randevuplanı
My accountGet started

Personal Data Protection Notice (KVKK)

Effective date: 01.11.2026

Randevu Planı — Privacy Notice under the Turkish Data Protection Law (KVKK)

Language: This is a translation provided for your convenience. The official and legally binding version of this notice is the Turkish one. In the event of any discrepancy, the Turkish text prevails.

Pursuant to Article 10 of the Turkish Personal Data Protection Law no. 6698 (“KVKK”), we would like to inform you, in our capacity as data controller, about the processing of your personal data. The identity of the data controller is given at the end of this notice (Section 9).

Scope note: With regard to Customer data collected by a Business through the Platform, the relevant Business is the data controller; Randevu Planı acts as a data processor processing that data on behalf of the Business. With regard to your account and analytics data, Randevu Planı is the data controller.

1. Personal Data Processed

  • Identity: first name and surname.
  • Contact: phone number, e-mail address.
  • Customer transactions: appointment records, appointment history, service preferences.
  • Location: address and/or device location (with your permission).
  • Personal details (optional): birth date, gender, occupation. These are processed only where you choose to enter them. Your choice on sharing them with businesses is also recorded, together with the date on which you gave or withdrew it and the version of the text in force on that date.
  • Review: the 0–10 recommendation score (NPS) you give after an appointment and your optional note.
  • Marketing (commercial message consent): campaign SMS consent or refusal, its date, channel and text version, the IP address and browser/device information from which consent was given, and the status of transmission to İYS.
  • Transaction security: IP address, log records, device information.

2. Purposes of Processing

  • Providing, managing and sending reminders for the appointment service.
  • Account creation, authentication and security.
  • Carrying out notification and communication activities.
  • If you allow it, enabling the businesses you book with to offer birthday discounts, campaigns and similar gestures.
  • If you give consent, recording it and transmitting it to the Message Management System (İYS) so that the business you book with can send you campaign SMS.
  • Collecting the post-appointment satisfaction score (NPS) and reporting it to the relevant business.
  • Improving the service and performing analytics.
  • Fulfilling legal obligations.

3. Legal Grounds for Processing (KVKK arts. 5–6)

  • Processing is necessary for the conclusion or performance of a contract.
  • Compliance with a legal obligation of the data controller (e.g. registering commercial message consents with İYS and keeping consent records for 3 years).
  • Legitimate interests, provided that your fundamental rights and freedoms are not harmed.
  • Explicit consent (for example, for location data, commercial electronic messages and optional cookies, and for sharing your optional personal details — birth date, gender, occupation — with the businesses you book with).

4. Transfer of Personal Data

Your personal data may be transferred to cloud/hosting and network security (Cloudflare), analytics, error tracking, authentication, notification, communication (SMS, WhatsApp, e-mail), calendar sync, video, maps/location, subscription/payment and artificial intelligence service providers (detailed list: Privacy Policy, Section 4), to İleti Yönetim Sistemi A.Ş. (İYS) if you have given campaign SMS consent, and to legally authorised public institutions, in accordance with the conditions set out in Articles 8 and 9 of the KVKK, for the purpose of providing the service.

Sharing with businesses: If you turn on the “Let businesses I book with see this” option in your account, your birth date, gender and occupation are shown only to businesses with which you yourself have created at least one appointment; appointments that a business has created on your behalf do not meet this condition. This sharing is based on your explicit consent. The option is off by default; you can turn it off at any time, and once you do, businesses can no longer see this information. While the option is off, your details are not shown to any business and only you can see them in your account. Turning the option off does not delete your details; you can change or delete them in your account at any time. If you delete your account, this information is deleted. Information that businesses enter themselves into their own customer records is independent of this option; the relevant Business is the data controller for those records (see the Scope note).

Campaign SMS (commercial electronic messages): If the business has enabled this feature, the booking form shows an optional consent box along the lines of “I would like to receive campaigns and offers by SMS”. Consent is given only to that business and for the phone number you provide; other businesses cannot use it. The relevant Business is the data controller for the content and sending of campaign messages; Randevu Planı records your consent and, as required by Turkish Law no. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages, transmits it to the Message Management System (İYS) through the business’s SMS provider. This transmission includes your phone number, the consent or refusal, its date and the channel through which it was given. Campaign messages are sent only to numbers whose consent is recorded in İYS. You can withdraw your consent at any time from Marketing consents in your account or directly through İYS (iys.org.tr, e-Devlet); your refusal is also transmitted to İYS. Not giving consent does not affect your ability to book.

Satisfaction score (NPS): After your appointment you may be asked, on a scale of 0–10 and with an optional short note, whether you would recommend the business to someone you know (via the review page, My appointments or an app notification). Giving a score is optional. Your score and note are reported, together with the related appointment, only to that business; they are not published and are not passed on to platforms such as Google.

Transfers abroad: Our servers and some of our suppliers are located in the European Union (EU); some suppliers may also process data on servers outside the EU, in particular in the US. Your data is therefore transferred abroad (including to the EU and the US) within the meaning of Article 9 of the KVKK. Such transfers rely on your explicit consent and/or on their being necessary for the performance of the contract; appropriate safeguards (an adequacy decision or an undertaking/Standard Contractual Clauses) are put in place.

5. Method of Collection

Your data is collected electronically, by automated and partly automated means, through the website and the mobile application, during account creation and appointment transactions and when you update your account details.

6. Your Rights as a Data Subject (KVKK art. 11)

Under Article 11 of the KVKK you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom the data has been transferred in Türkiye or abroad; request rectification if the data is incomplete or inaccurate; request erasure or destruction where the conditions are met; request that these actions be notified to the parties to whom the data was transferred; object to a result reached against you solely through automated analysis; and claim compensation if you suffer damage.

You may withdraw your consent at any time for processing based on your explicit consent. For sharing with businesses, you can also do this by turning off the “Let businesses I book with see this” option in your account, and for campaign SMS from Marketing consents in your account or through İYS.

7. How to Apply

You may send requests relating to the rights above to privacy.randevuplani@gmail.com. Your request will be concluded within the periods prescribed by the KVKK and related legislation (as a rule, within 30 days at the latest). Depending on the nature of your request, we may ask for information verifying your identity.

8. Contact

9. Identity of the Data Controller

Mert Can Taşkın