Personal Data Information Notice

This English version is provided for information only. In case of any discrepancy, the Turkish version prevails.

This information notice has been prepared pursuant to Art. 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, for our members and buyers using the “Antiquus” platform (antiquus.com.tr, the “Platform”), persons applying to become or working as sellers and their authorised representatives, experts, and persons who contact us via the contact form or by e-mail.

1. Data controller

Your personal data is processed by ELBOS PROFESYONEL HASSAS TEKNOLOJİ ÜRÜNLERİ SERVİS VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ (the “Company”) in its capacity as data controller. The Company’s MERSİS number, registered office address, KEP and e-mail addresses are set out in the “Service Provider Details” section at the end of this page.

When you purchase a product on the Platform, your data required for the performance of the order is shared with the relevant Seller; the Seller processes this data in its own name and under its own responsibility, as a separate data controller.

2. Categories of personal data processed

• Identity: first name, surname, display name; for corporate purchases and sellers, trade name and the name of the authorised representative.
• Contact: e-mail address, telephone number, delivery and billing addresses.
• Customer transaction: order, basket, bid and proxy bid records, watchlist, order status, shipping information, dispute and withdrawal requests, order notes, contact form messages.
• Financial: tax office and tax number; payment reference, bank transfer receipt; for sellers and for buyers receiving refunds, bank account holder and IBAN; seller payout and commission records.
• Legal transaction: contract and consent records (approved text and its version, time of approval, language and IP address), dispute and correspondence records.
• Transaction security: password hash (your password is not stored in plain text), session tokens, IP address, access and transaction records (logs), rate-limiting records for security purposes.
• Marketing: consent and withdrawal records for commercial electronic messages, newsletter subscription.
• Visual and audio records: profile image; product and storefront images uploaded by sellers.
• Professional experience (experts): areas of expertise, title and CV information.

No special categories of personal data (health, religion, biometrics, etc.) are requested through the Platform; please do not share such data in message and description fields.

3. Purposes of processing and legal grounds

Purpose	Legal ground (KVKK Art. 5/2)
Creating membership, managing the account, verifying identity and e-mail	(c) Establishment and performance of a contract
Receiving the order, collecting and matching payment in the Escrow Account, forwarding the order to the Seller, tracking delivery, conducting return and withdrawal processes	(c) Performance of a contract; (ç) Legal obligation (Law No. 6502, Distance Contracts Regulation)
Receiving auction bids, executing proxy bidding, determining the winner	(c) Performance of a contract
Evaluating seller applications, verifying seller identity and tax details, payout payments	(c) Performance of a contract; (ç) Legal obligation (Law No. 6563 and the Intermediary Service Provider Regulation)
Conducting Expert review	(c) Performance of a contract; (f) Legitimate interest (product reliability)
Keeping contract and consent records (text version, time, IP)	(ç) Legal obligation; (e) Establishment, exercise or protection of a right
Accounting, bookkeeping and document management, retention arising from financial legislation	(a) Expressly provided for by law (TCC No. 6102 Art. 82, Tax Procedure Law (VUK) No. 213); (ç) Legal obligation
Keeping access records (traffic data)	(a) Expressly provided for by law (Law No. 5651 Art. 5); (ç) Legal obligation
Information security, prevention of fraud and abuse, malware scanning of files, rate limiting	(f) Legitimate interest; (ç) Legal obligation (KVKK Art. 12)
Responding to requests, complaints, disputes and contact form messages	(c) Performance of a contract; (f) Legitimate interest
Managing legal disputes, responding to requests from competent authorities	(e) Establishment, exercise or protection of a right; (ç) Legal obligation
Informational e-mails and Platform notifications regarding orders, payments and account security	(c) Performance of a contract
Sending newsletters and commercial electronic messages for promotional purposes	Your consent given pursuant to Art. 6 of Law No. 6563; (a) Expressly provided for by law

4. Parties to whom personal data is transferred

• Sellers: For the performance of the order, first name, surname, telephone and delivery address (only province/district before payment is confirmed), billing information and order contents. The buyer’s e-mail address is not shared with the Seller.
• Experts: Product and listing information for review; buyer data is not shared with experts.
• Banks: Information required for matching payments received in the Escrow Account and for refund and payout transfers.
• Shipping companies: By the Seller, the buyer’s name, telephone and delivery address for the delivery of the shipment.
• Service providers (data processors): Companies providing server hosting (Contabo GmbH, Germany), content delivery and cyber security (Cloudflare, Inc., USA), e-mail delivery infrastructure, backup and information technology support services; only to the extent required by the service and subject to security measures determined by contract.
• Advisers: Persons providing legal, financial advisory and audit services; subject to a duty of confidentiality.
• Competent public institutions and organisations: Courts, public prosecutors’ offices, the Ministry of Trade, the Revenue Administration, the Information and Communication Technologies Authority, the Personal Data Protection Authority, consumer arbitration committees and other legally authorised bodies; upon request and to the extent required by the legislation.

Transfer abroad: The Platform’s servers are hosted in the Contabo GmbH data centre in Germany; requests to the Platform are routed through the infrastructure of Cloudflare, Inc. (USA) for service continuity, DDoS and abuse protection and content delivery. Accordingly, the personal data listed in this notice is transferred abroad for the same purposes and on the same legal grounds, in accordance with KVKK Art. 9, by signing the standard contracts announced by the Personal Data Protection Board and notifying the Authority. The service providers process the data only on behalf of and on the instructions of the Company.

5. Method of collection

Your personal data is collected electronically: from you through the membership, order, bid, seller application, profile, contact and newsletter forms on the Platform; from Sellers and banks during the order and delivery processes; and by automated means through server logs and strictly necessary cookies while you use the Platform.

6. Retention period

Your personal data is retained for the period required by the purpose of processing and prescribed by the relevant legislation; at the end of that period it is erased, destroyed or anonymised. The principal periods are set out in the Privacy Policy.

7. Your rights under KVKK Art. 11

By applying to the Company, you have the right to: learn whether your personal data is being processed; request information about it if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request rectification if it has been processed incompletely or inaccurately; request erasure or destruction within the framework of the conditions in KVKK Art. 7; request that rectification, erasure and destruction be notified to the third parties to whom it has been transferred; object to a result to your detriment arising from analysis exclusively by automated systems; and claim compensation for damage if you suffer damage due to unlawful processing.

If you are a member, you may instantly obtain a copy of your data using the “Download my data” function on your profile page, correct your information from your profile, and use the “Close my account” function to have your account closed and your personal data anonymised.

8. Method of application

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application in Turkish, together with information identifying you and your request,

• to the Company’s registered office address by a petition bearing a wet signature, in person or through a notary public,
• to the Company’s KEP address by Registered Electronic Mail (KEP),
• to the Company’s e-mail address, signed with a secure electronic signature or mobile signature,
• from the e-mail address registered on the Platform to the Company’s KVKK application e-mail address.

Address and e-mail details are set out in the “Service Provider Details” section below. Your application is concluded free of charge as soon as possible according to its nature and within 30 days at the latest; if the process requires an additional cost, the tariff determined by the Personal Data Protection Board may be applied. If your application is rejected, the response is found insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board pursuant to KVKK Art. 14.