vesunil
Ücretsiz deneyin
YASAL BELGELER

KVKK Privacy Notice

Vesunil legal documents.

This notice explains how the personal data of people who open an account on and use the Vesunil platform (the "Platform") is processed, in accordance with Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

Version: v1 · Last updated: 4 September 2026

1. Identity of the data controller

  • Data controller: [LEGAL ENTITY NAME]
  • Address: [ADDRESS]
  • MERSIS number: [MERSIS NUMBER]
  • VERBİS registration number: [VERBIS REGISTRATION NUMBER]
  • Email: info@dualyxlabs.com
  • Registered e-mail (KEP) address: [REGISTERED E-MAIL ADDRESS]

2. Scope of this notice and the separation of roles

The Platform is a multi-tenant business service on which businesses manage their own appointment and customer operations. There are therefore two separate processing relationships:

  • Panel users' data: For the account and usage data of the people who sign in on behalf of a business (business admins, providers), the data controller is [LEGAL ENTITY NAME]. This notice describes that relationship.
  • The business's customers' data: For the customer, appointment, payment and communication data a business records on the Platform, the data controller is that business; [LEGAL ENTITY NAME] acts only as a data processor. That relationship is set out in the Data Processing Agreement. If you are a customer of a business, address requests about your data to the business you received service from.

3. Personal data processed

Identity and contact data: Full name, email address, phone number, date of birth where provided, profile photo, language and time zone preference.

Business information: Business name, address, phone number, owner name, tax number and tax office, logo. For a sole trader this information may itself constitute personal data.

Account security data: The irreversibly hashed form of the password, email verification and password reset records, one-time sign-in codes, session records, sign-in attempts and registration attempts, and the IP address associated with those records.

Usage and transaction security data: Audit records of operations performed in the Panel (who, when, on which record), in-business change records, application version and error logs.

Support data: Support requests and feedback submitted, their attachments and the correspondence on them.

Contract and subscription data: Trial and package start/end dates, assigned feature entitlements, storage usage, and the version and time of acceptance of the terms of use.

The Platform takes no online payments and processes no card data.

4. Purposes of processing

  • Creating the account, verifying the email address and authenticating the user.
  • Providing the service, operating the business panel and managing roles and permissions.
  • Establishing and performing the agreement, tracking trial and package entitlements.
  • Ensuring information security, preventing unauthorised access and abuse, and maintaining an audit trail.
  • Handling support requests and feedback.
  • Delivering mandatory service messages (verification, password reset, security and service announcements).
  • Meeting legal obligations and exercising the right of defence in disputes.

5. Legal grounds for processing

  • KVKK Art. 5/2-c (performance of a contract): Account and business records, role and permission management, subscription and package tracking, mandatory service messages.
  • KVKK Art. 5/2-ç (legal obligation): Retention and notification duties required by law.
  • KVKK Art. 5/2-e (establishment, exercise or protection of a right): The version and time record of accepted terms, audit records, defence in disputes.
  • KVKK Art. 5/2-f (legitimate interest): Information security, prevention of abuse and automated attacks, service continuity and fault diagnosis.

Where processing relies on explicit consent, that is stated separately and the consent can be withdrawn at any time.

6. Method of collection

Data is collected through registration and sign-in forms, fields filled in within the Panel, the support screen, email correspondence, and records kept automatically by the Platform and its infrastructure components, by partly automated or automated means.

7. Recipients of personal data and purposes of transfer

Under KVKK Art. 8, your data is transferred only to the extent necessary to operate the service, for the following purposes:

  • Hosting and database provider: Running the Platform and the database (servers are hosted on Hetzner infrastructure).
  • Email delivery infrastructure: Sending verification, password reset, support and service messages.
  • Bot protection provider (Cloudflare Turnstile): Preventing automated attacks on the registration and sign-in forms. Your IP address and browser signals are passed to the provider for this purpose.
  • SMS and WhatsApp providers: Delivering messages where the business uses the messaging feature.
  • Authorised public authorities and judicial bodies: Meeting requests and obligations arising from legislation.
  • Legal and financial advisors and auditors: Fulfilling obligations and protecting rights.

Your personal data is not sold or transferred to third parties for advertising or marketing purposes.

8. Transfers abroad

Some of the service providers used have servers outside Türkiye. The Platform's servers are hosted on Hetzner infrastructure, in the [SERVER REGION] region; bot protection runs on Cloudflare and WhatsApp messages run over Meta infrastructure.

These transfers are carried out in accordance with the conditions set out in KVKK Art. 9, relying on an adequacy decision, one of the appropriate safeguards (including standard contractual clauses) or one of the exceptions listed in the Law. Transfers based on standard contractual clauses are notified to the Personal Data Protection Authority.

9. Retention periods

  • Account and business records: For as long as the service relationship continues.
  • Session records and sign-in/registration attempts: For a limited period for security purposes, then deleted or anonymised.
  • Audit and in-business change records: For the duration of the service relationship and thereafter for the limitation period prescribed by law, to evidence the account's legal history.
  • Support records and attachments: For a reasonable period after the request is closed.
  • Verification and password reset records: Become unusable once their short validity expires.

When the service relationship ends, data is deleted or anonymised within the periods described in the Account and Data Deletion document, subject to retention obligations arising from legislation.

10. Data security

Data is encrypted in transit. Passwords are stored irreversibly. Provider credentials are held encrypted and masked in the interface. Each business's data is separated by a tenant identifier (businessId) and authorisation checks are enforced server-side. Access rights are limited to what a role requires, and Panel operations are written to audit records.

11. Your rights as a data subject

Under KVKK Art. 11 you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom the data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction within the conditions set out in the Law; request that correction and erasure be notified to third parties to whom the data was transferred; object to an adverse outcome arising from analysis carried out solely by automated systems; and claim compensation if you suffer loss due to unlawful processing.

12. How to submit a request

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:

  • from the support screen in the Panel,
  • to info@dualyxlabs.com from the email address registered in the system,
  • in writing with a wet signature to [ADDRESS],
  • to the registered e-mail address [REGISTERED E-MAIL ADDRESS] with a secure electronic signature.

Your application must include your full name; your signature if it is in writing; your national identification number (passport number for foreign nationals); your address for notification; your email address and phone number if any; and the subject of your request. Requests are concluded free of charge as soon as possible and in any event within 30 days; where the process entails an additional cost, the fee in the tariff set by the Board may be charged.

If your application is refused, you find the response insufficient, or no response is given in time, you have the right to lodge a complaint with the Personal Data Protection Board.

13. Changes

This notice may be updated. The current version is always published at this address with its version number and last-updated date. Significant changes are communicated through the Panel.