This notice explains how the personal data of people who open an account on and use the Vesunil platform (the "Platform") is processed, in accordance with Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
Version: v2 · Last updated: 20 October 2026
For a detailed account of the data and how it is protected, see also the Privacy Policy.
The key terms used in this notice mean the following under KVKK Art. 3:
- Personal data: Any information relating to an identified or identifiable natural person.
- Processing: Any operation performed on data, such as obtaining, recording, storing, transferring or deleting it.
- Data controller: The person who determines the purposes and means of processing and is responsible for establishing and managing the data filing system.
- Data processor: The person who processes personal data on behalf of the data controller, based on the authority given by the controller. The Platform Provider is a data processor for businesses' customer data (Section 2).
- Data subject: The person whose personal data is processed, that is, you.
- Explicit consent: Consent relating to a specific matter, based on information and given freely.
- Board: The Personal Data Protection Board.
- Platform Provider: The data controller identified in Section 1.
1. Identity of the data controller
- Data controller: Büşra Uçar Sönmez (sole proprietorship, DualyxLabs brand)
- Address: Mustafa Kemal Mah. Dumlupınar Bul. Tepe Prime C-Blok Kapı No: 71, Çankaya / Ankara, Türkiye
- Tax office / number: Maltepe Tax Office / 8830642472
- E-mail: info@vesunil.com
- KEP address: busra.ucarsonmez@hs01.kep.tr
2. Scope of this notice and the separation of roles
The Platform is a multi-tenant business service on which businesses manage their own appointment and customer operations. There are therefore two separate processing relationships:
- Panel users' data: For the account and usage data of the people who sign in on behalf of a business (business admins, providers), the data controller is the Platform Provider. This notice describes that relationship.
- The business's customers' data: For the customer, appointment, payment and communication data a business records on the Platform, the data controller is that business; the Platform Provider acts only as a data processor. That relationship is set out in the Data Processing Agreement. If you are a customer of a business, address requests about your data to the business you received service from.
3. Personal data processed
Identity and contact data: Full name, email address, phone number, date of birth where provided, profile photo, language and time zone preference.
Business information: Business name, address, phone number, owner name, tax number and tax office, logo. For a sole trader this information may itself constitute personal data.
Account security data: The irreversibly hashed form of the password, email verification and password reset records, one-time sign-in codes, session records, sign-in attempts and registration attempts, and the IP address associated with those records.
Usage and transaction security data: Audit records of operations performed in the Panel (who, when, on which record), in-business change records, application version and error logs.
Support data: Support requests and feedback submitted, their attachments and the correspondence on them.
Contract and subscription data: Trial and package start/end dates, assigned feature entitlements, storage usage, and the version and time of acceptance of the terms of use.
Payment and invoice data: When a business administrator buys a package or SMS credit, the order and payment record (package or credit, amount, currency, status, payment institution reference, fraud-check result, discount code if any) and the buyer's invoice details (title, tax number and tax office, address, email, phone). The client's IP address is passed to the payment institution during payment. Card number, CVC and expiry date are not processed or stored on the Platform; card details are entered only on the payment institution's secure page.
Public online booking page: When a business turns the online booking feature on, the booking person's name, phone number, the SMS verification code sent to their phone (only its hash is stored), a keyed hash of their IP address (not the address itself) and the time of their explicit consent are processed. For this data the business is the data controller and the Platform Provider is the data processor. The feature is off by default.
4. Purposes of processing
- Creating the account, verifying the email address and authenticating the user.
- Taking payment for package and SMS credit purchases, confirming the order and crediting it to the account, invoicing and keeping accounting records.
- Providing the service, operating the business panel and managing roles and permissions.
- Establishing and performing the agreement, tracking trial and package entitlements.
- Ensuring information security, preventing unauthorised access and abuse, and maintaining an audit trail.
- Handling support requests and feedback.
- Delivering mandatory service messages (verification, password reset, security and service announcements).
- Meeting legal obligations and exercising the right of defence in disputes.
5. Legal grounds for processing
- KVKK Art. 5/2-c (performance of a contract): Account and business records, role and permission management, subscription and package tracking, mandatory service messages; taking and crediting the payment for a purchase order.
- KVKK Art. 5/2-ç (legal obligation): Retention and notification duties required by law; keeping invoice and accounting records.
- KVKK Art. 5/2-e (establishment, exercise or protection of a right): The version and time record of accepted terms, audit records, defence in disputes.
- KVKK Art. 5/2-f (legitimate interest): Information security, prevention of abuse and automated attacks, service continuity and fault diagnosis; fraud checks on payments.
Where processing relies on explicit consent (KVKK Art. 5/1), that is stated separately and the consent can be withdrawn at any time. Consent to commercial electronic messages and this explicit consent are separate concepts; withdrawing consent to commercial messages is described in the Commercial Electronic Messages and IYS Principles.
6. Method of collection
Data is collected through registration and sign-in forms, fields filled in within the Panel, the support screen, email correspondence, and records kept automatically by the Platform and its infrastructure components, by partly automated or automated means.
Data about staff and provider accounts, such as full name and email address, is mostly obtained not from you but from the business administrator who opens the account; the administrator also sets the initial password. The full name, email, password and role fields requested when an account is created are mandatory for providing the service; if they are not provided, the account cannot be opened or the Panel cannot be used. Filling in other fields, such as phone, date of birth, time zone and language, is optional.
7. Recipients of personal data and purposes of transfer
Under KVKK Art. 8, your data is transferred only to the extent necessary to operate the service, for the following purposes:
- Hosting and database provider: Running the Platform and the database (servers are hosted on Hetzner infrastructure).
- Email delivery infrastructure: Sending verification, password reset, support and service messages.
- Bot protection provider (Cloudflare Turnstile): Preventing automated attacks on the registration and sign-in forms. Your IP address and browser signals are passed to the provider for this purpose.
- Payment institution (iyzico): Taking payment for package and SMS credit purchases. The order amount, the buyer's invoice details and the client IP address are passed to it; card details are entered directly with iyzico on its secure page and do not reach the Platform Provider. iyzico is a licensed payment institution.
- SMS and WhatsApp providers: Delivering messages where the business uses the messaging feature.
- Authorised public authorities and judicial bodies: Meeting requests and obligations arising from legislation.
- Legal and financial advisors and auditors: Fulfilling obligations and protecting rights.
Your personal data is not sold or transferred to third parties for advertising or marketing purposes; the structural transactions below are not treated as such.
If the Platform Provider becomes subject to a structural transaction such as a merger, demerger, acquisition or transfer of part of the business, your data may be transferred to the acquiring party and its advisors to the extent the transaction requires. In a merger or demerger, succession arises by operation of law; in other transfers, the transfer is made under KVKK Art. 5/2-f (legitimate interest) and Art. 8. The acquiring party is placed under a confidentiality obligation before the transaction, and the data is transferred subject to the commitments in this document on purposes, retention and your rights. Such a transfer does not mean the data is being sold for advertising or marketing purposes.
8. Transfers abroad
Some of the service providers used have servers outside Türkiye. The Platform's servers are hosted on Hetzner infrastructure, in the [SERVER REGION] region; bot protection runs on Cloudflare and WhatsApp messages run over Meta infrastructure.
These transfers are carried out in accordance with the conditions set out in KVKK Art. 9, relying on an adequacy decision, one of the appropriate safeguards (including standard contractual clauses) or one of the exceptions listed in the Law. Transfers based on standard contractual clauses are notified to the Personal Data Protection Authority.
9. Retention periods
- Account and business records: For as long as the service relationship continues.
- Ended sessions, sign-in and registration attempts, one-time sign-in codes: 30 days for security purposes; records older than 30 days are deleted by a daily cleanup job.
- Email delivery records: 90 days; records older than 90 days are deleted by a daily cleanup job.
- Order, payment and invoice records: Official books and invoices are kept for 10 years in the Platform Provider's accounting records under Turkish Commercial Code Art. 82 and tax legislation (VUK). The order and payment records on the Platform are deleted together with the business when it is deleted.
- Audit and in-business change records: For the duration of the service relationship and thereafter for the limitation period prescribed by law, to evidence the account's legal history. When a business is deleted, its registration audit record (email address, business name, time and version of accepted terms) remains, with the link to the business removed.
- Support records and attachments: For as long as needed to handle the request and, after that, only within the limitation periods for disputes; then deleted or anonymised.
- Verification and password reset records: Become unusable once their short validity expires; records older than 30 days are deleted by a daily cleanup job.
When determining the retention period, we take into account the nature and sensitivity of the data, the risk of harm that could arise from unauthorised access or disclosure, whether the purpose of processing can be achieved by other means, the limitation periods under the Turkish Code of Obligations, and, where applicable, retention obligations arising from the Turkish Commercial Code and tax legislation. When the retention period ends or the purpose of processing no longer exists, the data is deleted, destroyed or anonymised. Where copies exist in backups, they are only stored, without being processed again, after the moment of deletion, and disappear once the backup cycle completes.
When the service relationship ends, data is deleted or anonymised within the periods described in the Account and Data Deletion document, subject to retention obligations arising from legislation.
10. Data security
Data is encrypted in transit. Passwords are stored irreversibly. Provider credentials are held encrypted and masked in the interface. Each business's data is separated by a tenant identifier (businessId) and authorisation checks are enforced server-side. Access rights are limited to what a role requires, and Panel operations are written to audit records.
11. Your rights as a data subject
Under KVKK Art. 11 you have the right to:
- learn whether your personal data is being processed;
- request information if it has been processed;
- learn the purpose of processing and whether the data is used in line with that purpose;
- know the third parties to whom the data is transferred in Türkiye or abroad;
- request correction of incomplete or inaccurate data;
- request erasure or destruction within the conditions set out in the Law;
- request that correction and erasure be notified to third parties to whom the data was transferred;
- object to an adverse outcome arising from analysis carried out solely by automated systems;
- claim compensation if you suffer loss due to unlawful processing.
12. How to submit a request
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:
- from the support screen in the Panel,
- to info@vesunil.com from the email address registered in the system,
- in writing with a wet signature to Mustafa Kemal Mah. Dumlupınar Bul. Tepe Prime C-Blok Kapı No: 71, Çankaya / Ankara, Türkiye,
- to the registered e-mail address busra.ucarsonmez@hs01.kep.tr with a secure electronic signature.
Your application must include your full name; your signature if it is in writing; your national identification number (passport number for foreign nationals); your address for notification; your email address and phone number if any; and the subject of your request. Requests are concluded free of charge as soon as possible and in any event within 30 days; where the process entails an additional cost, the fee in the tariff set by the Board may be charged (KVKK Art. 13). If we refuse your application in whole or in part, we give our reasons in writing or electronically.
To verify that the applicant is the data subject, for applications made from the email address registered in the system we may ask for additional information; if your identity cannot be verified, the application cannot be processed. If you apply through a representative, a special power of attorney (notarised) is required; for persons under custody or guardianship, a custody/guardianship document is required. We provide the reasons for our response to your application in writing or electronically.
If your application is refused, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response (or, if no response was given in time, of the end of the response period) and in any case within 60 days of the application date (KVKK Art. 14). To complain to the Board you must first apply to us.
13. Changes
This notice may be updated. The current version is always published at this address with its version number and last-updated date. Significant changes are announced by email to your registered email address.
14. Contact
- E-mail: info@vesunil.com
- Address: Mustafa Kemal Mah. Dumlupınar Bul. Tepe Prime C-Blok Kapı No: 71, Çankaya / Ankara, Türkiye
- KEP address: busra.ucarsonmez@hs01.kep.tr