Privacy Notice (KVKK)
- Data Controller
- Bayazıt Sigorta Aracılık Hizmetleri Limited Şirketi
- Version
- 1.4
- Last updated
- 25.08.2026
The Turkish text prevails. This English version is provided for information only. Our processing is governed by Turkish Personal Data Protection Law no. 6698 (“KVKK”), and in any discrepancy theTurkish original is the binding text.
1. Who is the data controller?
Bayazıt Sigorta Aracılık Hizmetleri Limited Şirketi — an insurance agency operating under Turkish Insurance Law no. 5684 and the Insurance Agencies Regulation.
| Address | İstasyon Mah. Gazi Mustafa Kemal Blv. No: 53/A Dulkadiroğlu / Kahramanmaraş |
|---|---|
| bayazit@sigortabayazit.com | |
| Phone | 0533 503 44 67 |
| Registered e-mail (KEP) | — |
| TOBB registry no. | T081224-KPK9 |
| MERSİS no. | — |
2. What data do we process?
Only what the requested insurance product actually requires:
- Identity — name, Turkish ID number, date of birth
- Contact — phone, e-mail, address
- Customer transaction — quote record, policy number, renewal date, claim file
- Vehicle and property — plate, registration details, home or business address
- Financial — premium, payment plan, collection record
- Health (special category) — only for health and travel health insurance, and only with your explicit consent
- Transaction security — IP address, timestamp, form submission record
- Marketing — only if you have given consent
3. Purposes and legal grounds
- Preparing and comparing insurance quotes — Art. 5/2-c (necessary for a contract)
- Transmitting accurate details to the insurer for policy issuance — Art. 5/2-c and 5/2-ç
- Premium collection and accounting records — Art. 5/2-ç (legal obligation)
- Guidance and document tracking during a claim — Art. 5/2-c and 5/2-e
- Renewal reminders — Art. 5/2-f (legitimate interest)
- Responding to SEDDK, TOBB and other authorities — Art. 5/2-a and 5/2-ç
- Health insurance quotes — Art. 6/3-a (explicit consent)
- Commercial electronic messages — explicit consent and consent recorded in the İYS system under Law no. 6563
4. Who do we share it with?
- The insurance companies we represent — required to issue a policy
- Competent public authorities (SEDDK, TOBB, courts) — only upon lawful request
- Our service providers (hosting, e-mail, accounting) — bound by confidentiality
- Our legal and financial advisers — only to the extent necessary
4.1. Transfer abroad
Data relating to your insurance transactions is not transferred abroad.Data processed for quotes, policies, claims and collection is processed and stored on systems located in Türkiye. Our website's e-mail infrastructure is also in Türkiye.
There are two exceptions, and both run only with your consent.In both, the recipient is Google LLC and the servers are outside Türkiye.
a) Contact details of people who consent to commercial electronic messages
Those details are kept in Google Sheets, provided by Google LLC, so that the campaign and updates list can be managed.
| Which data | Full name, phone, e-mail, requested product, consent date |
|---|---|
| Why | Keeping the campaign and updates list current |
| Recipient | Google LLC (Google Sheets) |
| Legal basis | Your explicit consent under Art. 9 of the KVKK. By ticking the commercial electronic message consent on the quote form, you also consent to your contact details being stored in that service abroad for this purpose. |
| If you do not consent | Nothing about you is written to this list. Your quote is still prepared; none of our services depends on this consent. |
| Never transferred | ID number, date of birth, plate, chassis number, address, health data and any documents you upload are never written to this list. |
When you withdraw your consent, your contact details are removed from this list. How to withdraw is set out in section 4 of the Explicit Consent Text. Only people who have consented are written to this list; nobody else's data is transferred abroad.
b) Site usage statistics (Google Analytics)
We use Google Analytics to measure how the site is used. This measurement runsonly if you consent to analytics cookies in the cookie banner. If you do not consent, no data at all is sent to Google — the measurement code is never executed in your browser.
| Which data | Truncated IP address, browser and device information, pages visited, the link you arrived from, visit duration |
|---|---|
| Why | To see which pages work and where the site struggles, and to improve the content accordingly |
| Recipient | Google LLC (Google Analytics 4) |
| Legal basis | Your explicit consent under Art. 5/1 and Art. 9 of the KVKK — the consent you give to the “Analytics” category in the cookie banner. |
| If you do not consent | Measurement never starts; not a single request goes to Google. The site keeps working with all its features. |
| Never transferred | Your name, national ID, phone, e-mail, plate number, health data and the documents you upload never enter analytics measurement. What you type into the quote form is not sent to Google Analytics. |
You can withdraw your analytics consent at any time: use theCookie Preferences link in the footer and switch the category off. Measurement stops the moment you withdraw.
c) Human verification on the quote form (Cloudflare Turnstile)
To stop the quote form from being filled in by automated scripts, Cloudflare Turnstile runs on the final step. This is not an analytics or advertising tool; it is a security measure that keeps the form usable, and for that reason it is not tied to cookie consent. It writes no cookies to your browser and does not track you across sites.
| What data | Your IP address, browser/device information and interaction signals on the page (processed solely to answer “is this a human?”) |
|---|---|
| Why | To prevent bulk automated submissions and fake quote requests that would block the service |
| Recipient | Cloudflare, Inc. (Turnstile) |
| Legal basis | KVKK art. 5/2-f — our legitimate interest (protecting the service against abuse). Without verification the form could become unusable, so this processing is necessary for providing the service. |
| Not transferred | Nothing you type into the form (name, ID number, phone, e-mail, plate, documents) is sent to Cloudflare. Turnstile only sees verification signals. |
| Retention | The verification token is single-use and expires once your request is submitted. We do not store it. |
d) Security screening of the documents you upload
Images and PDF documents you upload to the quote form are screened on our own server before they are e-mailed: we verify at byte level that the file really is the type it claims to be, and we scan PDFs for executable active content. This screening runs entirely on our own infrastructure; your documents arenot sent to any third party and are not transferred abroadfor this purpose.
5. How we collect it
- Through quote and contact forms on this website — by automated means
- Through phone, WhatsApp and e-mail — by partly automated means
- In person at our office and through signed documents — by non-automated means
- From the insurers we represent, at renewal
- If you consented to analytics cookies, from site usage statistics — by automated means (details in 4.1/b).
6. Retention
Data is kept for as long as needed for the purpose and for the statutory limitation periods. Afterwards it is deleted, destroyed or anonymised (Art. 7).
7. Your rights
Under Art. 11 of the KVKK you may ask us to:
- confirm whether your data is processed and obtain information about it;
- learn the purpose and whether it is used accordingly;
- know the third parties to whom it has been transferred, in Türkiye or abroad;
- have incomplete or inaccurate data corrected;
- have it erased or destroyed under Art. 7;
- have corrections and erasures notified to third parties;
- object to an adverse result produced solely by automated analysis;
- claim compensation for damage caused by unlawful processing.
8. How to apply
Send a signed written request to İstasyon Mah. Gazi Mustafa Kemal Blv. No: 53/A Dulkadiroğlu / Kahramanmaraş, or write from your registered e-mail address tobayazit@sigortabayazit.com, or use our registered e-mail (KEP) address —. Your request will be answered free of charge within thirty days at the latest. If we reject it, answer inadequately or fail to reply in time, you may complain to the Turkish Personal Data Protection Board (Art. 14).