Who is responsible for your data?
Perfect Tower is a building and property management service owned and operated by Perfecto Group, based in İstanbul, Türkiye. This notice covers the public website, account services and related web and mobile functions. Our official address and contact channels appear below.
Perfecto Group determines the purposes and means of processing its own enquiries, account administration, subscription billing, security and support records. For resident, owner, tenant, staff and building records entered by a building customer, that customer normally acts as data controller and Perfecto Group processes the records on its instructions. The actual roles depend on the processing activity, not simply on the name of the platform. Building management must provide its own notice and lawful instructions.
What we collect and where it comes from
You provide data when registering, using forms, communicating with us or using the service. Building managers and authorised users may supply records about residents and staff. Browsers, devices and service providers supply technical and transaction information.
- Identity and contact: name, account identifiers, email, telephone, role and building affiliation.
- Property operations: apartments, ownership or tenancy information, dues, payment and invoice records, maintenance requests, communications and, where enabled, guard shifts and operational reports.
- Subscriptions and transactions: selected plan, billing details, transaction references and payment status. Payment providers process information required by their own payment flows; never send card security codes through our contact forms.
- Technical and support: IP address, browser/device information, session and security records, request dates, messages, referral information and website interaction data.
- Mobile permissions: notifications or files you choose to submit, where a feature requests them. Device permissions can be managed in your operating-system settings.
Why we process it and the legal bases
Account creation, subscriptions, requested support and service delivery rely on steps requested before a contract and performance of that contract where applicable. Statutory billing and disclosure obligations rely on legal obligations. Necessary security, abuse prevention and service administration may rely on legitimate interests after balancing your rights, or on establishing, exercising or protecting legal claims.
Where an activity requires explicit consent, such as optional marketing or non-essential tracking without another lawful ground, that consent must be separate, specific and withdrawable. Reading this notice, sending a deletion request or accepting service terms is not blanket consent to unrelated processing. Under Turkish Law No. 6698, the applicable conditions are assessed under Articles 5 and, for special-category data, 6. Where GDPR applies, the corresponding grounds are assessed under Article 6 and, where relevant, Article 9.
Required form fields are needed to provide the requested service or identify and handle a request; without them we may be unable to do so. Optional fields can be left blank. Do not upload sensitive personal information unless the feature and your lawful authority require it.
Who may receive information
Records may be accessible to authorised people within your building according to their roles and the service configuration. Relevant data may be provided to hosting and infrastructure providers, communications and notification providers, payment providers, technical support contractors and professional advisers for the relevant service purpose. Courts, regulators and other competent authorities may receive data when legally required.
A building administrator cannot authorise unrestricted disclosure of another person’s data. Service-provider access must be limited to the relevant task and governed by appropriate confidentiality, processing and security obligations. A provider may act as an independent controller for its own regulated services; its own notice then also applies.
International processing
Depending on the hosting, communications, payment and analytics services used, information may be processed outside your country, including outside Türkiye. A provider’s location alone does not make a transfer lawful. Transfers subject to Turkish law require the conditions and safeguards of Article 9 of Law No. 6698, such as an applicable adequacy decision or an appropriate transfer arrangement. GDPR Chapter V applies where relevant.
You can request information about the recipients, processing locations and applicable safeguards using the contact channels below. This notice does not represent that every provider is located in Türkiye or that a particular transfer agreement has already been signed.
Cookies, analytics and referral links
Session and security cookies support sign-in, form protection and language preferences. Referral links may carry an agent code or token, which can be stored to attribute a registration. The public homepage also integrates Google Tag Manager and first-party visit/event measurement. Depending on the active tags, Google or other tag recipients may receive browser and interaction information. Tag Manager is a delivery tool, not itself a guarantee of which tags are active.
Browser storage can contain referral identifiers, visitor identifiers and visit markers. Cookie and local-storage settings can be inspected or cleared in your browser; restricting necessary cookies may prevent sign-in or form submission. Browser controls alone do not replace the explicit consent required for non-essential tracking. Contact us to exercise a privacy right or ask about tracking. The legal information pages do not embed the homepage analytics scripts.
How long information is kept
Retention depends on the record’s purpose, the active service relationship, the building customer’s lawful instructions, statutory accounting and other retention duties, applicable limitation periods and unresolved disputes. Plan-based access to a history or log is not a promise that all copies are erased at the end of that period.
When the applicable grounds end, data must be deleted, destroyed or irreversibly anonymised as appropriate. Account deletion does not automatically erase shared building records or legally required invoices. Restricted records and backup copies may remain while a lawful retention obligation or backup lifecycle applies; they must not be reused for unrelated purposes. Ask us for the retention information applicable to a specific record.
Security and your responsibilities
The platform uses account permissions, request protection and operational logging. Appropriate technical and organisational measures are required for the risks involved; no internet service can promise absolute security. Keep credentials private, use authorised roles and tell us promptly about suspected misuse. Building administrators should keep access permissions current.
Your rights and how to apply
Under Turkish data protection law you may ask whether your data is processed, obtain information about processing and its purposes, learn the domestic or foreign recipients, seek correction or erasure where the legal conditions are met, request notification of those actions to recipients, object to an adverse result arising solely from automated analysis, and seek compensation for unlawful processing. Where GDPR applies, restriction, portability, objection and withdrawal of consent may also be available under its conditions.
Contact us through the linked form or send a written application to our official address. Describe the right you wish to exercise and the relevant account. We may request proportionate verification or the information required for a formal statutory application through a suitable channel. Do not send passwords or unnecessary identity documents. For building-controlled records we will identify or involve the relevant building controller as appropriate.
KVKK requests must be concluded as soon as possible and at the latest within 30 days of receipt; any refusal must be explained. Applications are generally free, subject only to the legally permitted tariff for additional costs. If the response is unsatisfactory or absent, you may complain to the Turkish Personal Data Protection Board after first applying to the controller: within 30 days of learning the response and, in any event, within 60 days of the application. Other applicable supervisory and judicial remedies remain available.
Children and changes to this notice
The service is intended for building management and authorised users, not to solicit children’s data. If a building record concerns a child, the responsible organisation must have a lawful basis and suitable safeguards. Contact us if you believe information was submitted without proper authority.
We may update this notice when services or legal requirements change and will identify the revision date. Where required, material changes will be communicated separately. A revision does not retrospectively create consent for a new purpose.