KVKK privacy notice

This privacy notice is for everyone who uses CasaX or whose records are kept through CasaX: managers of residential complexes and apartment buildings, employees of management companies, owners, tenants and household members, complex staff, visitors to casax.com.tr and anyone who writes to us through the contact form.

CasaX is a product name. The business that provides the service and is referred to in this notice as "we" or the data controller is:

Our position with respect to your personal data depends on the purpose for which, and on whose behalf, the data is processed.

• Data for which we are the data controller. Your CasaX account (name, email, phone number, password), subscription and billing details, support correspondence, the contact form, website visits and records kept for the security of the service. We decide for what purpose and how this data is processed.
• Data for which we are the data processor. Records entered into CasaX to manage a residential complex or apartment building: units, owner, tenant and household member details, dues and other amounts owed, collections, bank transactions, requests, announcements, polls, reservations, and visitor and parcel records. The data controller for these records is the management of your residential complex: the manager or management board acting on behalf of the owners' meeting under the Condominium Law (KMK) or, if management has been entrusted to a company, that company under the contract between them. We process this data only on the instructions of the complex management and in order to provide the service.

Data we process as the data controller:

• Identity and contact details: first name, last name, email address, phone number.
• Account and transaction security: an irreversible hash of your password, verification codes, session and device information, IP address, login and activity logs.
• Subscription and billing: organization name, billing name, Turkish national ID number or tax number, tax office, address, selected plan and payment status. Card details do not reach CasaX; they are collected on the payment institution's page.
• Support and contact form: the content of your message and the residential complex or company name you provide.
• Use of CasaX Assistant: the messages you write to the assistant, the answers given, the actions you approve and the monthly usage count.
• Marketing consents: your email and SMS preferences, if you have given consent.
• Cookies: session and preference information and, if you consent, analytics data (cookie policy).

As the data processor, we process the following data entered by the complex management or submitted by residents for the complex: block and apartment details; the resident's name, phone number, email address and relationship to the apartment (owner, tenant, household member), move-in and move-out dates, vehicle license plate; IBAN for payment matching; charges, collections, receipts and account statements; the description, amount and sender details of bank transactions; requests and attached photos; reservations; visitors' names and entry times; parcel records; announcement read status and poll votes.

As the data controller, we process your data on the following grounds listed in KVKK art. 5:

• Establishment and performance of a contract (art. 5(2)(c)): account creation and login, subscription, payment and billing, responding to support requests, mandatory notifications about the service.
• Legal obligation (art. 5(2)(ç)): keeping the records required by tax and commercial legislation, requests from competent authorities.
• Establishment, exercise or protection of a right (art. 5(2)(e)): records that must be kept as evidence in the event of a dispute.
• Legitimate interest (art. 5(2)(f)): account and service security, prevention of misuse, troubleshooting, and improving the service through aggregated usage measurements that do not identify individuals.
• Explicit consent (art. 5(1)): sending commercial electronic messages and optional analytics cookies. You can withdraw your consent at any time.

For the records we process as the data processor, the purpose and legal ground are determined by the complex management (e.g., tracking dues, communicating with residents, security of the complex). The complex management is responsible for informing residents and, where necessary, obtaining their explicit consent.

Your data is collected by automated or partly automated means: from you through the casax.com.tr website, the web panel, the iOS and Android apps, the contact form and email; from records that the complex management enters manually or uploads from Excel; and from integrations connected by the complex management (BankSocket for bank transactions, iyzico or PayTR for payment results, the SMS provider for SMS delivery reports).

Personal data is transferred only to the following groups of recipients, limited to the purpose and to the extent necessary:

• Providers of server, database, file storage, backup and email delivery services.
• Payment institutions for subscription payments (iyzico; Stripe if the foreign card payment option is enabled), and Apple App Store and Google Play for mobile subscriptions.
• Services connected by the complex management: iyzico or PayTR for dues payments, BankSocket for bank transactions, Netgsm or Twilio for SMS.
• Apple and Google notification services for delivering mobile notifications.
• Providers of AI language model services for generating CasaX Assistant answers; only the content needed to answer the relevant question is sent.
• Public institutions and organizations authorized by law and, in the event of a dispute, our legal advisers.

Some of these providers may have servers located outside Turkey. Transfers abroad are made in accordance with the conditions of KVKK art. 9: to countries covered by an adequacy decision, with appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board, or in the cases of occasional transfer listed in the Law.

• Account, subscription and billing records: for the duration of the membership and, after it ends, for the period required by tax and commercial legislation.
• Security and access logs: for the period required by the applicable legislation.
• Support and contact form correspondence: for a reasonable period after the request is resolved, in case of possible disputes.
• Records processed on behalf of the complex management: for the duration of the service; when the organization is deleted or the management requests it, they are deleted or anonymized, subject to statutory retention obligations.
• Marketing consents: until consent is withdrawn.

Under KVKK art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it has been transferred; to request its correction if it is incomplete or inaccurate, its deletion or destruction when the legal conditions are met, and notification of these actions to the third parties to whom it was transferred; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can submit your application to info@casax.com.tr from the email address registered to your account, or in writing to Ahmet Aksungur (Aksungur Yazılım), Karşıyaka Mah. 3923 Sk. Tez Apt. No: 2 İç Kapı No: 1 Kepez / Antalya. Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board.

You can delete your CasaX account yourself in the account settings in the app; records subject to statutory retention obligations are kept for that period.

This notice is updated when necessary. The current version is published on this page; the "Last updated" date at the top of the page applies.