This policy explains, as a whole, what data the Vesunil platform (the "Platform") holds, how it is protected, who it is shared with and how long it is kept. The KVKK notice for panel users' personal data is a separate document, and the processor undertaking for businesses' customer data is set out in the Data Processing Agreement.
Version: v2 · Last updated: 20 October 2026
The data controller for panel users' personal data is Büşra Uçar Sönmez, who operates the Platform (sole proprietorship, DualyxLabs brand). Details of the purposes, legal grounds and your rights are in the KVKK Privacy Notice. Terms such as "KVKK", "data controller" and "data processor" are defined at the start of the KVKK Privacy Notice.
1. Data layers on the Platform
The Platform is multi-tenant: all businesses share a single database, but every record carries a tenant identifier (businessId) and queries are constrained by it. We treat the data in three layers.
Platform data. Accounts, business records, roles, subscription and package information, order and payment records for package and SMS credit purchases and the buyer's invoice details (title, tax number and office, address, email, phone; card data is never processed or stored on the Platform, payment is made on iyzico's secure page), audit records, support records. In this layer the data controller is Büşra Uçar Sönmez (sole proprietorship, DualyxLabs brand).
Business data. The business's own operational records: services, working hours, expense categories, notification templates, documents and settings.
Customer data. Records about the business's own customers. In this layer the data controller is the business; the Platform Provider acts as a data processor and accesses this data only to provide the service, troubleshoot problems and carry out the business's instructions.
2. Data held in the customer layer
The customer records a business enters in the Panel may include: first name, last name, phone number, email address, date of birth, national identification number and free-text notes.
The national identification number field is optional. Free-text note fields are stored as the business fills them in; if special categories of personal data are entered into those fields, the resulting obligations belong to that business.
The following records are also kept against a customer record: appointments (date, time, service, provider, status, recurrence and notes), attendance status, manual payment records (amount, method, discount, notes), expenses, SMS, WhatsApp and email messages sent along with their delivery states, and post-appointment feedback and ratings.
Payment records in the customer layer record payments the business took physically from its customer; the Platform does not collect those payments. No card number, CVC or similar payment instrument data is processed in them. The package and SMS credit payments a business makes to the Platform Provider are separate and are covered under Platform data (see above).
When a customer list is bulk imported from an Excel file, the uploaded file is not stored permanently; once the import completes only the created customer records remain, and the operation is written to the audit record.
3. Technical and security data
Session records, sign-in and registration attempts, password reset requests, one-time sign-in codes and the IP addresses associated with them are kept to detect abuse and protect account security.
Every successful change made in the Panel is written to the in-business activity record. These records show which user performed which operation in which area, and a business admin can view them in the Panel. These records cannot be deleted from the Panel; retention periods are explained in Section 7 and in Section 9 of the KVKK Privacy Notice.
The Platform uses no advertising or tracking cookies and no third-party usage analytics service. The limited data held in the browser is described in the Cookies and Local Storage Notice.
4. Files and storage
Business documents and support attachments are stored privately and served only to authorised users. Logos and profile photos are served over a stable link so they can be displayed in the Panel; anyone who knows that link can reach the file. Confidential documents should therefore never be uploaded into the logo or profile photo fields.
Uploaded files are written to the Platform's own server rather than to a separate cloud storage service, so files sit with the same hosting provider as the database.
Each business has a storage quota and usage is visible in the Panel. Deleted files are first marked as deleted, then removed from storage.
5. Service providers
We share data only with the providers needed to run the service. Each is bound by contract and processes data only on our instructions.
- Hetzner — server and database hosting; region: [SERVER REGION].
- Cloudflare — bot protection on registration and sign-in forms (Turnstile).
- iyzico — taking payment for package and SMS credit purchases (licensed payment institution); the amount, the buyer's invoice details and the IP address are passed to it.
- İleti Merkezi, Verimor — SMS delivery (Türkiye).
- Meta Platforms — message delivery over the WhatsApp Cloud API.
- Email delivery infrastructure — verification, password reset, support and service messages.
This policy is updated when the provider list changes. We do not sell data to third parties for advertising. Section 7 of the KVKK Privacy Notice explains that data may be passed to the acquiring party in structural transactions such as a merger, demerger, acquisition or transfer of part of the business; such a transfer does not mean the data is being sold.
6. Transfers abroad
Because the servers and some providers are located outside Türkiye, transfers take place. These transfers are made in accordance with the conditions set out in KVKK Art. 9, relying on an adequacy decision, one of the appropriate safeguards (including standard contractual clauses) or one of the exceptions listed in the Law.
7. Retention and deletion
Personal data is kept for as long as necessary for the purpose for which it is processed and for the retention periods prescribed by the relevant legislation. When determining the retention period, we take into account the nature and sensitivity of the data, the risk of harm that could arise from unauthorised access or disclosure, whether the purpose of processing can be achieved by other means, the limitation periods under the Turkish Code of Obligations, and, where applicable, retention obligations arising from the Turkish Commercial Code and tax legislation. When the retention period ends or the purpose of processing no longer exists, the data is deleted, destroyed or anonymised. Where copies exist in backups, they are only stored, without being processed again, after the moment of deletion, and disappear once the backup cycle completes.
While the service relationship continues, data is kept in order to provide the service. Security records such as sessions, sign-in and registration attempts, one-time codes and password resets, as well as email delivery records, are cleaned up automatically at the end of the periods stated in Section 9 of the KVKK Privacy Notice. A business can delete its customer records, appointments, payments, expenses and files from the Panel at any time. When a customer record is deleted, the appointments, payments and notification records attached to that customer are deleted in the same operation. When a business is deleted, its order and payment records on the Platform are deleted too; official books and invoices are kept for 10 years in the Platform Provider's accounting records under Turkish Commercial Code Art. 82 and tax legislation.
Closing the whole account and deleting its data is requested as described in the Account and Data Deletion document. Records subject to a statutory retention obligation continue to be kept for the prescribed period.
8. Security measures
- Encryption in transit (TLS).
- Irreversible password storage and an enforced password policy.
- Provider credentials stored encrypted and masked in the interface.
- Tenant isolation enforced server-side; permission checks applied on the server independently of the interface.
- Session management, one-time sign-in codes and bot protection.
- Audit records and in-business activity records.
- Deployments made only from builds that passed verification.
9. Data breach notification
If unlawful access to personal data is identified, the Platform Provider takes the necessary technical measures. For Platform data, as data controller, it notifies the Personal Data Protection Board and the affected persons without delay under KVKK Art. 12(5). Where a breach affects the customer layer, the business acting as data controller is informed without delay; details are in Section 12 of the Data Processing Agreement.
10. Children's data
The Platform is a service for businesses and panel users are not expected to be under 18. If a business's customer records include minors, meeting the necessary consent and guardianship requirements is that business's responsibility.
11. Your rights
Your rights under KVKK Art. 11 (including requesting information, correction, deletion, objection and compensation), how to exercise them, the application route and the time limits for complaining to the Board are in Sections 11 and 12 of the KVKK Privacy Notice; the purposes and legal grounds of processing are in Sections 4 and 5 of the same notice. If you are a customer of a business, you should first direct your requests to the business you receive services from.
To withdraw your consent to commercial electronic messages, follow the route in the Commercial Electronic Messages and IYS Principles; consent to commercial messages and explicit consent under KVKK are separate concepts. Deleting the account and its data is described in the Account and Data Deletion document.
12. Changes and contact
This policy may be updated; the current version is published at this address. Material changes are announced by email to your registered email address. Send questions through the support screen in the Panel or using the contact details below.
Contact
- E-mail: info@vesunil.com
- Address: Mustafa Kemal Mah. Dumlupınar Bul. Tepe Prime C-Blok Kapı No: 71, Çankaya / Ankara, Türkiye
- KEP address: busra.ucarsonmez@hs01.kep.tr