KVKK and customer data in real-estate software: 8 questions to ask

When you set up a real-estate CRM or a WhatsApp assistant, the name, number, budget and wishes of every customer who writes to your office pass through that software. Under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), that is not a minor detail. The eight questions below collect the points you should get clear answers to when talking to a provider. This article is general information, not legal advice; consult a lawyer about your own situation.

1. Whose customer data is it?

The first and most important question. The provider should state clearly that it treats your office's conversations, customer details and appointments as your asset. Broad wording like “we may use it to improve the service” can mean the data may go to other purposes as well.

2. Is the data shared with other offices or ad networks?

Can other real-estate offices using the same software — possibly your competitors — see your customer data? Is the data passed to third-party networks for ad targeting? The answer to both should be a clear “no”.

3. Is my data used to train AI models?

With software that uses AI, this question deserves to be asked separately. Using your customer conversations to train a model means processing the data beyond its purpose. Ask what the provider commits to on this, both for itself and for the AI providers it works with.

4. Where is the data hosted?

The country or region where the servers sit matters for the KVKK's rules on transfers abroad. If data is transferred abroad, the basis for doing so should be explained in the disclosure notice.

5. Who can access it?

Ask whether data travels over encrypted connections and how access is separated inside the office. In a good setup the manager sees the whole office and each agent only their own customers; an agent who leaves can have their access closed easily.

6. Who takes which role?

Under the KVKK, the party that decides the purpose and means of processing is the data controller, and the party that processes on its behalf is the data processor. For the data of customers who write to your office, the deciding party is usually your office; the software provider processes that data on your behalf. Ask how this relationship is set out in your contract with the provider. Remember that, as data controller, the duty to inform your customers also rests with you.

7. What happens when a customer asks for their data to be deleted?

Article 11 of the KVKK gives people the right to ask for their data to be deleted or corrected. The software needs to be able to meet these requests, with deletion and export carried out in an auditable way. Also ask how long a deletion request takes to resolve and how backups are handled.

8. What happens to my data if I leave the software?

Leaving gets discussed less than joining, but matters just as much. When you end the contract you should be able to export your customer and portfolio data in a usable form and know when the provider deletes what remains. A customer list built up over years should not be held hostage inside a piece of software.

How does Realtiq answer these questions?

In short: the conversations, customer details and appointments you connect to Realtiq belong to you alone; they are not shared with other offices, not sent to ad networks and not used for model training. Servers are hosted in Türkiye or the EU region, traffic is encrypted with TLS and access is role-based. Your portfolio spreadsheet is accessed with read-only permission. Deletion and export requests are handled with an audit trail, and your data is exported when you leave. The full details are on the Security & data page; the legal texts are the KVKK Disclosure Notice and the Privacy Policy.

On the WhatsApp side, the safety of your number also comes up; why bulk and unsolicited messaging is a risk is explained in connecting your WhatsApp number.

← All articles