This document sets out the rights and obligations under Article 12 of Personal Data Protection Law No. 6698 ("KVKK") between the business using the Vesunil platform (the "Platform") as the "Data Controller" and Büşra Uçar Sönmez (sole proprietorship, DualyxLabs brand) as the "Data Processor" or "Platform Provider", in respect of the personal data the business records on the Platform. It forms an integral part of the Terms of Use. In this document "the business" means the Data Controller, "the Board" means the Personal Data Protection Board and "the Authority" means the Personal Data Protection Authority; "data controller", "data processor" and "data subject" are used in the sense of KVKK Art. 3.
Version: v2 · Last updated: 20 October 2026
1. Determination of roles
For the customer, appointment, payment, expense, notification, feedback and document data a business records on the Platform, the business is the data controller. The business determines the purposes and means of processing.
The Platform Provider acts as the data processor for that data, solely on the business's instructions and within the framework of the Terms of Use. It does not use that data for its own purposes, does not sell it to third parties and does not expose it to another business.
Panel users' account data and the Platform's own security and audit records are not the subject of this Agreement; for those, the data controller is the Platform Provider and the KVKK Privacy Notice applies.
2. Subject matter, duration and nature of processing
- Subject matter: Providing the Platform's appointment, customer, payment, expense, reporting, messaging, file and support functions.
- Nature: Storing, displaying, editing, listing, reporting, exporting, using in message delivery and deleting the data.
- Duration: For as long as the business's service relationship continues and until the deletion processes set out in this Agreement are complete. Even if the service relationship ends, this Agreement remains in force for as long as the business's personal data is held by the Data Processor, including records kept because of a retention obligation or in backups.
3. Categories of data and groups of data subjects
Groups of data subjects: The business's customers, third parties requesting appointments, and the recipients to whom the business sends notifications.
Data categories:
- Identity data: first name, last name, date of birth and, optionally, the national identification number.
- Contact data: phone number, email address.
- Customer transaction data: appointments, service and provider assignment, attendance status, manual payment records, discounts, expenses.
- Communication history: SMS, WhatsApp and email messages sent, message content and delivery states.
- Feedback data: post-appointment ratings and comments.
- Free-text fields: customer notes, appointment notes, payment notes.
- Document data: documents uploaded by the business.
- Public online booking page data (where the business turns this feature on): the booking person's name, phone number, the SMS verification code sent to their phone (only its hash is stored), a keyed hash of their IP address and the time of their explicit consent. For this data the business is the data controller and the Platform Provider is the data processor.
Order, payment and invoice data relating to the payments a business makes to the Platform Provider for packages and SMS credit are outside this Agreement; the Platform Provider processes them as data controller, as described in the KVKK Privacy Notice.
4. Warning about special categories of personal data
The Platform provides no field dedicated to special categories of personal data (KVKK Art. 6). However, free-text areas such as customer notes, appointment notes and uploaded documents can technically hold special category data, including health data.
If special category data is entered into those areas, it is the business's responsibility to secure explicit consent or another condition provided in the Law, to take the adequate measures determined by the Board, and to provide the required notice. The Platform Provider does not inspect the content of these fields and assumes no responsibility arising from that content.
5. Warning about the national identification number
The national identification number field on a customer record is optional. This data should be processed only where it rests on a concrete purpose and legal ground; where it is not needed, the field should be left empty. The decision to fill in the field, and its consequences, belong to the business.
6. The Data Processor's obligations
The Platform Provider shall:
- Process personal data only to provide the service and in accordance with the business's instructions, and not go beyond those instructions.
- Take appropriate technical and administrative measures to prevent unlawful processing of and access to the data and to ensure its safekeeping. The measures taken are summarised in the Privacy Policy.
- Limit access to what a role requires, and place personnel with access under a confidentiality obligation; under KVKK Art. 12/4 this obligation continues after the duty or service relationship ends.
- Keep each business's data separate by tenant identifier and enforce authorisation checks server-side.
- Write Panel operations to audit and activity records.
- Assist the business, to a reasonable extent, in responding to data subject requests and in meeting its audit obligation under KVKK Art. 12.
- Enable the business to export its data from the Panel (Excel, CSV, PDF).
The business's instructions consist of this Agreement, the Terms of Use, operations carried out in the Panel, and written requests that an authorised representative of the business sends through the support screen or the contact channels in Section 16. If the Data Processor considers that an instruction violates legislation, it informs the business and may stop carrying out that instruction. Instructions that exceed the scope of the service or require changes to the Platform are agreed separately in writing.
The Data Processor does not use the business's personal data to train, develop or improve artificial intelligence or machine learning models, and does not allow sub-processors to do so. The Platform does not make decisions about data subjects that produce legal effects or significantly affect them solely by automated processing.
Under KVKK Art. 12/2 the Data Processor is jointly responsible with the business for taking the measures relating to data security.
7. Audit and information
The business may audit the Data Processor's compliance with its obligations under this Agreement, in order to fulfil its audit obligation under KVKK Art. 12/3, once a year and additionally whenever the Board or a competent authority requests it, on written request. Within its duty to assist under Section 6, the Data Processor provides the information and documents needed for this purpose. An on-site audit takes place only where that information and those documents are not sufficient and there is a suspected breach or a request from the Board.
An audit request is sent in writing at least two weeks in advance, stating its scope and date, and is carried out during working hours without unreasonably disrupting the Data Processor's activities. An audit may not extend to other businesses' data, the Data Processor's trade secrets, information that could reveal security vulnerabilities, or confidentiality obligations owed to third parties. The facilities of sub-processors are outside the scope of the audit; for them, the providers' own certificates and reports are made available. If a third party carries out the audit, that person must be independent, must not be a competitor of the Data Processor and must give a confidentiality undertaking. Audit costs, including the working time the Data Processor reasonably sets aside for the audit, are borne by the business.
8. The Data Controller's obligations
The business shall:
- Hold a valid legal ground for processing the personal data it records on the Platform and provide the required notice.
- Prepare its own privacy notice for its customers, obtain explicit consent where necessary, and retain those records.
- Manage panel users and their roles, and close the access of people who leave the business.
- Respond first-hand to applications received from data subjects.
- Meet consent and İYS obligations for commercial electronic messages. See the Commercial Electronic Messages and İYS document for detail.
- Consent, as informed under this Agreement, to the use of the sub-processors listed below.
9. Sub-processors
The following sub-processors are used to provide the service:
- Hetzner Online GmbH — server and database hosting. Region the server is located in: [SERVER REGION]. Files uploaded through the Panel are written to that same server, not to a separate storage service.
- Cloudflare — bot protection on registration and sign-in forms.
- İleti Merkezi and Verimor — SMS delivery (Türkiye).
- Meta Platforms — message delivery over the WhatsApp Cloud API.
- Email delivery infrastructure — verification, password reset and notification emails.
SMS and WhatsApp providers come into play only to the extent the business uses the relevant feature. Where the business configures its own provider account, it is responsible for its relationship with that provider.
This document is updated when the sub-processor list changes, and significant changes are communicated to the business's registered e-mail address. A business that objects to a change has the right to terminate the agreement.
10. Transfers abroad
Because hosting and some providers are located outside Türkiye, transfers take place. Transfers are made in line with KVKK Art. 9: to countries covered by an adequacy decision, or to recipients that provide the appropriate safeguards the Article sets out. Explicit consent is relied on only for incidental transfers; transfers needed for the basic operation of the service are not based on data subjects' explicit consent. A transfer is stated to rely on standard contractual clauses only after the contract has been notified to the Authority.
11. Data subject applications
If a data subject sends a request about their data to the Platform Provider, the request is not actioned; the data subject is directed to the business acting as data controller and the business is informed.
The business can satisfy access, correction, deletion and export requests itself through the Panel. Where a request cannot be satisfied from the Panel, technical assistance can be requested from the support screen.
12. Breach notification
For the purposes of this Agreement, a personal data breach is the unlawful acquisition, disclosure, alteration or loss of the business's data, or its exposure to unauthorised access, in systems under the Data Processor's control. Failed sign-in attempts and attack attempts that do not affect the security of the data are not breaches.
When the Platform Provider becomes aware of a personal data breach affecting the business's data, it informs the business without delay, so that the business can notify the Board within 72 hours, and shares what it knows about the nature of the breach, the categories of data affected and the number of data subjects, the measures taken and the measures it recommends the business take. This notice does not mean that the Platform Provider accepts fault or liability.
Notifying the Board and the data subjects is the obligation of the business as data controller, and the 72-hour period for notifying the Board runs, for the business as data controller, from when it becomes aware of the breach. The Platform Provider provides reasonable support in preparing those notifications. If the business needs to name the Platform Provider in a notice to the Board or to data subjects, it informs the Platform Provider beforehand where possible.
13. Return and deletion of data
When the service relationship ends, the business can export its data through the Panel. Closing the account and deleting the data is carried out within the periods and by the means described in the Account and Data Deletion document.
Upon a deletion request, the business's data is deleted or anonymised, subject to retention obligations arising from legislation; copies in backups disappear once the backup cycle completes.
14. Liability and order of precedence
If this Agreement and the Terms of Use conflict on the processing of personal data, this Agreement prevails. The Data Processor's liability under this Agreement is subject to the limitations in the "Limitation of liability" section of the Terms of Use. Cases of intent and gross negligence, and liabilities arising from KVKK and related legislation that cannot be limited by contract, fall outside that limitation.
15. Changes
This Agreement may be updated, for example to adapt to changes in legislation, Board decisions, the sub-processor list or the scope of the service. The current version is published at this address.
Except for changes that legislation or Board decisions require, an update may not significantly reduce the level of protection of personal data or significantly increase the business's obligations. Significant changes are announced to the business's registered e-mail address at least 30 days before they take effect; changes required by legislation may take effect immediately. If the business does not accept a change, it may terminate the service relationship and export its data under Section 13.
16. Contact
For questions and requests about data processing:
- E-mail: info@vesunil.com
- Address: Mustafa Kemal Mah. Dumlupınar Bul. Tepe Prime C-Blok Kapı No: 71, Çankaya / Ankara, Türkiye
- KEP address: busra.ucarsonmez@hs01.kep.tr