PLANIRO.ME PRIVACY POLICY AND KVKK INFORMATION NOTICE
Effective date: 16 September 2026
Last updated: 16 September 2026
Version: 1.0
1. INTRODUCTION
This notice has been prepared to fulfil the obligation to inform under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") regarding the personal data processed through the Planiro.me mobile application and web panels (the "App"). It also satisfies the privacy policy requirement of the app stores.
2. DATA CONTROLLER
Planiro.me Email: kvkk@planiro.me
The data controller is the person who operates the Planiro.me application. The identity and contact details of the data controller will be provided to you upon request via the email address above.
In this notice, "we", "us" and "Planiro.me" refer to the data controller above.
3. AN IMPORTANT DISTINCTION: WHO IS RESPONSIBLE FOR WHICH DATA
Planiro.me acts in two different capacities. Which role we have depends on whose data it is:
3.1. Where we are the DATA CONTROLLER When you sign up for the App of your own free will (account creation, login, profile, session and security records, support requests you send us, your in-app notification preferences), we are the data controller of that data.
3.2. Where we are the DATA PROCESSOR When a facility, business or service provider enters records about its own customers into the App (customer card, appointment history, package/credit records, customer notes, messages sent), the relevant business is the DATA CONTROLLER of that data. Planiro.me only hosts and processes this data on the business's instructions; it does not use this data for its own purposes, sell it, or disclose it to third parties for marketing purposes.
If you have a request about a record a business holds about you (erasure, correction, information), you should first contact the relevant business. If you contact us, we will forward your request to the relevant business.
4. PERSONAL DATA WE PROCESS
4.1. Identity data First name, last name, date of birth, gender (optional), organisation/business name.
4.2. Contact data Phone number, email address, address, province, district. For business accounts, corporate contact details.
4.3. Account and transaction security data Password (stored only in an irreversibly hashed form), verification code (OTP) records and attempt counts, session records, device ID, operating system/platform information, push notification token, IP address, browser/app information (user agent), activity history records (audit log).
4.4. Service and customer transaction data Appointment/reservation records (date, time, service, service provider, status, notes), package and credit records, payment status information (amount/status — NOT card details), attendance/no-show information, waiting list records, favourites.
4.5. Content data Messages sent within the App, message templates, survey responses, ratings and reviews, customer notes entered by the service provider, profile description (bio), profile photo.
4.6. Location data The business/service location address and the map coordinates derived from it. The App does not track your device's real-time location in the background.
4.7. Consent and permission data (KVKK proof records) Acceptance of the Terms of Use and Privacy Policy; your communication channel preferences (SMS, email, WhatsApp, Telegram, push notification, phone call) and the date and time these preferences were recorded; technical information at the moment of consent (IP, device, browser, time zone) and a screenshot of the consent screen. These records are kept solely to prove that consent was given.
4.8. Optional data that may be associated with health The "weight" field, intended for sports/fitness use, is optional. If you fill it in, the data is processed based on your explicit consent, and you may delete it at any time. The App is not designed for entering health data such as illnesses, diagnoses, medication or disabilities, and entering such data in free-text fields is prohibited.
4.9. Data we do not collect We do not collect credit/debit card details, Turkish national ID numbers, biometric data, criminal record data, continuous device location tracking, or your contacts or photo gallery (other than the image you select). No advertising identifier is used, and no profiling for advertising purposes or third-party ad tracking is carried out.
5. HOW WE COLLECT DATA
Personal data is collected, by fully or partly automated means, from the information you enter into the App, through sign-up and login, from technical records generated automatically while you use the App, through the business/service provider that adds you to the App, and via invitation/confirmation links.
6. PURPOSES OF PROCESSING
•Creating your account, verifying your identity by phone/email and providing secure login,
•Providing appointment, calendar, package and customer management features,
•Sending appointment confirmation, reminder, change and cancellation notifications,
•Responding to requests, complaints and support enquiries,
•Keeping accounts secure and preventing unauthorised access, fraud and misuse,
•Keeping activity history (logs) and providing evidence in the event of a dispute,
•Fixing bugs and improving the App (on an aggregated/statistical basis),
•Sending informational and promotional messages, if you have given permission,
•Meeting legal obligations and responding to requests from competent authorities.
7. LEGAL GROUNDS (KVKK Art. 5)
•Necessity for the conclusion or performance of a contract (Art. 5/2-c): account creation, appointment and service management, mandatory service-related notifications.
•Compliance with a legal obligation (Art. 5/2-ç): retention of transaction and message records, responding to data subject requests, requests from competent authorities.
•Establishment, exercise or protection of a right (Art. 5/2-e): consent records, log records, evidence in the event of a dispute.
•Legitimate interest (Art. 5/2-f): security, prevention of misuse and fake accounts, measuring and improving service quality.
•Explicit consent (Art. 5/1): commercial informational/promotional messages, optional profile fields (such as weight) and other cases where the law requires explicit consent.
You may withdraw your consent to processing based on explicit consent at any time; withdrawal does not affect the lawfulness of processing carried out before that date.
8. PARTIES TO WHOM DATA IS TRANSFERRED
8.1. Domestic transfers
•The facilities, businesses and service providers you are a member of or book appointments with — only within the scope of their own customers/records,
•Competent public authorities and judicial bodies, upon request,
•Our legal, financial and technical advisers (under a duty of confidentiality).
Your personal data is not sold or rented to third parties for advertising/marketing purposes.
8.2. International transfers The infrastructure and communication services we use to run the App are obtained from providers located outside Turkey. As a result, your personal data is transferred abroad in connection with the following services:
•Hetzner Online GmbH (Germany) — server and database hosting (the primary location where data is stored),
•Twilio Inc. (USA/Ireland) — SMS delivery, phone verification (OTP) and WhatsApp messages,
•Resend (USA) — email delivery,
•Apple Inc. (USA) — app distribution, push notifications (APNs) and, where applicable, in-app purchases,
•Expo (USA) — push notification delivery service,
•Google LLC (USA) — address search/map services (address information is queried),
•Cloudflare Inc. (USA) — domain management and email forwarding,
•Vercel Inc. (USA) — hosting of the planiro.me promotional website,
•Telegram Messenger — message delivery, only if you have linked the Telegram channel yourself.
These transfers are made under KVKK Art. 9, on the grounds that they are necessary for providing the service and performing our contract with you, and/or based on your explicit consent. Data processing/confidentiality commitments are in place with these providers, and the standard contract procedures required by law are followed.
9. RETENTION PERIODS
•Account and profile data: for as long as the account is open; deleted or anonymised within 6 months of the account being closed.
•Appointment, package and customer records (kept on behalf of a business): in line with the relevant business's instructions; deleted or handed over to the business within 6 months of the business ceasing to use the App.
•Verification code (OTP) records: 1 year.
•Session, device and activity history (log/IP) records: 2 years.
•Commercial electronic message consents and delivery records: 1 year from the end of the consent's validity/the creation of the record, as required by the relevant legislation; where needed as evidence, consent records may be kept for the general statute of limitations period.
•Consent proof records and consent screenshots: up to 10 years from the withdrawal of consent.
•Support correspondence: 2 years from the closure of the request.
If the law requires a longer retention period, or if there is an ongoing legal dispute, the relevant data will be kept for that period.
10. ACCOUNT AND DATA DELETION
10.1. You can close your account within the App via Settings > Account > Delete Account. You can also submit a request by writing to kvkk@planiro.me.
10.2. When you request account deletion, your identity/contact data and profile information are deleted or anonymised.
10.3. The following data may be kept for a certain period even after your account is deleted:
•Transaction and message records that must be kept by law,
•Consent proof records,
•Appointment/package records relating to your service relationship that a business holds as data controller (deletion of these records must be requested from the relevant business),
•Records subject to an ongoing dispute or security breach investigation.
10.4. Deleting your account does not cancel any financial obligations you have towards the relevant business.
11. DATA SECURITY
The main technical and administrative measures we take:
•Encryption of all data traffic with HTTPS/TLS,
•Storing passwords hashed with an irreversible algorithm; no plain-text passwords are kept,
•Identity verification via phone verification (OTP), with attempt limits and short code validity,
•One session per device and automatic session termination after inactivity,
•Role- and permission-based access control, so each user sees only the data within their authorised scope,
•The database is accessible only from the application server and is closed to outside access,
•Monitoring of access and changes through activity history (audit log) records,
•Rate limiting and abuse prevention mechanisms,
•Keeping the number of people with access to data processing to a minimum, under a duty of confidentiality.
No system is 100% secure. If we discover that personal data has been accessed unlawfully, the data subjects concerned and the Turkish Personal Data Protection Board will be notified as soon as possible, in accordance with KVKK Art. 12/5.
12. COOKIES AND SIMILAR TECHNOLOGIES
12.1. The mobile app does not use advertising cookies or third-party tracking technologies. The credentials needed to keep you signed in (session token) are stored in your device's secure storage.
12.2. The web panels (panel.planiro.me) use only cookies that are strictly necessary for maintaining the session and for security.
12.3. The promotional website (planiro.me) uses no marketing cookies, only strictly necessary cookies.
13. NOTIFICATIONS AND COMMUNICATION PERMISSIONS
13.1. Notifications that are required for the service to work (verification codes, appointment confirmation/cancellation/reminders, security alerts) are sent as part of performing the contract and cannot be turned off completely.
13.2. Promotional and informational messages are sent only through the channels you have allowed. You can view your permissions under Profile > Communication Channels, and change them or turn them all off at any time.
13.3. For messages a business sends you, the channels that can be used are limited to those that are both enabled by the business and allowed by you. No message is sent through any channel you have not allowed.
13.4. You can also turn off push notifications in your device's operating system settings.
14. CHILDREN'S DATA
14.1. The App is not designed for children under 13; we do not knowingly collect data from this age group.
14.2. Users aged 13 to 18 must use the App with the consent of a parent/legal guardian.
14.3. If we learn that a child's data has been processed without parental consent, we will delete that data without delay. To notify us of such a case: kvkk@planiro.me
15. YOUR RIGHTS UNDER KVKK ART. 11
Regarding your personal data, you have the right to:
•Find out whether your personal data is being processed,
•Request information about it, if it has been processed,
•Find out the purpose of processing and whether the data is being used for that purpose,
•Know the third parties in Turkey or abroad to whom the data has been transferred,
•Request correction if the data has been processed incompletely or inaccurately,
•Request erasure or destruction of the data under the conditions set out in KVKK Art. 7,
•Request that third parties to whom the data has been transferred be notified of any correction, erasure or destruction,
•Object to a decision against you that results solely from analysis by automated systems,
•Claim compensation if you suffer damage because of unlawful processing.
16. HOW TO APPLY
16.1. You can submit your requests, in line with the "Communiqué on the Procedures and Principles for Applications to the Data Controller", by:
•Email: kvkk@planiro.me — please send it from the email address registered in the App; your identity is verified this way.
•Email signed with a secure electronic signature or mobile signature.
Your application must clearly include your full name, contact details and the subject of your request.
16.2. Depending on the nature of the request, your application will be concluded free of charge within thirty (30) days at the latest. If the process involves an additional cost, a fee may be charged according to the tariff set by the Board.
16.3. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty (30) days of learning of the response, and in any case within sixty (60) days of the application date.
17. CHANGES TO THIS POLICY
This Privacy Policy may be updated. Material changes will be announced within the App before they take effect, and your consent will be obtained again where necessary. You can always find the latest version of this notice within the App (Settings > Legal).
18. CONTACT
Planiro.me Email: kvkk@planiro.me