Personal Data & Privacy Notice

This notice covers two services: the avmci.online website and the ANKAmall mobile app (iOS and Android).

• The website is information-only. There is no membership, login or contact form; no name, phone or email is collected through the site.
• The mobile app allows you to create an account. The data processed in the app is therefore broader than on the site and is described separately below.

Your personal data is processed by PROFAM Gayrimenkul Yönetimi A.Ş. as data controller. PROFAM is the company responsible for the management and operation of ANKAmall Shopping Centre.

As the site has no membership, account or contact form, identity and contact details such as your name, phone number or email are not collected through it. Only automatically generated data strictly necessary for the site to function is processed:

• Technical connection data: IP address, browser type and version, operating system, device type.
• Access logs: pages visited, date and time of access, referring address.

The following data is processed depending on how you use the app. If you do not use a feature, no data relating to it is processed.

When you create your account:

• Name and surname, email address.
• Your password — stored not as plain text but as an irreversibly hashed digest.
• If you sign in with Google or Apple: the name, email address, profile photo link and user identifier those services provide to us.
• Email verification status.

If you complete your profile (all optional):

• Date of birth, gender, phone number.
• Province, district and full address.
• Vehicle plate number, make and model.
• Profile photo.

While using the app:

• Campaign and event codes you claim, and when you claimed them.
• Which notifications you read and your notification preferences.
• The text of messages you send to the help assistant and any like/dislike feedback you give.
• The text of complaints, suggestions and requests you send us, along with any attached photo.
• Which store, campaign and event pages you view, and searches you make in the app.

Automatically:

• Your IP address and device/browser information.
• If you allow notifications, your device's notification identifier and platform (iOS/Android).
• Session information and record creation/update timestamps.
• Server access logs.

If you use the app as a guest, we do not ask for your name, email or phone. However, an identifier is generated and stored on your device, and each guest sign-in reconnects you to the same account. Guest use is therefore not fully anonymous; your browsing and chat records accumulate under that identifier.

We do not collect special categories of personal data. The app has no field for health, biometric, religious, political or similar data. That said, feedback text, attached photos and chat messages are free-form fields; please do not enter such information there. The app does not collect location data.

• Operating the website and app technically, protecting their security and preventing abuse.
• Creating your account in the app, verifying your identity and maintaining your session.
• Presenting store, campaign, event and floor plan information to you.
• Delivering campaign and event codes to you and tracking their use.
• Informing you in line with your notification preferences.
• Handling your requests through the help assistant and feedback channels.
• Improving the service by measuring which content draws interest.
• Sending commercial electronic messages where you have given explicit consent.
• Fulfilling legal obligations and exercising the right of defence against legal claims.

Your data is collected electronically by automated means. If you sign in with Google or Apple, some information reaches us through those services. The following grounds under Article 5 of the KVKK apply:

• Necessity for the conclusion or performance of a contract: your account, your campaign codes and data relating to the delivery of the service.
• Legitimate interests of the data controller: records kept for security, fault resolution, abuse prevention and service improvement.
• Express provision in law and fulfilment of legal obligations.
• Your explicit consent: commercial electronic messages, optional profile details and transfer of data abroad.

The website uses no advertising, tracking or analytics cookies. There is only one strictly necessary cookie: NEXT_LOCALE, which remembers whether you want to view the site in Turkish or English. It contains nothing but “tr” or “en” — no name, identity or browsing history — is never used for advertising and is shared with no one. It is deleted when you close your browser. If you block cookies in your browser settings the site still works; only your language preference will not be remembered.

The app contains no third-party advertising, analytics or tracking software (SDK); your advertising identifier is not processed, no advertising is shown in the app, and your data is not shared with advertising networks.

Images on the site are delivered through an image delivery service called Cloudinary. As a result, when you open a page your IP address and browser information also reach that service; this is technically necessary for the images to be shown to you.

That said, to improve the service, which store, campaign and event pages are viewed and the searches made in the app are recorded on our own servers together with the IP address and device information.

We do not sell your personal data and do not transfer it to third parties for marketing purposes. Data is shared with the following providers only to the extent necessary for the service to function:

• Google LLC — Google sign-in, authentication infrastructure and notification delivery in the app.
• Apple Inc. — Apple sign-in and notification delivery to iOS devices.
• Cloudinary — storage and delivery of uploaded images.
• Render Services, Inc. — hosting of the application server.
• Neon Inc. — hosting of the database.
• Resend — delivery of verification and notification emails.
• Cloudflare — network security and content delivery.
• Vercel — hosting of the website.
• Netgsm (Türkiye) — where SMS delivery is required.
• 650 Industries, Inc. (Expo) — building and distribution of the app.

In addition, relevant data may be transferred to courts, public prosecutors, the Personal Data Protection Authority and other competent public bodies upon requests based on legislation.

Of the providers listed above, all except Netgsm operate servers outside Türkiye. Your personal data is therefore transferred abroad so that the service can function. Such transfer is carried out on the basis of your explicit consent under Article 9 of the KVKK, with the necessary technical and administrative measures in place.

You may withdraw your consent; however, in that case using the app will not be technically possible.

• Data relating to your account is retained for as long as your account remains open.
• Code usage history is retained for the period prescribed by legislation for the purpose of evidencing rights and obligations.
• Server access logs and security records are retained only for as long as the security purpose requires.
• When you delete your account, your data is deleted or anonymised except where retention is legally required.

• Your password is not stored as plain text; it is irreversibly hashed.
• Communication takes place over an encrypted connection.
• Your session information is held in the operating system's secure store on your device.
• Server access is restricted by authorisation and administrator actions are logged.
• Request rates are limited as a measure against abuse attempts.

Despite all measures taken, we remind you that no transmission over the internet is absolutely secure.

The mobile app is intended for use by persons aged 18 and over. Accounts and data belonging to persons we learn are under 18 are deleted unless parental or guardian consent is present.

Under Article 11 of the KVKK you have the following rights:

• To learn whether your personal data is processed and, if so, to request information about it.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties, in Türkiye or abroad, to whom your data is transferred.
• To request correction if processed incompletely or inaccurately, and deletion or destruction where the conditions are met.
• To request that correction and deletion operations be notified to third parties to whom the data was transferred.
• To object to an adverse outcome arising from analysis solely by automated systems.
• To claim compensation for damage suffered due to unlawful processing.

You can delete your mobile app account yourself from within the app, with no request needed: Profile > Settings > Delete account. What is deleted, what is anonymised, and the route to follow if you cannot access the app are explained on a separate page.

You may submit requests regarding your rights by the following means:

• Email: KVKK@profamyonetim.com
• Post: PROFAM Gayrimenkul Yönetimi A.Ş., Mevlana Bulvarı No: 2/A Kat: 3 No: 1 Yenimahalle / Ankara, Türkiye
• Phone: +90 312 541 12 13
• Registered electronic mail (KEP): profam@hs01.kep.tr

Your application should state your full name, Turkish ID number, address for service, email and phone if any, and the subject of your request. Requests are concluded free of charge within thirty (30) days at the latest; where a separate cost is incurred, the tariff set by the Authority applies.

This notice may be updated in line with legal developments, company policies and new features added to the app. The current text is always accessible on this page and from the Settings section within the app.