Burgasian

KVKK Information Notice

Last updated: October 10, 2026

This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK). The notice required by Article 13 of the EU General Data Protection Regulation (GDPR) is on the Privacy page; both texts describe the same processing activities, and if one changes the other is updated in the same release.

1. Data controller

The data controller is SMARTIA OOD (СМАРТИЯ ООД) · Tria City Center, Burgas · Bulgaria, which operates Burgasian (www.burgasian.com). Contact details are on the Contact page.

2. Personal data processed

The personal data processed by Burgasian is limited to the following:

  • Identity and account: your SocialID reference number, your display name (at most 80 characters), the moment you accepted the terms of use, whether your account is active, an administrator flag where applicable, and the times your account was created and last updated. Your e-mail address and password are not held by Burgasian; they stay with the central identity service, SocialID.
  • Location: taken only at the moment you grant device permission. Your raw GPS coordinates are never stored on the server; a check-in record holds only the venue, the day and your distance to the venue in metres.
  • Content you create: your feed posts, your group and direct messages, the events you create or join, the venues you add to the directory and, if you own a venue, your promotions.
  • Moderation and support: the content or user reports you submit (with your reason and note), the users you block, and the title and message of any support request you send.
  • Transaction security: the session and sign-in security cookies and the terms-acceptance record — their names and lifetimes are on the Cookies page.
  • Paid membership status (tier and validity). Your payment details stay with Apple or Stripe and never reach us.

3. Purposes of processing

  • Providing the service and creating and managing your account.
  • Location-based features: listing venues near you and confirming that you are really at the venue when you check in.
  • Communication between users (feed, group chat, direct messages) and event management.
  • Security, prevention of abuse and fraud, content moderation and the resolution of reports.
  • Meeting legal obligations and responding to your requests.

4. Legal basis

  • Necessary for the conclusion or performance of a contract (KVKK art. 5/2-c): your account, your content, your messages and your event records.
  • Explicit consent (KVKK art. 5/1): location data. You can withdraw your consent at any time in your device settings; the app also works without location (except for the nearby features).
  • Legitimate interests of the controller (KVKK art. 5/2-f): security, prevention of abuse and moderation.
  • Compliance with a legal obligation (KVKK art. 5/2-ç): statutory retention and response duties.

5. Method of collection

Data is collected entirely by automated means while you use the app or the site: the SocialID sign-in flow, in-app forms (post, message, event, venue, report, support request) and, where you allow it, your device's location service.

6. Transfers

Your data is never sold or handed to third parties for advertising. Only the following service providers are used, to the extent necessary to deliver the service (the KVKK art. 9 framework for transfers abroad is described separately below):

  • Hosting and visitor measurement: Vercel (outside Türkiye).
  • Database: Neon — European Union region.
  • Authentication: SocialID (Sosya ecosystem).
  • Place search: OpenStreetMap / Nominatim — the query goes directly from your browser, and only when you search.
  • Report notification e-mail: Resend (United States) — target type and ID, reason and note (without the reporter's identity) when forwarded to the operator by e-mail.
  • Request rate limiting (abuse prevention): Upstash (United States) — your IP address is held briefly as a counter key and expires automatically.

KVKK Art. 9 requires an adequacy decision or appropriate safeguards for transfers abroad; the standard contract announced by the Turkish Authority and the notification to the Authority fall within it. The hosting provider's (Vercel Inc., United States) published data processing addendum contains the EU standard contractual clauses (GDPR Art. 46(2)(c)); whether those clauses satisfy KVKK Art. 9 (the Authority's standard contract and notification duty) is subject to legal review. For users in the EU the basis is GDPR Art. 46.

7. Retention and deletion

Your data is kept for as long as your account remains open. My Account lets you delete your account permanently: your posts, messages, event and check-in records, promotions and membership record are erased irreversibly. Your central SocialID identity is not affected; you can close that separately through SocialID.

8. Your rights (KVKK art. 11)

Under Article 11 of the Law you have the right to:

  • Learn whether your personal data is being processed.
  • Request information if it has been processed.
  • Learn the purpose of processing and whether the data is used in line with that purpose.
  • Know the third parties, in Türkiye or abroad, to whom the data is transferred.
  • Request correction if the data is incomplete or incorrect.
  • Request erasure or destruction within the conditions of Article 7 of the Law.
  • Request that correction, erasure or destruction be notified to the third parties to whom the data was transferred.
  • Object to an adverse outcome reached solely through automated analysis of your data.
  • Claim compensation if you suffer damage because your data was processed unlawfully.

9. How to apply

To exercise your rights, use the form on the Contact page. Your application is concluded free of charge within 30 days at the latest; if the process incurs a cost, the tariff set by the Turkish Personal Data Protection Board applies.

If your request is refused, not answered in time or you find the answer insufficient, you may complain to the Turkish Personal Data Protection Board under Art. 14 KVKK (www.kvkk.gov.tr). The supervisory authority for users in the EU (Bulgaria's КЗЛД) is stated in the Privacy Policy.

KVKK Information Notice · Burgasian