KVKK Privacy Notice

Data processed

• Identity and contact: full name, email (verified before publication), contact phone (mandatory but not verified; if you enter someone else's number, it is your responsibility to inform that person about this sharing), your preferred contact channel and call hours, and for a company account the company name and tax ID number.
• Company account as a sole proprietorship: your tax ID number is your Turkish national ID number and is personal data. It is stored encrypted, shown masked on screens and never shown to firms; it is used to check the taxpayer record, for invoicing and to prevent the same person or firm from acting in more than one role on the platform.
• Project information: province/district, the location you mark on the map and the full address (encrypted; until unlock, firms see only an approximate location), roof and building details, consumption and bill amount, description text, the documents you upload (bill, architectural plan, structural report, single-line diagram, etc.).
• Material request: items (product group, quantity, unit, short spec, brand preference), province and district, delivery mode and time, private note and the contact copy in the request (name, phone, email; stored encrypted).
• Messaging: the messages you exchange with unlocking firms, and with suppliers that unlock your material request, on the platform (text only; stored encrypted), sender, recipient and time.
• Transaction records: project request statuses, which firm unlocked it and when, records of firms' attempts to reach you (time, outcome, short note), bids you receive and the comparison if you choose, the listing fee payment (only if you paid), your satisfaction survey answers, and your statement that you opened the request through a partner's link if you made one.

Individual investors are not asked for an ID copy or national ID number (if you open a company account as a sole proprietorship, your national ID number is collected as the tax ID number). Do not put special category information such as health or religion in the description, documents or messages.

Purposes and legal grounds

Who is it shared with?

• Unlocking suppliers (material request): every approved supplier that spends credits to unlock your material request; full name, your company name if any, phone, email, district and private note. Each supplier firm unlocks a request only once, firms in the same corporate group count as one, there is no upper limit. The supplier is a separate data controller for this information and may use it only to quote and communicate about this request. Suppliers' product catalogues are not shown to you; you see only the unlocking supplier's company name, messages and quote.
• Unlocking firms: every document-verified firm that spends credits, based on project size, to unlock your project request; full name, company name, phone, email, preferred contact channel and hours, full address and documents that have passed the security scan. There is no cap on the number of firms; each firm can unlock a request only once and firms in the same corporate group count as one firm. Inside the firm, the information is shown only to users authorised to view contacts. Once you close your request, no new unlocks are possible; your correspondence with firms that unlocked it earlier may continue.
• The unlocking firm is a separate data controller for this information; under the platform rules it uses the information only for this project (contacting you, messaging and, if you wish, a bid), may not sell or transfer it to third parties, and must meet its own obligations if it wants to add you to its marketing list. The agreement is made off the platform, directly between you and the firm.
• Contracted bank or payment institution, e-Invoice/e-Archive service provider and the Turkish Revenue Administration (only if you paid a listing fee): name/company name, tax ID number (national ID number for a sole proprietorship), amount and invoice details.
• Tax number verification service (company accounts only, when this service is used; checking the taxpayer record): tax ID number (national ID number for a sole proprietorship) and company name.
• Yield estimate: for the solar yield calculation, only the coordinates of an area of about 5 km are sent to the PVGIS service of the European Commission Joint Research Centre; your name, address or the exact location you marked are not sent.
• Hosting provider, Cloudflare and public authorities: as described in sections 5 and 6 of the general notice.

For an assisted project request, our staff enter your information at your request; the same rules and periods apply.

Automated assessment

To protect the platform against fake and malicious use, account and project request activity (for example many requests from the same device or connection in a short time) may be assessed by automated means, and this may lead to the request being reviewed by staff. If you believe such an assessment has led to a result against you, you can ask for human review and object through the KVKK request form.

Retention periods

Your rights and how to apply are in section 8 of the general notice.

Data processed

• Officers and users: full name, email, phone (optional), role and permissions in the company, login records, team invitations.
• Firm application: company name, tax ID number and tax office, billing email and address (encrypted), the documents uploaded with the application (tax certificate, trade registry record, signature circular, engineer certificate, references, etc.) and the result of the document check. No ID card image is requested. Information about a legal entity is not personal data; personal information contained in the documents is personal data.
• Sole proprietorship: the tax ID number is the owner's Turkish national ID number and is personal data. It is stored encrypted and shown masked on screens; only authorised staff can see the full number, and every access is logged. It is used to check the taxpayer record, for the document check, for invoicing and to prevent the same firm from acting through more than one account; it is never shown to investors or other firms.
• Company profile: about text, website, team size, certificates, service provinces.
• Transactions: credit purchases and wallet movements; for a saved card, the encrypted key issued by the payment institution, card brand, last four digits and expiry month/year (Ufkon does not store full card numbers); bank transfer notices, unlocks, attempts to reach the investor and notes, bids, disputes, document downloads, paid add-on services (subscription, sponsorship, etc.).
• Material request: the items, delivery details, private note and contact copy of material requests you open as an EPC; material request unlocks you make as a supplier and the price quotes you leave.
• Messaging: the messages you exchange on the platform with the owner of a project or material request you unlocked, and with suppliers that unlock your material request (text only; stored encrypted), sender, recipient and time.
• Trust data: trust score, badges and the events behind them; signals linking accounts (same device, connection, phone, email or tax number).

Purposes and legal grounds

Who is it shared with?

• Contracted bank or payment institution (collecting payment, refunds): company name, amount, card brand and last four digits.
• e-Invoice/e-Archive service provider and the Turkish Revenue Administration (invoicing obligation): company name, tax ID number (national ID number for a sole proprietorship), address, amount.
• Tax number verification service (when this service is used; checking the taxpayer record): tax ID number (national ID number for a sole proprietorship) and company name.
• Investors: in a project request you unlock, your company name and website, the messages you write and, if you wish, the bid you submit.
• Material request parties: with approved suppliers that unlock a material request you opened as an EPC: name, company name, phone, email, district and private note; with the owner of a request you unlocked as a supplier: your company name, messages and quote.
• Public firm directory: only with your explicit consent and only the information shown on the directory page.
• Hosting provider, Cloudflare and public authorities: as described in sections 5 and 6 of the general notice.

Automated assessment

The trust score is calculated automatically from events such as disputes, unlock and response behaviour, and can affect your unlock speed or badges. The score is an algorithmic performance indicator, not a workmanship guarantee. You can always see your score in your dashboard; to object to the result and ask for human review, you can use the KVKK request form.

Investor data you unlock

Your company is a separate data controller for the contact details of a project request you unlock. You may use this information only to contact the investor, message on the platform and, if you wish, submit a bid for that project, and may not sell or transfer it to third parties; details are in the EPC membership agreement. You may likewise use the contact details of a material request you unlock as a supplier only to quote and communicate about that request.

Retention periods

Your rights and how to apply are in section 8 of the general notice.