1. Introduction and Scope
TR MOTOSİKLET BORSASI TİCARET LİMİTED ŞİRKETİ (the “Company”, “MOBO” or “we”) cares about the security of your personal data. This Privacy Policy explains our practices regarding the personal data processed through the motosikletborsasi.com website and the mobile application named “Motosiklet Borsası” offered on Google Play and the App Store (the “App”).
This Policy should be read together with the Member - Customer Privacy Notice, the Cookie Policy, the Membership Agreement and the Terms of Use. Our disclosure obligation under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) is reserved; in case of any conflict, the relevant privacy notice prevails.
2. Data Controller and Contact
| Legal name | TR MOTOSİKLET BORSASI TİCARET LİMİTED ŞİRKETİ |
| Address | Maslak Atatürk Oto Sanayi 2. Kısım, 15. Sokak No: 511-512, Sarıyer / İstanbul, Türkiye |
| iletisim@motosikletborsasi.com | |
| Registered email (KEP) | trmotosikletborsasi@hs01.kep.tr |
| Website | https://motosikletborsasi.com |
3. Personal Data We Process
You can use the App without signing up just to browse listings. Most of the data below is processed only when you choose to use the related feature.
| Data category | Data processed | When it is processed |
|---|---|---|
| Identity and contact | Mobile phone number; first name, last name, email address, province and district | When you create an account and complete your profile |
| Identity verification | Identity verification status and date (the verified name is the name already saved in your profile) | When you complete the identity verification step |
| Billing and company details | Individual/company selection, company name, tax office, tax ID number, province, district and full address | When you save your billing details or purchase a paid service |
| Listing and vehicle data | Plate, make, model, year, mileage, price, province, district, colour, engine displacement, power, description, equipment and safety features | When you create a listing or auction record |
| Images | Listing photos you select from your device's gallery or take with the camera | When you add photos to your listing |
| Transaction and exchange data | Bids you place, bid history, won transactions, wallet balance and account activity | When you use the exchange features |
| Payment data | Order record, package details, amount and payment status; the card brand and last four digits of the card number returned by the payment institution | When you purchase tokens, boosts or listing extensions |
| Transport data | Pickup and delivery province/district, date preferences, name and phone number of the contact person, notes | When you request transport for a vehicle you have won |
| Support data | Subject and message content of your support request | When you write to us |
| Notification data | App notification token (push token), device platform and your notification preferences | When you allow notifications |
| Preference data | Favourite listings and saved searches | When you use the related feature |
| Usage and interaction data | Which listings you view and on which listing you choose to call the seller are recorded | When you open a listing or choose to contact the seller |
| Technical data | Server logs such as IP address, request time and error records | When the App communicates with our servers |
4. How Data Is Collected and Legal Grounds
Your personal data is collected, wholly or partly by automated means, through the information you enter directly into the App and through the App's communication with our servers. The data is processed on the following legal grounds under Article 5 of the KVKK:
- It is directly related to the conclusion or performance of a contract: membership, publishing listings, bidding, purchasing and transport processes.
- Compliance with our legal obligations: invoicing and record-keeping obligations under tax and commercial legislation.
- Establishing, exercising or protecting a right: keeping transaction records in case of a dispute.
- Our legitimate interest: platform security, preventing fraud and abuse, and maintaining service quality.
- Your explicit consent: sending commercial electronic messages and non-essential notifications.
5. Permissions Requested by the App
The App requests the following device permissions only at the moment you use the related feature. If you do not grant a permission, you can continue to use the rest of the App.
| Permission | Purpose |
|---|---|
| Photos / Gallery | So that you can select photos from your device to add to your listing. Only the images you select are accessed. |
| Camera | So that you can take a listing photo directly within the App. |
| Notifications | To send notifications such as bid results, listing approval, listing expiry and saved search matches. |
The App does not request access to the microphone, location, contacts, calendar, SMS or call logs.
6. Data Stored on Your Device
Some data is kept only on your device and is not transferred to our servers:
- Your session information (access and refresh tokens and a basic summary of your account) is stored encrypted in the secure storage provided by the operating system.
- Your recent searches are stored in your device's local storage only to make the search box easier to use, and are not sent to us.
When you log out of the App, your session information is deleted from your device. When you uninstall the App, all of this data kept on the device is deleted.
7. Data We Do Not Collect
- Location data: The App does not access your device's GPS or network-based location. Province and district information is only the value you select from a list.
- Advertising ID: The App does not collect or use the Android Advertising ID (AAID) or any similar advertising identifier.
- Third-party analytics and tracking: The App does not contain any analytics, advertising or user-tracking software development kit (SDK). No profiling is carried out for advertising purposes and your data is not shared with advertising networks. Listing view and contact records are kept only on our own servers and are presented to the seller as aggregate statistics; see section 3.
- Card details: Your card number, expiry date and security code are never entered into the App; this information is processed only on the payment institution's own secure 3D Secure page. Only the payment result, the card brand and the last four digits of the card number are passed to us.
- Special categories of personal data: health, biometric data, religion, political opinion and similar data are not processed.
8. Parties to Whom Personal Data Is Transferred
Your personal data is shared only for the purposes listed below and only to the extent required by those purposes. Your data is never sold or transferred to third parties for advertising purposes.
| Party | Data shared | Purpose |
|---|---|---|
| Other users | The content and photos of the listing you publish, the province/district stated in the listing, your seller display name and — when a buyer chooses to contact you — your mobile phone number | Publishing your listing on the platform and enabling buyers to reach you. A published listing is public; you should decide what information and images to add to the listing accordingly. Your phone number is not shown in the listing list; it is shown only when a logged-in buyer chooses the contact step, and this choice is recorded. |
| Listing owner | How many times their listing has been viewed, how many times it has been called and how many people have added it to their favourites — as aggregate numbers | So that the seller can see the performance of their own listing. The numbers are presented in aggregate; which user viewed the listing is not shared. |
| Payment institution | Order amount and reference; card details are entered directly with the payment institution | Securely receiving payment with 3D Secure |
| Notification infrastructure providers | App notification token and notification content | Delivering App notifications to your device. On Android devices, delivery takes place via Google's Firebase Cloud Messaging service. |
| Hosting and infrastructure providers | Data processed on our servers | Running, backing up and securing the App |
| Transport and service partners | The address and contact details you provide in your transport request | Carrying out the transport service you requested |
| Competent authorities and institutions | Requested data | In cases provided for by law and within the scope of our legal obligations |
9. International Transfers
Notification delivery and cloud infrastructure services are provided through service providers whose servers may be located abroad. In this context, your personal data may be transferred abroad in accordance with the conditions set out in Article 9 of the KVKK. Transfers are limited to the data required by the service.
10. Retention Periods
| Data | Retention period |
|---|---|
| Membership and profile data | For as long as your membership continues; after membership ends, for the statutory limitation periods |
| Listing and photo data | For as long as the listing remains published; after removal, for the period required by legislation |
| Invoice and payment records | 10 years under tax legislation |
| Completed exchange transactions | For the statutory limitation periods, for the purpose of establishing and proving rights |
| Support records | A reasonable period after the request is resolved |
| Notification token | Becomes invalid and is deleted when you withdraw notification permission or uninstall the App |
| Usage and interaction records | For as long as the listing remains published and for a reasonable period to provide statistics |
| Server logs | A limited period for security purposes |
11. Deleting Your Account and Data
You can delete your account yourself directly within the App by following the “Delete my account” step in the My Account section; this takes effect immediately and no separate request is needed. If you prefer, you can also request deletion of your account by writing to the email or KEP address in section 2 of this Policy, or by post; requests submitted this way are resolved within 30 days at the latest.
When your account is deleted:
- Your published listings are taken down and deleted.
- Your listing photos, favourites and saved searches are deleted.
- Your identity and phone verification record is deleted; if you sign up again, you will need to verify again.
- Your notification token is deleted and no notifications are sent to you.
The following data continues to be retained even if your account is deleted, due to our legal obligations:
- Your invoice and payment records are retained for 10 years under tax legislation.
- Records relating to completed exchange transactions are retained for the purpose of establishing and proving rights.
12. Data Security
We take appropriate technical and administrative measures to prevent unlawful processing of and unlawful access to your personal data. In this context: all communication between the App and our servers is encrypted with HTTPS; your session information is stored on your device in the operating system's secure storage; card details never enter our systems at any stage; authorization tokens are valid for a limited time and are invalidated when you log out.
13. Children's Privacy
The App is not intended for persons under the age of 18, and we do not knowingly collect personal data from them. If we discover that data belonging to a person under 18 has been processed, that data is deleted.
14. Your Rights under the KVKK
Under Article 11 of the KVKK, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction if it is incomplete or inaccurate; request its deletion or destruction; request that correction, deletion and destruction be notified to the third parties to whom the data was transferred; object to a result against you arising from analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.
You can submit your requests to us via the email, KEP or postal address given in section 2, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your applications are resolved within 30 days at the latest.
15. Changes to This Policy
This Privacy Policy may be revised from time to time due to changes in legislation or updates to our services. The current version is always published on this page. In case of significant changes, you will be informed via the App or by email.