Privacy Policy

This English version is provided for information only. In case of any discrepancy, the Turkish version prevails.

This policy explains how personal data is protected on the “Antiquus” platform (antiquus.com.tr, the “Platform”) operated by ELBOS PROFESYONEL HASSAS TEKNOLOJİ ÜRÜNLERİ SERVİS VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ (the “Company”), how long it is retained and how you can exercise your rights. The purposes of processing, legal grounds and transfer recipients are set out in detail in the KVKK Information Notice, and cookie and local storage records in the Cookie Policy.

1. Core principles

We process your personal data in accordance with the principles in KVKK Art. 4: lawfully and fairly, accurately and, where necessary, kept up to date, for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to those purposes, and only for as long as necessary. We do not sell your personal data; we do not create profiles for advertising purposes; no third-party advertising or analytics cookies are used on the Platform.

2. Where data is stored

Personal data is stored on our servers in the Contabo GmbH data centre in Germany; site traffic is routed through the infrastructure of Cloudflare, Inc. These transfers are carried out in accordance with KVKK Art. 9; details are set out in the Personal Data Information Notice.

3. Data security measures

• Communication between the Platform and your browser is encrypted with TLS (HTTPS); the servers accept connections only through the Cloudflare security network, and administrative access to the servers is possible only via key-based SSH.
• Passwords are stored in irreversibly hashed form (bcrypt); e-mail verification and password reset links operate with single-use, time-limited tokens, and tokens are not stored in plain text in the database.
• Sessions are managed with short-lived access tokens and revocable refresh tokens; open sessions are terminated upon a password change, account suspension or “sign out of all devices”.
• Access to personal data is restricted by role-based authorisation; Sellers do not see the buyer’s e-mail address and, before payment is confirmed, see only the province/district of the delivery address.
• Bank transfer receipts and expert attachments are kept in non-public, access-controlled storage.
• All files uploaded to the Platform are scanned for malware before being saved.
• Login attempts and form submissions are rate-limited against abuse; administrative actions are written to an audit log.
• Employees and service providers accessing the systems are subject to confidentiality obligations.

If your personal data is obtained by others through unlawful means, the data subjects concerned and the Personal Data Protection Board are notified as soon as possible pursuant to KVKK Art. 12/5.

4. Retention periods

Data	Retention period
Membership and profile information, addresses	For the duration of membership; anonymised or erased when the account is closed
Order, payment, refund, invoice and payout records	10 years from the end of the relevant calendar year (TCC Art. 82, VUK)
Contract consent records (text version, time, IP)	10 years from the end of the relationship (general limitation period under the TCO)
Consent and withdrawal records for commercial electronic messages	At least 3 years from the end of the validity of the consent; at most 10 years together with contract consent records
Auction bid records	10 years together with the related order; 2 years for auctions not resulting in a sale
Access records (traffic data: time, IP, user, request)	400 days (Law No. 5651: at least 1, at most 2 years)
Application error logs	14 days
Platform notifications	Read notifications 90 days, unread notifications 180 days
E-mail delivery queue	14 days after sending
Session refresh tokens	7 days after expiry or revocation
Contact form messages	2 years from the date of submission
Newsletter subscription	For the duration of the subscription; 3 years from unsubscribing (for evidentiary purposes)
Guest basket cookie	30 days
Audit (administrative action) records	10 years

Where a dispute, investigation or request from a competent authority is involved, the relevant records may be retained until the process is concluded.

5. Closing the account and exporting data

Using the “Download my data” function on your profile page, you can obtain a copy of the personal data relating to your account in machine-readable (JSON) format. Using the “Close my account” function, your account is closed: your e-mail address, name, telephone and tax details are anonymised; your addresses, watchlist, notifications, basket and newsletter subscription are deleted; all your sessions are terminated. Order, bid and consent records subject to a statutory retention obligation are retained in de-identified form for the periods above. An account cannot be closed while you have an ongoing order or auction bid.

6. Minors

The Platform is intended for persons who have reached the age of 18. Accounts found to belong to persons under the age of 18 are closed and the related data is erased.

7. Third-party links

Links to social media or external sites on the Platform are subject to the respective sites’ own privacy policies.

8. Your rights and contact

You can find your rights under KVKK Art. 11 and the methods of application in the KVKK Information Notice. For privacy-related questions, you may use the contact channels in the “Service Provider Details” section below.

9. Amendments

This policy may be updated in line with changes in the legislation or our services; the current version enters into force on the date of its publication on this page, and the date of update is displayed at the top of the page.