for commercial communications; you can withdraw your consent by using the opt-out link in the messages or by contacting us.
18. Customer Relationships and Segmentation
Your communication history, requests, purchase, and interaction records are consolidated into a single customer record to manage the relationship established with you. These records are used to improve service quality, expedite your requests, and identify suitable campaigns for you and can be automatically segmented (e.g., new customer, regular shopper, long-term inactive).
Segmentation does not produce an automated decision with legal consequences for you; it merely determines the relevance of communication and offers. You have the right to object to this assessment and request a review of the decision.
19. Notifications and Device Data
When you accept to receive notifications, your browser/device notification address (token), device type, and language information are processed. This data is solely used for sending notifications and measuring the success of the delivery. You can revoke the notification permission at any time through your browser or device settings; when you do so, your record is deleted.
20. Mobile Application
When you use our mobile application or the web application installed on your device, your device type, operating system, application version, language preference, and the application key that maintains your session are processed. This information is used to ensure the application's functionality, security, and error resolution.
Permissions such as camera, location, notifications, and similar device permissions are requested only when you use the relevant feature and with your consent; the reason for each permission is stated on the permission screen. Not granting a permission does not prevent the application's other functions, and you can revoke any granted permission at any time from your device settings. Your location is not continuously tracked in the background.
Analytics and ad measurement in the application only work when you grant tracking permission; if you do not grant permission, the application continues to function without measurement.
You can delete your account from within the app or via the "My Account > Delete My Account" section. Upon receiving your request, your account will be suspended and the request will be processed within the legal timeframe; your personal data will be deleted or anonymized, and order and invoice records, which have a legal retention period, will be stored separately from your identity.
21. Measurement and Analytics
Analytical tools are used to understand how the website is utilized. These tools collect data such as pages visited, session duration, referring address, approximate location (at city level), device, and browser information. Measurement cookies only operate with your consent, and you can withdraw your consent from the Cookie Policy page. As the providers' servers may be located abroad, data transfer to foreign countries may occur within this scope.
22. Advertising and Remarketing
Advertising measurement and retargeting technologies can be utilized through the pixels of advertising platforms. These technologies process your ad identity with information about the pages and products you view, clicks, and conversions, allowing for the display of ads relevant to your interests. Marketing cookies operate solely with your consent; this sharing ceases when you revoke your consent. Advertising display may continue without personalization.
23. External Evaluation Platforms
The comments and ratings you write on external platforms (map/business profile, review sites) where our business profile is located are published within the framework of the rules of that platform. To be able to respond to these comments, the comment text, your visible name, and response history are transferred to our panel. The relevant platform is also a data controller in terms of this data; you can also request the deletion of your comment from the tools of that platform.
24. Social Media Components
The website may feature social media feeds or sharing buttons. When these components load, the respective platform may process data such as your IP address and the page you visited according to its own policies. Sharing a post is subject to the terms of the relevant platform.
25. Embedded Video and Audio Contents
On some pages, video or audio content is displayed embedded from the platform where the content is hosted (e.g. YouTube, Vimeo). When the player is loaded, your IP address, device/browser information, and the page you are viewing are transmitted to the relevant platform; the platform may set its own cookies. These components are loaded when you have given consent to the relevant cookie category. The platform's own privacy policy applies.
26. Map and Location
A map service is used to display address and route information. When the map loads, it processes your IP address and device details provided by your browser. If your browser requests location permission, this is optional and you can decline; your location is not stored by us.
27. Hosting and Content Delivery Infrastructure
The site is served through a content delivery network (CDN) to protect against attacks and ensure fast page loading. This infrastructure processes the IP address from which your request comes, browser information, and request time for security and performance purposes, and keeps short-term records. If images are served from a media service, the same technical data is also transmitted to that service. These providers act as data processors.
28. Google API Services and Linked Google Accounts
This site and admin panel run on infrastructure operated by Milenyums. The name of the application connected to Google services via the panel is Milenyums Dijital; the application's home page is https://milenyums.com, and the admin panel is located at https://partners.milenyums.com. The rules in this section apply to data obtained from Google when you voluntarily connect your Google account to the application.
Connection is optional
Linking a Google account is not required; the site and panel can be used fully without it. The connection is established only by you clicking the “Connect with Google” button on the Integrations screen in the panel, and you can see the permissions you granted on Google's consent screen. The authorization flow redirects to https://partners.milenyums.com/oauth/geri-donus/….
Requested Permissions and Usage Purposes
Only permission is requested for the service you choose to connect; no permission is requested for a service you do not use.
| Google Business Profile | .../auth/business.manage | Read business account and location list, import and respond to customer reviews in the dashboard, update business information and posts |
| Google Search Console | .../auth/webmasters, .../auth/siteverification | Verify site ownership, add property to your account, submit sitemap, and read search performance data |
| Google Analytics | .../auth/analytics.edit | Create a web data stream with GA4 property and place measurement ID on the site |
| Google Tag Manager | .../auth/tagmanager.manage.accounts, .edit.containers, .edit.containerversions, .publish | Create tag container, set up GA4 tag, and publish version |
| Google AdSense | .../auth/adsense.readonly | View publisher ID and whether your site is registered with AdSense in read‑only form |
| Google Ads | .../auth/adwords | Bring campaign, impression, and cost reports to the dashboard |
| YouTube | .../auth/youtube.upload, .../auth/youtube.readonly, .../auth/youtube.force-ssl | Upload video from panel, read channel and video information |
| Google Drive | .../auth/drive.file | Write site backups only to files created by the app itself; no access to the rest of your Drive |
| Google account identity | openid, .../auth/userinfo.email | Show which Google account is connected in the panel |
What do we do with the data obtained from Google?
- Authorization tokens: access and refresh tokens are stored encrypted on our servers; they are used solely to perform the above actions on your behalf.
- Account identifiers: the email address of the linked account along with the business account, location, property, and container IDs are stored to enable accurate targeting and to display “linked account” information in the panel.
- Service content: data such as business profile reviews, search performance, and ad reports are processed for display and reporting in the panel.
- This data is shown only to authorized panel users of the relevant site; it is not disclosed to another site or client.
What We Don’t Do
- We do not sell, rent, or use data obtained from Google APIs for advertising targeting.
- We do not transfer data to third parties for purposes such as ad serving, credit scoring, or similar activities.
- We do not use data to train artificial intelligence or machine learning models (including generalized model training).
- We do not read data manually. Exceptions are limited to: resolving your support request with your explicit consent; security‑purpose review (misuse/violation); when the data is aggregated and anonymized; and when required by law.
Limited Use Declaration
Milenyums Dijital application’s use and transfer of information obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawing Consent and Deleting Data
You can revoke the connection at any time via the panel under Integrations → Disconnect in the panel, or via the My Google Account → Third‑party app access page. When the connection is terminated, the tokens are immediately removed from our system; the data retrieved from Google and displayed in the panel is deleted within 30 days at the latest. You may send your deletion request to iletisim@primeistanbulresidences.com, through the channels listed on our Contact page, or to the platform support address destek@milenyums.com.
Retention and International Transfer
Data obtained from Google is retained only for the duration that the relevant service is provided; it is deleted when the connection ends. Since Google’s infrastructure is located abroad, such transfers are carried out in accordance with the conditions set forth in KVKK.
29. Messaging and Inbox
When you reach out to us via our website or through our messaging channels (email, WhatsApp, social media inboxes), the message content, sender's name and contact information, along with the time of the message, are collected in a single inbox. These records are stored for the resolution of your request, for tracking purposes, and as proof in case of any disputes. Message contents are not used for marketing purposes and are not accessible to irrelevant staff members.
30. Short Links and QR Codes
When a short link or QR code is used; click time, referrer address, device/browser type, approximate location at the country-city level, and a unique visitor flag are processed. This data is used to generate link statistics and prevent abuse; full IP addresses are not displayed in reports.
31. Inter-Site Management Across Connections
This site may be part of a network of sites owned by the same company. The network administrator can manage the content of affiliated sites and incoming requests from a single panel; in this context, your requests and contact information transmitted through the form can be seen by authorized persons at the network center. Your request is only used for response and follow-up, and is not sold or transferred to another company in the network.
32. Your Rights (KVKK Art. 11)
- Learning whether your personal data is processed
- Requesting information regarding this if it has been processed
- Learning the purpose of processing and whether it is used in accordance with its purpose
- Knowing the third parties to whom it is transferred domestically or abroad
- Requesting correction if it has been processed incompletely or inaccurately
- Requesting its deletion or destruction
- Requesting notification of correction/deletion processes to the third parties to whom data has been transferred
- Objecting to an outcome against you resulting from analysis exclusively by automated systems
- Requesting compensation if you suffer damage due to unlawful processing
33. Application Methods
You can submit your application through one of the following channels to exercise your rights:
- Email: iletisim@primeistanbulresidences.com
- Wet-signed petition: Yenibosna Merkez, Zübeyde Hanım Cad. A No: 4A, Bahçelievler / İstanbul
Your application will be finalized within 30 days at the latest.
34. Changes
This policy may be updated in accordance with changes in legislation and the services we provide. When a new service is introduced on our site, the relevant section is added to this text; the section belonging to a service that is no longer offered is removed from the text. The current version is always published on this page.
