GDPR Privacy Notice (European Economic Area and Switzerland)

This Notice is published in Turkish and English with the same content. If you are located outside Türkiye, this English version is the authoritative version for you (see Section 19).

Data Controller Information

• Data controller: Mobiza Teknoloji
• Brand / service: Planfly
• Data protection contact: legal@planfly.com.tr
• Customer support: destek@planfly.com.tr
• Phone: +90 850 307 90 23
• Address: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86/2, 16335 Osmangazi, Bursa, Türkiye
• Website: planfly.com.tr

1. Purpose and Scope of This Notice

This GDPR Privacy Notice (the "Notice") explains how Mobiza Teknoloji ("we" or "us"), which operates the Planfly online appointment platform, processes the personal data of people located in the European Economic Area ("EEA": the member states of the European Union, Iceland, Liechtenstein and Norway) and in Switzerland. It provides the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and, for Switzerland, by Article 19 of the Federal Act on Data Protection of 25 September 2020 ("FADP"). Because we offer Planfly to businesses and individuals in the EEA and, if you consent, measure the use of our marketing pages, the GDPR applies to the processing described in this Notice (Article 3(2) GDPR).

This Notice covers the processing for which we are the controller, in particular when you:

• visit planfly.com.tr or any of its subdomains,
• create a business account, or use the business dashboard or the Planfly mobile app as a business owner, manager or authorized user,
• are invited by a business to its team and use your own Planfly user account,
• request information, a demonstration or a quote, or contact us by email, phone, the support form or the chat assistant on our website,
• purchase, renew or cancel a subscription or an add-on,
• receive service or marketing messages from us,
• sign up through a partner's referral link or take part in our partner program (for partners, the Partner Privacy Notice also applies).

Appointments booked with businesses: If you book an appointment through a business's booking page or booking widget, or if a business records you as its customer, that business is the controller of your appointment data, and we process this data only on the business's behalf (Section 3.2).

Relationship with other documents: This Notice complements the Privacy Policy, which describes our processing in more detail and applies to everyone who uses Planfly. If you are located in the EEA or Switzerland and this Notice differs from the Privacy Policy, this Notice prevails. As a company established in Türkiye, we are also subject to Turkish Law No. 6698 on the Protection of Personal Data (KVKK), which is described in the KVKK Privacy Notice; this does not limit the rights you have under this Notice. People in the United Kingdom should read the UK Privacy Notice, and residents of the United States the US Privacy Notice.

2. Controller, Representative and Contact

The controller for the processing described in this Notice is Mobiza Teknoloji, established in Türkiye, whose contact details are given at the beginning of this Notice. We have no establishment in the EEA or in Switzerland.

We have not appointed a data protection officer. Please send questions about the processing of your personal data and requests to exercise your rights to legal@planfly.com.tr; you can also send questions about your account or the service to destek@planfly.com.tr.

3. Our Role and the Role of Businesses

3.1. Processing for Which We Are the Controller

We determine the purposes and means, and are therefore the controller, of the processing relating to our website, business accounts and dashboard users, Planfly mobile app accounts, subscriptions and purchases, invoicing, customer support and the chat assistant, information security, product analytics, our own marketing communications, the partner program and compliance with the laws that apply to us.

3.2. Booking Pages: the Business Is the Controller

Businesses that use Planfly, such as hair salons, beauty centers, psychologists, dietitians, clinics, physiotherapists and studios, are the controllers of the personal data of their customers (clients, patients, members, students and similar) that they collect through their booking page, booking widget, dashboard or the Planfly mobile app, or that they enter into Planfly themselves. The same applies to the staff profiles that a business creates for its team (name, title, photo, working hours and the services provided).

For this data, we act as the business's processor within the meaning of Article 28 GDPR: we process it only on the business's documented instructions, only to provide the Planfly service and under the Data Processing Agreement between the business and us. Each business's booking page links to the business's own privacy notice or to the notice that Planfly prepares on the business's behalf from the business's details; that notice explains how the business uses your data and how you can exercise your rights. If you send us a request concerning appointment data, we forward it to the business without undue delay and let you know.

3.3. Payments and Purchases

• Purchases in Turkish lira: Subscriptions and add-ons paid in Turkish lira are sold by Mobiza Teknoloji, and the payment is processed by iyzico Ödeme Hizmetleri A.Ş. ("iyzico"). Card details are transmitted over an encrypted connection directly to iyzico's infrastructure and are not stored in our systems; we receive only limited payment data, such as the payment status, the transaction reference, the card type and the masked last four digits of the card (Section 4.6 of the Privacy Policy). iyzico also processes certain data as an independent controller, for example to prevent fraud and to meet its own legal obligations.
• Orders in other currencies (Paddle): Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all orders paid in currencies other than Turkish lira on our website. Paddle provides customer service for payment and billing inquiries and handles returns and refunds for these orders. Paddle.com Market Limited (company number 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom) and the Paddle group companies named in Paddle's buyer terms ("Paddle") buy the subscription from us and resell it to you; Paddle collects the payment, calculates and remits VAT or sales tax and issues the invoice or receipt. Paddle processes your payment data as an independent controller under its own privacy notice. We do not receive your card details; Paddle sends us only the order data we need to provide the service: the order and subscription ID, the plan, the amount, the currency, the country, the tax status, your name and email address, the payment status and any refund or chargeback status.
• App Store and Google Play: If you buy a subscription in the Planfly mobile app, Apple or Google is the seller and processes your payment data as an independent controller. To activate your subscription, we receive from them only transaction information about the purchase, renewal, cancellation and refund status.

4. Personal Data We Process and Where It Comes From

4.1. Categories of Personal Data

Depending on how you interact with Planfly, we process the following categories of personal data; a detailed list is given in Section 4 of the Privacy Policy:

• Website visitors: IP address, device, browser and operating system information, access times and logs, the referring page and campaign (UTM) information, cookie data and, if you consent, Google Analytics 4 measurement data.
• Prospective customers and people who contact us: first name, last name, email address, phone number, business name and industry, the content of your messages, support tickets and chat assistant conversations, attachments and communication history.
• Business account holders and dashboard users: first name, last name, email address, phone number, account identifiers, hashed password and two-factor authentication settings, the Google or Apple account identifier if you sign in with Google or Apple, Google Calendar connection data if you connect it, business details (name, industry, address, contact details, logo and cover image), billing details, subscription, order, payment and invoice records, roles and permissions, session, device and security logs, the device token used for push notifications in the mobile app, and dashboard usage data.
• Team members with their own user account: first name, last name, email address, phone number, role and permissions, sign-in and security records.
• Purchasers: the order data received from Paddle, the transaction information received from Apple or Google and the limited payment data received from iyzico (Section 3.3).
• Partner program: the partner code used for the sign-up, a masked version of the business name, the plan and the subscription status.

4.2. Sources

We collect personal data:

• directly from you, when you fill in forms, use your account, write to us or use the chat assistant,
• automatically from your device and browser when you use our website, the dashboard or the app (and, if you consent, through analytics cookies),
• from the business that invites you to its team (your name, email address and role),
• from Google or Apple, if you choose to sign in with them, and from Google, if you connect Google Calendar (Section 16 of the Privacy Policy),
• from Paddle, Apple, Google and iyzico in connection with your purchases,
• from the partner whose referral link you used (only the partner code).

5. Purposes and Legal Bases

5.1. Our Legitimate Interests

Where we rely on legitimate interests, our interests are: providing a secure and reliable service and preventing fraud and abuse; understanding how the service is used so that we can improve it; answering inquiries and keeping our business customers informed; running the partner program; complying with the laws that apply to us as a company established in Türkiye; and establishing, exercising or defending legal claims. We use only the data needed for these interests and weigh them against your interests and fundamental rights and freedoms. You can ask us for information about this balancing test, and you can object to processing based on legitimate interests at any time (Section 11).

5.2. Consent

Where we rely on your consent, giving it is voluntary, and you can withdraw it at any time with effect for the future: for analytics, through the "Cookie preferences" link on our pages; for marketing messages, through the opt-out link or instructions included in each message or by writing to legal@planfly.com.tr. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Is Providing Your Data Required?

You are not under a statutory obligation to provide personal data to us. However, the data marked as required in our forms is necessary to conclude and perform the contract with you: without it, we cannot open an account for you, provide the service or process a purchase. For purchases in Turkish lira, billing details are required to issue the invoice required by Turkish tax law. Consent to analytics cookies and marketing messages is entirely optional, and refusing it has no effect on your use of Planfly.

7. Special Categories of Personal Data and Health Data

We do not process special categories of personal data, such as health data, for our own purposes, and we ask you not to include such data in support requests or chat assistant conversations. Businesses in the health sector may process health data through intake questions, appointment notes and customer notes. For this data, the business is the controller and determines the condition under Article 9 GDPR on which it relies, in particular Article 9(2)(h) and 9(3) for health care provided by or under the responsibility of a health professional subject to an obligation of professional secrecy, and Article 9(2)(a) for explicit consent. On the booking forms of businesses outside Türkiye, explicit consent is always optional, and booking an appointment online is never made conditional on it. We process this data only as the business's processor and with additional safeguards: private notes on the customer card are encrypted in the database and shown only to the business's authorized users, and businesses can use the discreet message option so that reminders do not show the service name.

8. Recipients

We disclose personal data only to the extent necessary for the purposes above, to the following categories of recipients (see also Section 9 of the Privacy Policy):

• service providers acting as our processors: hosting and database providers, Cloudflare (content delivery network, file storage, DNS and network security), email delivery providers, Netgsm İletişim ve Bilgi Teknolojileri A.Ş. and other SMS providers, Google (encrypted backups on Google Drive and mobile app push notifications through Firebase Cloud Messaging) and artificial intelligence model providers for the chat assistant on our website; the sub-processors we use for businesses' customer data are listed in Annex 3 of the Data Processing Agreement,
• sign-in providers: Google and Apple, if you choose to sign in with them,
• payment and purchase partners: iyzico and banks for purchases in Turkish lira, Paddle for orders paid in other currencies, and Apple and Google for purchases in the mobile app; these recipients act as independent controllers for their own processing,
• analytics provider: Google (Google Analytics 4), only if you consent, with advertising features turned off,
• the business you work with: if you are a team member, the business's authorized users can see your profile and activity in the business's dashboard,
• professional advisers: accounting, e-invoicing, legal and audit service providers,
• public authorities: competent authorities, courts and enforcement offices, where we are legally required to disclose data or where disclosure is necessary to establish, exercise or defend legal claims.

We do not sell your personal data and do not use it for third-party advertising.

9. International Data Transfers

We are established in Türkiye, and the European Commission has not adopted an adequacy decision for Türkiye. Personal data that you send us directly when you use Planfly is collected and processed by us in Türkiye. According to the European Data Protection Board (Guidelines 05/2021), such direct collection from you is not a transfer within the meaning of Chapter V GDPR; the GDPR nevertheless applies to our processing, and we protect your data with the measures described in Section 14.

When we pass personal data on to service providers outside Türkiye, we rely on:

• an adequacy decision of the European Commission for the recipient's country (for example, for the EEA countries and the United Kingdom) and, for recipients in the United States that are certified under the EU-U.S. Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795,
• where no adequacy decision covers the transfer, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, together with supplementary measures where necessary.

Transfers of the personal data of businesses' customers from businesses in the EEA to us are based on the standard contractual clauses (Module Two or Module Three) incorporated into the Data Processing Agreement. Paddle collects the data needed for orders in other currencies directly from you as an independent controller; the United Kingdom, where Paddle.com Market Limited is established, is covered by an adequacy decision of the European Commission. Transfers concerning people in Switzerland are described in Section 17.2. You can request a copy of the safeguards we use at legal@planfly.com.tr.

10. Retention

We keep personal data only for as long as necessary for the purposes for which it is processed. To determine retention periods, we use the following criteria: the duration of the contract and of your account; the time needed to handle your request or support case; the retention periods for invoicing, accounting and commercial records under Turkish law (as a rule, up to 10 years) and for traffic logs under Law No. 5651; the limitation periods for possible legal claims; and the time for which we must be able to prove consents and opt-outs. Data relating to your account is kept while the account is active and, after the account is deleted, only for these purposes and until the backup cycle is completed; it is then deleted or anonymized. Google Analytics data is kept for at most 14 months, and Google Analytics cookies expire after at most 12 months. The periods for each category are set out in Section 12 of the Privacy Policy. Businesses' customer data is kept according to the business's instructions and the Data Processing Agreement.

11. Your Rights

Subject to the conditions and exceptions in the GDPR, you have the right:

• to obtain confirmation as to whether we process your personal data, and to access the data and information about the processing (Article 15),
• to have inaccurate data rectified and incomplete data completed (Article 16),
• to have your data erased (Article 17),
• to have processing restricted (Article 18),
• to receive the data you have provided to us, where it is processed by automated means on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (Article 20),
• to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time and without giving reasons to the use of your data for direct marketing (Article 21),
• to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)),
• to lodge a complaint with a supervisory authority (Article 77; Section 16).

How to exercise your rights: Send your request to legal@planfly.com.tr, preferably from the email address registered to your Planfly account. You can also view and correct much of your data, and delete your account, in your account settings. Requests are free of charge. We respond without undue delay and in any case within one month of receipt; where necessary, taking into account the complexity and number of requests, we may extend this period by two further months, in which case we tell you within the first month and explain why. We ask only for the information reasonably necessary to verify your identity; we do not ask for a Turkish national ID number, a passport number or a handwritten signed letter. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, as permitted by Article 12(5) GDPR. We inform the recipients to whom your data has been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort (Article 19).

If your request concerns appointment data processed on behalf of a business, please send it to that business; if it reaches us, we forward it to the business and help it respond.

12. Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). In the dashboard, businesses can see attendance-probability badges for their customers, which are calculated on the business's behalf from the customer's appointment history; these badges are only indications for the business, and blocking a customer is a manual action taken by the business. Automated security controls, such as rate limits and bot checks, may temporarily limit requests; if you believe that such a control has affected you wrongly, contact us and a member of our team will look into it.

13. Cookies and Similar Technologies

Without asking for consent, we use only the cookies and similar technologies that are strictly necessary for our website, the dashboard and booking pages to work. All other cookies and similar technologies, in particular Google Analytics 4 on our marketing pages, are used only with your prior consent, which you can give or refuse in the cookie notice and change at any time through the "Cookie preferences" link. Google Analytics runs with advertising features and Google signals turned off and does not run while your browser sends a Do Not Track or Global Privacy Control signal. For visits from the EEA and Switzerland, we do not set the partner referral cookie (the partner code is kept only in the session of that visit), we do not store anything in the browser for the information messages next to the chat button, and we do not keep the cookieless visit statistics on booking pages. Details, including the full list of cookies and their durations, are given in the Cookie Policy.

When you open the Paddle checkout for an order in a currency other than Turkish lira, Paddle may use cookies and similar technologies that are necessary for the checkout and for payment security, under its own privacy notice.

14. Security

We implement appropriate technical and organizational measures to protect personal data, including encrypted transmission (TLS) on all connections, separation of business data and role-based access control, hashed passwords and optional two-factor authentication, encryption in the database of private customer notes and third-party access tokens, rate limiting and misuse detection, logging, and regular encrypted backups (Section 13 of the Privacy Policy). If a personal data breach occurs, we notify the competent supervisory authority and the people affected where the GDPR requires it.

15. Children

Planfly is intended for businesses and their customers and is not directed at children. We do not knowingly collect personal data from children for our own purposes. Where a business accepts appointments for children, the appointment is expected to be made by a parent or legal guardian, and the business is responsible for the processing as the controller (Section 17 of the Privacy Policy).

16. Right to Lodge a Complaint

If you believe that we process your personal data in breach of the GDPR, you can lodge a complaint with the supervisory authority of the EEA country of your habitual residence, your place of work or the place of the alleged infringement. The contact details of all EEA supervisory authorities are available in the list of members of the European Data Protection Board. You also have the right to an effective judicial remedy. We would welcome the chance to address your concern first, so please feel free to contact us at legal@planfly.com.tr; this is not a precondition for a complaint.

17. Additional Information for People in Switzerland

17.1. Applicable Law and Contact

For people in Switzerland, our processing is subject to the FADP, in force since 1 September 2023, and to the Data Protection Ordinance ("DPO"). This Notice provides the information required by Article 19 FADP; the sections above also apply to you, with the additions in this section. We process your personal data in accordance with the principles in Article 6 FADP (lawfulness, good faith, proportionality, purpose limitation and transparency). Where a justification is required, we rely on your consent, on our overriding private interests, which correspond to the legitimate interests described in Section 5.1, or on the law (Article 31 FADP). Health data is sensitive personal data under the FADP; for health data processed through a business's booking page, the business is the controller (Section 7). Storing information on your device and reading it is also subject to Article 45c of the Telecommunications Act (Section 13).

You can contact us directly about any matter concerning your personal data at legal@planfly.com.tr.

17.2. Disclosure Abroad

Your personal data is processed in Türkiye, where we are established, and may be disclosed to our service providers in the United States, in EEA states, in the United Kingdom (Paddle) and in the other countries shown in the location column of the sub-processor list in Annex 3 of the Data Processing Agreement. Türkiye is not on the list of states with an adequate level of data protection in Annex 1 to the DPO; the EEA states and the United Kingdom are. For disclosures to recipients in states without an adequate level of protection, we rely, for certified recipients in the United States, on the Swiss-U.S. Data Privacy Framework, recognized by the Federal Council with effect from 15 September 2024, and otherwise on the standard contractual clauses of the European Commission recognized by the Federal Data Protection and Information Commissioner ("FDPIC"), with the adaptations required for Switzerland (Article 16(2)(d) FADP). Transfers of businesses' customer data from businesses in Switzerland to us are governed by the Data Processing Agreement. You can request a copy of these safeguards at legal@planfly.com.tr.

17.3. Your Rights in Switzerland

Under the FADP, you have the right:

• to request information on whether we process personal data about you and, if so, which data (Article 25 FADP); we provide this information free of charge, as a rule within 30 days, and if we cannot do so within 30 days, we tell you within that period when you will receive it,
• to receive the personal data you have disclosed to us in a commonly used electronic format, or to have it transferred to another controller (Article 28 FADP),
• to request the rectification of inaccurate personal data (Article 32(1) FADP), and to request that processing be stopped, that data not be disclosed to third parties, or that data be deleted or destroyed (Article 32(2) FADP),
• to withdraw your consent at any time with effect for the future.

We do not take automated individual decisions within the meaning of Article 21 FADP. If you believe that we process your personal data unlawfully, you can report this to the FDPIC, which can open an investigation (Article 49 FADP), and you can bring your claims before the civil courts (Article 32 FADP). We would welcome the chance to address your concern first at legal@planfly.com.tr.

18. Changes to This Notice

We may update this Notice if the law, our services or our service providers change. This version was last updated on October 10, 2026. For significant changes, we may also inform business users by email or by a notification in the dashboard.

19. Language of This Notice

This Notice is published in Turkish and English with the same content. For people located outside Türkiye, the English version is authoritative.