KVKK Privacy Notice

This notice is published in Turkish and English with the same content. If you are located outside Türkiye, this English version is the authoritative version for you. The privacy notices for the European Economic Area and Switzerland, the United Kingdom and the United States are listed in Section 20 of the Privacy Policy.

1. Purpose of This Privacy Notice

This Privacy Notice has been prepared to inform data subjects about the personal data processed within the Planfly online appointment platform operated by Mobiza Teknoloji, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ).

This notice applies:

• on planfly.com.tr and all of its subdomains,
• in email, phone, support and other communication channels owned by Planfly or operated on Planfly's behalf,
• in the Planfly website, business dashboard, online booking pages, embeddable booking widget, appointment confirmation and reminder infrastructure, subscription and payment processes and related digital services,
• in customer, user and visitor interactions connected with Planfly.

This notice does not cover other products, brands, services or platforms of Mobiza Teknoloji outside Planfly.

This notice has been prepared to fulfill the obligation to inform under the KVKK. If you are located outside Türkiye, you can find the privacy notice for your region in Section 20 of the Privacy Policy.

2. Identity of the Data Controller

Under the KVKK, and subject to the division of roles described in Section 3, your personal data may be processed by Mobiza Teknoloji, whose details are set out below, in its capacity as data controller:

• Data controller: Mobiza Teknoloji
• Brand / service: Planfly
• Email: legal@planfly.com.tr
• Phone: +90 850 307 90 23
• Address: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86/2, 16335 Osmangazi, Bursa, Türkiye
• Website: planfly.com.tr

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all orders paid in currencies other than Turkish lira on our website. Paddle provides customer service for payment and billing inquiries and handles returns and refunds for these orders. Paddle.com Market Limited (company number 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom) and the Paddle group companies named in Paddle's buyer terms ("Paddle") are a separate data controller for the payment data they collect on their checkout, under Paddle's own privacy notice; the data transferred to and received from Paddle is described in Section 4.5.

3. Important Note on Data Controller and Data Processor Roles

Planfly is a software service (SaaS) that provides online booking pages, calendar, staff and service management, customer records and appointment reminder infrastructure to appointment-based businesses such as hair salons, beauty centers, psychologists, dietitians, dental clinics, private medical practices, physiotherapists, veterinary clinics, Pilates and yoga studios, gyms, consulting offices and similar businesses.

In this context:

• Mobiza Teknoloji is the data controller with respect to Planfly's own website, business accounts and dashboard users, sales, subscriptions, invoicing and payment confirmation, support, security, system administration, analytics and legal obligations.
• Businesses that use Planfly are data controllers with respect to customer (client, patient, member, student, etc.) data that they collect through their own booking pages, widgets or dashboards or that they themselves enter into Planfly. The service that is the subject of the appointment is a relationship between the person who books the appointment and the relevant business.
• Mobiza Teknoloji acts as a data processor, processing this customer data of businesses only in line with the relevant business's instructions, for the purpose of providing the Planfly service and within the framework of the data processing provisions in the Terms of Use and the Data Processing Agreement.

Therefore, if you booked an appointment through a business's booking page or widget on Planfly, your point of contact for the privacy notice, explicit consent and application processes relating to your appointment data is the relevant business. Each business's booking page contains a link to the business's own privacy notice or to a privacy notice prepared by Planfly on the business's behalf.

If you send your application to us by mistake, we will forward it to the relevant business without delay and inform you accordingly.

4. What Personal Data Do We Process?

Data processing activities within Planfly vary depending on how the data subject interacts with the system.

4.1. Website Visitors

If you visit our website, the following data may be processed:

• IP address,
• device, browser and operating system information,
• site usage and navigation records,
• access time and traffic logs,
• referring page, campaign and UTM information,
• cookie data and similar online identifiers,
• if you give consent, measurement data collected through Google Analytics 4 relating to navigation and interactions on marketing pages and to successful sign-up, sign-in and business setup events (Google Analytics cookie ID, device and browser information, approximate location, the domain of the referring site and campaign / UTM tags; no name, email, phone number or form content is sent),
• if a contact or support form is filled in, first name, last name, phone, email, business name and message content.

4.2. Prospective Customers, Communication and Support Processes

In sales, promotion, communication and support processes, the following data may be processed:

• first name, last name,
• phone number,
• email address,
• business name and industry,
• the content of requests, questions, suggestions, complaints and support tickets, together with their attachments,
• campaign or referral source information,
• call and correspondence records,
• for tickets opened without a Planfly account through the support form or the chat assistant, the channel through which the ticket was opened, the date and IP address, and records relating to the personal link sent to your email address so that you can track the ticket.

If you use the chat assistant on our website, your chat messages, contact details you share in the chat such as your name, phone number and email, as well as your IP address, the address of the page where the chat takes place and browser information, are processed in order to answer your questions and, where necessary, to create a support ticket. Chat responses are prepared with the help of artificial intelligence; in this context, your messages may be processed by artificial intelligence service providers located abroad, within the framework of the service relationship and in accordance with the principles described in Section 9. Chat records are deleted after being kept for a limited period (90 days by default).

4.3. Business Accounts, Dashboard Users and Staff Members

In the Planfly dashboard and account processes, the following data may be processed:

• first name, last name, email and phone,
• user account information and hashed password data,
• if two-factor authentication is used, authentication configuration records,
• if Sign in with Google or sign-up with Google is used, or if a Google account has been linked later: the Google account ID (the permanent number Google assigns to the account), the email address of the Google account and the date it was linked; if the account was opened with Google, the name in the Google account and the information that the email address has been verified by Google,
• if the business or a staff member uses the Google Calendar / Google Meet integration for online meetings: the email address and ID of the connected Google account, access and refresh tokens stored in encrypted form, the permissions granted, the selected calendar and connection status records,
• the mobile phone number verified by SMS for the free trial, verification records (date, IP address) and the trial usage record,
• business name, industry, address, contact details, logo and cover image,
• staff member name, title, photo, bio, working hours, days off and the services they provide,
• role, permission and team invitation records,
• billing information (full name or trade name, Turkish national ID number (T.C. kimlik numarası) or tax number, tax office, billing address),
• subscription, plan, payment and invoice records,
• session, transaction and security logs,
• support tickets and correspondence.

4.4. People Who Use Booking Pages and the Widget

If you book an appointment through a business's Planfly booking page or the Planfly widget that the business has embedded on its own website, the following data is processed on behalf of the relevant business and in our capacity as data processor:

• first name, last name,
• phone number and/or email address,
• selected service, service options, staff member, date and time,
• appointment note,
• your answers to the intake questions the business asks on its booking form,
• appointment status, cancellation, rescheduling and no-show records,
• records relating to the display of the privacy notice, explicit consent and consent to commercial electronic messages (date, IP address, text version),
• records of appointment confirmation and reminder emails / SMS messages sent to you and their delivery status,
• the meeting link for online appointments; if the business has connected its Google account, records of the event and Google Meet link created in the business's or staff member's Google Calendar for your appointment,
• if the business uses review collection, the review request and link records sent to you after your completed appointment and, optionally, the rating, review and name display preference you provide (reviews are shown only if the business publishes them, and your name is shown in abbreviated form; your phone and email are not shown),
• IP address, device and browser information and security logs,
• anonymous visit statistics kept without using cookies: page views, booking steps, referring site and campaign (UTM) information, device type, operating system and browser family. The IP address is not stored for this purpose; visitors are counted using a hash that changes every day and cannot be reversed. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, these statistics are not kept.

The business may also store in Planfly customer information that it enters itself through the dashboard (e.g., date of birth, tags, private notes, appointment history).

4.5. Payment Processes

For Planfly subscription payments, card data is transmitted during payment over an encrypted connection to the infrastructure of iyzico Ödeme Hizmetleri A.Ş. ("iyzico") and processed by iyzico; Planfly processes this data only for the duration of the transmission. For orders paid in currencies other than Turkish lira on our website, card and other payment details are entered directly on Paddle's checkout; this information does not reach Planfly's servers. Planfly does not store the full card number or the CVV/CVC in its own systems; for payments made with iyzico, the card's expiration date is not stored either. Only the following limited payment data may be processed by Planfly:

• payment status, transaction and reference number,
• payment date, amount and the period it covers,
• payment method,
• card type, card scheme and the masked last four digits of the card,
• if card storage is chosen, card and customer reference keys (tokens) generated by iyzico,
• payment verification, automatic renewal and refund records,
• for orders paid in currencies other than Turkish lira, the order data received from Paddle.

For orders paid in currencies other than Turkish lira on our website, your billing email address, your billing name or business name, your country and billing address, your tax number (if provided), your language preference, the identifier of your business account in Planfly and the order identifiers for the plan or add-on you selected are transferred to Paddle so that Paddle's checkout can be opened. To activate and manage your subscription, only order data (order and subscription ID, plan, amount, currency, country, tax status, name, email, payment status and refund or chargeback status) is received from Paddle; your card details are not transmitted to Planfly. This transfer and the receipt of this data are based on the legal ground that the processing is directly related to the establishment or performance of a contract (KVKK Art. 5(2)(c)). Paddle processes the payment data it collects on its checkout as the seller and a separate data controller under its own privacy notice.

For online deposits and prepayments that businesses collect from their customers through the booking page (Payment Module), card details are entered only on the payment institution's hosted payment page: iyzico for the "Accept payments with iyzico" method, and iyzico or PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. ("PayTR") for methods to which the business's own account is connected. Card details are not transmitted to Planfly's servers or to the business, and are not stored. For these payments, Planfly, as a data processor on behalf of the business, processes only the payment amount and date, the payment and order number, the card type and masked last four digits, refund and payout records, records of acceptance of the preliminary information and the agreement (date, IP address, text version), and withdrawal notice and complaint records. These records are kept for at least 3 years as required by the obligations of intermediary service providers.

The identity, tax, contact and IBAN details of business representatives who apply for the "Accept payments with iyzico" method are transferred to iyzico for sub-merchant registration and are stored in encrypted form in Planfly.

5. For What Purposes Is Your Personal Data Processed?

Your personal data may be processed within Planfly for the following purposes:

5.1. Providing and Managing Planfly Services

• operating the website, the business dashboard and the application infrastructure,
• creating and managing user and business accounts,
• offering the option to sign in and sign up with Google, linking a Google account for sign-in and removing the link,
• publishing online booking pages and the embeddable booking widget,
• providing calendar, staff, service, working hours and availability management,
• creating, confirming, canceling and rescheduling appointments,
• sending appointment confirmation and reminder emails and SMS messages,
• managing team invitations, roles and permissions,
• at the business's request, creating events and Google Meet links in Google Calendar for online appointments, updating them when the appointment changes and deleting them upon cancellation.

5.2. Carrying Out Communication, Sales and Support Processes

• responding to communication and support requests,
• carrying out promotion and sales processes,
• communicating with prospective customers,
• carrying out pre-sales and after-sales processes,
• managing customer relationships and satisfaction.

5.3. Carrying Out Subscription, Invoicing and Payment Processes

• carrying out free trial, plan selection, subscription and automatic renewal processes,
• collecting payments through iyzico, card storage and payment confirmation,
• for orders paid in currencies other than Turkish lira, opening Paddle's checkout and activating and managing the subscription with the order data received from Paddle,
• issuing invoices and keeping accounting and financial records,
• managing failed payment notifications and grace period processes.

5.4. Information Security and System Administration

• authentication and authorization,
• when signing in with Google, checking that the email address has been verified by Google and preventing the misuse of accounts opened with an email address belonging to someone else,
• session and access security,
• logging and incident tracking,
• preventing fake appointments, spam, bots, fraud and unauthorized access attempts,
• preventing abuse of the free trial (since the free trial can be used only once per account and per phone number, the phone number verified for the trial may be kept together with the trial record even if the account is deleted),
• identifying errors, performance and system issues,
• backups and protecting data integrity.

5.5. Product Development, Analytics and Improvement

• performing traffic and usage analyses,
• improving the user experience,
• measuring product and service performance,
• making technical and operational improvements.

5.6. Marketing and Commercial Communications

• if you have given consent, sending campaigns, news and announcements about Planfly,
• measuring campaign and conversion performance,
• managing your communication preferences.

5.7. Fulfilling Legal Obligations and Protecting Rights

• fulfilling obligations arising from legislation,
• responding to requests from competent institutions and organizations,
• resolving disputes,
• establishing, exercising and protecting rights,
• fulfilling audit, evidentiary and retention obligations.

6. On What Legal Grounds Is Your Personal Data Processed?

Your personal data may be processed on the following legal grounds, within the scope of the personal data processing conditions set out in Article 5 and, where necessary, Article 6 of the KVKK:

• Being directly related to the establishment or performance of a contract: account creation (including sign-up with Google), sign-in, subscriptions, providing Planfly services, the Google Calendar / Google Meet integration enabled by the business, support and invoicing processes, and, for orders paid in currencies other than Turkish lira, the transfer to Paddle and the receipt of order data from Paddle,
• Being expressly provided for by law and the data controller's legal obligation: invoice and accounting records under Tax Procedure Law No. 213 (Vergi Usul Kanunu) and Turkish Commercial Code No. 6102 (Türk Ticaret Kanunu), traffic records under Law No. 5651 on Regulating Internet Publications and Combating Crimes Committed Through Such Publications, providing information to competent authorities,
• Establishing, exercising or protecting a right: dispute resolution, evidence and defense processes,
• The data controller's legitimate interest, provided that it does not harm the data subject's fundamental rights and freedoms: information security, preventing misuse, measuring and improving service quality,
• Having been made public by the data subject: contact details that businesses publish publicly on their booking pages,
• Explicit consent: sending commercial electronic messages, cookies that are not strictly necessary and other cases where legislation requires explicit consent.

For processing that requires explicit consent, your consent is requested separately and with a separate text. This Privacy Notice does not replace an explicit consent text.

The legal ground on which businesses process their own customers' data is determined by the relevant business in its capacity as data controller.

7. To Whom and For What Purposes May Your Personal Data Be Transferred?

Depending on the purposes of processing and the legal grounds, and only to the extent necessary, your personal data may be transferred to the following groups of recipients:

• the relevant business you booked with or contacted,
• server, database, backup and hosting service providers,
• content delivery network (CDN), file storage (Cloudflare R2), DNS and network security service providers, primarily Cloudflare,
• Netgsm İletişim ve Bilgi Teknolojileri A.Ş. ("Netgsm") and, where necessary, other authorized SMS service providers, for sending appointment confirmation and reminder SMS messages,
• email sending and delivery service providers,
• Apple Inc. for Sign in with Apple and App Store purchases, and Google LLC for Google Play purchases, mobile app push notifications (Firebase Cloud Messaging) and encrypted database backups (Google Drive),
• artificial intelligence model providers that prepare the chat assistant's responses on our website,
• if you use Sign in with Google or the business enables the Google Calendar / Google Meet integration, Google (Google LLC), to the extent necessary for the sign-in request and for creating the calendar event; the scope of these transfers is described in the "Google Services" section of the Privacy Policy,
• iyzico Ödeme Hizmetleri A.Ş. and the relevant banks, for subscription payments, card storage and refunds,
• Paddle, which is the seller and a separate data controller for orders paid in currencies other than Turkish lira on our website, for opening the checkout, collecting payment, invoicing, refunds and payment disputes,
• iyzico Ödeme Hizmetleri A.Ş. and, where the business has connected its own account, PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., and the relevant banks, for businesses' online deposits and prepayments, sub-merchant registration and refunds,
• persons and organizations providing accounting, financial advisory, e-invoice / e-archive integration, legal, audit and consulting services,
• if you have given consent, analytics and measurement service providers, primarily Google Analytics 4 (Google LLC),
• competent public institutions and organizations and judicial and administrative authorities.

The information you provide through the booking page or widget is shown to the relevant business's authorized users (e.g., the business owner, managers and the staff member who will serve the appointment) for the purpose of creating and carrying out the appointment.

Sign-ups made through a partner: If your business signed up through a link or code of one of our partners, the following are transferred to that partner so that the commission calculation can be verified: your business name, partially masked (e.g., "Ay*** Kua***"), your subscription plan and status, and the commission amounts based on your payments; your phone, email, contact person's name and payment amounts are not transferred. Legal ground: the data controller's legitimate interest (KVKK Art. 5(2)(f)). In the "Your partner" section of your business dashboard, you can choose for your business name never to be shown to the partner (fully anonymous). Partners contractually undertake to use this information only for commission tracking and to keep it confidential. Partners' own personal data is processed under the Partner Privacy Notice.

8. How Is Your Personal Data Collected?

Your personal data may be collected by automated, partially automated or non-automated means through the following methods:

• your browsing and use of the website and its subdomains,
• cookies and similar technologies,
• sign-up, sign-in, contact and support forms,
• identity information received from Google, upon your approval in your Google account, when you sign in or sign up with Google or link a Google account,
• use of the business dashboard,
• online booking pages, the embeddable widget and appointment management links,
• customer, staff member or appointment data entered by businesses through the dashboard,
• team invitations,
• transaction and order notifications from the payment institution, Paddle and other service providers,
• email, phone, SMS and similar communication channels.

9. Can Your Personal Data Be Transferred Abroad?

Planfly's core service infrastructure may include services that use servers located abroad or service providers with connections abroad. For example, Cloudflare infrastructure is used for content delivery network, file storage, DNS and network security services; data is transmitted to Google services when Sign in with Google and the Google Calendar and Google Meet integration are used and, if you give consent, through Google Analytics; for orders paid in currencies other than Turkish lira on our website, the data listed in Section 4.5 is transferred to Paddle, established in the United Kingdom, and, for buyers in the United States, to Paddle.com Inc., established in the USA; depending on the configuration, cloud, hosting and email service providers may also be located abroad. Google for mobile app push notifications and encrypted database backups, Apple for Sign in with Apple and App Store purchases, and artificial intelligence model providers for the chat assistant are also located abroad.

Therefore, pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik), your personal data may be transferred abroad within the framework of:

• the existence of an adequacy decision regarding the country, international organization or sector to which the transfer is made,
• in the absence of an adequacy decision, the signing of the standard contract announced by the Personal Data Protection Board (KVKK Board) and its notification to the Personal Data Protection Authority (KVKK Authority) within five business days of signing, or the provision of binding corporate rules or one of the other appropriate safeguards listed in the legislation,
• where these options are not available, and only provided that the transfer is incidental, the existence of one of the exceptional cases listed in the sixth paragraph of Article 9 of the KVKK, including explicit consent.

Transfers to Paddle for orders paid in currencies other than Turkish lira on our website are based on the standard contract announced by the Personal Data Protection Board.

10. Note on Special Categories of Personal Data

Planfly is not a service intended for processing special categories of personal data. However, businesses providing health services, such as psychologists, dietitians, dental clinics, private medical practices, physiotherapists and similar businesses, may include special categories of personal data, such as health data, in answers to intake questions on the booking form, in appointment notes or in notes added to the customer card.

With respect to such data:

• the data controller is the relevant business; the business decides which information to ask for, which legal ground to rely on and whether explicit consent must be obtained where necessary,
• Planfly allows businesses in the health sector to obtain a separate and optional explicit consent on the booking form for the processing of such data; not giving consent does not prevent booking an appointment,
• private notes the business adds to the customer card are stored encrypted in the database and shown only to the business's authorized users,
• businesses can use the discreet message option, which hides the service name in reminder messages,
• Planfly processes this data only as a data processor, to the extent necessary to provide the service and having regard to the adequate measures prescribed by the Personal Data Protection Board for special categories of personal data.

11. Your Rights Under Article 11 of the KVKK

Under Article 11 of the KVKK, you may exercise the following rights by applying to the data controller:

• to learn whether your personal data is processed,
• to request information about it if it has been processed,
• to learn the purpose of processing and whether it is used in line with that purpose,
• to know the third parties to whom it is transferred in Türkiye or abroad,
• to request correction if it is incomplete or inaccurately processed,
• to request erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK,
• to request that the correction, erasure or destruction be notified to the third parties to whom the personal data has been transferred,
• to object to a result against you arising from the analysis of the processed data exclusively by automated systems,
• to request compensation for damages if you suffer damage due to the unlawful processing of personal data.

12. How to Apply

You can send your applications under the KVKK to Mobiza Teknoloji through the following channels, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ):

• Email: legal@planfly.com.tr (sending from the email address registered to your Planfly account makes identity verification easier)
• Mail: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86/2, 16335 Osmangazi, Bursa, Türkiye
• Phone (for information): +90 850 307 90 23

Your application must include your first and last name, your signature if the application is made in writing, your Turkish national ID number (for foreign nationals, nationality and passport or identity number), your residential or business address for notifications, your email address for notifications (if any), your phone number and the subject of your request.

These formal requirements apply to applications under the KVKK. If you are located outside Türkiye and make your application under the law of the place where you are located, no more information is requested than is necessary to verify your identity, and your application is concluded in accordance with the procedures and time limits described in the privacy notice for your region (Section 20 of the Privacy Policy) or in Section 21 of the Privacy Policy.

Your applications are concluded free of charge, as soon as possible depending on the nature of the request and within thirty days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. Additional information may be requested to verify your identity.

If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

If you are located in the European Economic Area, the United Kingdom or Switzerland, your right to lodge a complaint with the supervisory authority of your country is also reserved.

For your data relating to an appointment you made with a business, you must apply to the relevant business, which is the data controller. You can find the business's contact details on its booking page and in the business's privacy notice.

13. Additional Note on Businesses' Own Customers

Businesses that use Planfly have their own data protection obligations with respect to their own customers' appointment, communication, intake form, reminder, customer note and similar processes.

To make it easier for businesses to fulfill these obligations, Planfly provides each business with a privacy notice template generated with the business's own details and, if the business wishes, allows it to link to its own privacy notice. It is the business's responsibility to check whether the template matches its actual data processing activities and, where necessary, to prepare its own text.

For businesses outside Türkiye, the template provided is a privacy notice prepared under the law of the place where the business is located instead of the KVKK.

If you are booking an appointment with a business as an end user, the relevant business's privacy notice, privacy practices and communication channels should also be taken into account.

14. Final Provision

This Privacy Notice has been prepared to provide information about general data processing activities within Planfly. For more details, see the Privacy Policy and the Cookie Policy. Layered privacy notices or explicit consent texts may also be provided for specific modules, campaigns or processing that requires explicit consent.

This notice may be updated in line with legislative changes and developments in our services. The current text is always published on planfly.com.tr, on the KVKK Privacy Notice page.

This Privacy Notice is published in Turkish and English with the same content. For individuals located in Türkiye, the Turkish version is authoritative; for individuals located outside Türkiye, the English version is authoritative.