KVKK Notice
Effective date: 31 October 2026 · Version 0.2.0
This notice informs Bubi Family users under Article 10 of Turkish Personal Data Protection Law No. 6698 (the "Law", "KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. The Turkish version prevails. Full details are in the Privacy Policy.
1. Identity of the data controller
Bubiapps Bilgi Teknolojileri ARGE Ltd. Şti. (Bubiapps Information Technologies R&D Ltd.) · Address: Gribucak Mah. Alkaya Sk. No: 9/5, Melikgazi / Kayseri, Türkiye · E-mail: privacy@bubiapps.com
2. Personal data processed
- Identity and contact: display name, e-mail address, year of birth.
- Location: precise location, location history, arrival/departure events, places.
- Customer transactions: subscription status and purchase data (card details stay with the store).
- Transaction security: user ID, device notification token, app version, crash and performance records.
- Visual records: profile photo and photos shared in chat (optional).
- Other: battery status, activity type, chat messages; app usage events if you consent.
We do not intend to process special categories of personal data under Article 6 of the Law.
3. Purposes and legal grounds
| Purpose | Legal ground (Law Art. 5) |
|---|---|
| Membership, sign-in, creating circles and invitations | Art. 5/2-c: establishing and performing a contract |
| Sharing location only with chosen circle members, notifications, SOS and check-in, chat | Art. 5/2-c: performing a contract |
| Managing subscriptions and circle premium; invoicing and accounting | Art. 5/2-c and Art. 5/2-ç: legal obligation |
| Age check (no service under 13) | Art. 5/2-ç and Art. 5/2-f |
| Information and service security, abuse prevention, troubleshooting | Art. 5/2-f: legitimate interest |
| Protecting rights in legal disputes | Art. 5/2-e: establishing, exercising or protecting a right |
| App usage measurement | Art. 5/1: explicit consent (Explicit Consent Notice) |
4. Method of collection
Data is collected electronically and by automated means from information you enter in the app and, to the extent you allow, from your device's location, notification and motion sensors. Subscription data comes from Apple App Store and Google Play via RevenueCat.
5. Transfers
- Within Türkiye: to competent public authorities where the law requires it.
- Abroad: Google LLC / Google Ireland (Firebase, Google Maps Platform) for hosting and infrastructure, and RevenueCat, Inc. (US) for subscription management. The Firestore database is in the EU; support and some service components run in other countries including the US.
- Transfers abroad rely on Article 9 of the Law, i.e. an adequacy decision or appropriate safeguards such as the standard contract announced by the Board; a standard contract is notified to the Authority within five business days of signing. We will state the safeguard used for each transfer here after legal review.
- Your personal data is not transferred to third parties for advertising or marketing and is not sold.
6. Retention
Data is kept only as long as the purpose requires: location history at most 30 days (at most 48 hours on the free plan), event records 30 days, account data until the account is deleted. The retention table is in the Privacy Policy. Expired data is deleted automatically.
7. Your rights under Article 11 of the Law
By applying to the data controller you may:
- a) learn whether your personal data is processed,
- b) request information if it has been processed,
- c) learn the purpose of processing and whether data is used accordingly,
- ç) know the third parties in Türkiye or abroad to whom data is transferred,
- d) request correction if data is incomplete or inaccurate,
- e) request deletion or destruction under Article 7 of the Law,
- f) request that operations under (d) and (e) are notified to third parties to whom data was transferred,
- g) object to a result against you arising from analysis exclusively by automated systems,
- ğ) claim compensation for damage caused by unlawful processing.
8. How to apply
Send your request, with information allowing us to verify your identity, to privacy@bubiapps.com or in writing to Gribucak Mah. Alkaya Sk. No: 9/5, Melikgazi / Kayseri, Türkiye. Under Article 13 of the Law requests are concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee set by the Board may be charged. You can also delete your account and data in the app or on the family.bubiapps.com/delete-account page. If your request is rejected or the answer is insufficient, you may complain to the Personal Data Protection Board.