Avis sur les données personnelles (KVKK)

1. Data controller

Your personal data is processed by Mehmet KIYAK, registered at Karacaahmet Mah. 38008 Nolu Cad. No:17/B İç Kapı No:10, Şehitkamil, Gaziantep, Turkey, tax office Şehitkamil, tax number 5590769167 (“3 Numara” or the “Company”) as data controller.

2. Personal data we process

• Identity: first and last name.
• Contact: phone number, email address, business address.
• Customer transactions: business (salon) name, subscription plan, payment and invoice records, support requests and correspondence.
• Financial: billing details, payment amount and result. The Company never sees or stores your full card number; card data is processed by the licensed payment institution iyzico.
• Transaction security: IP address, session and login records, device and browser details.
• Marketing: campaign and announcement preferences, only with your explicit consent.

3. Purposes of processing

• Creating your account, managing it and providing the service,
• Handling subscriptions, payments, invoicing and refunds,
• Answering support requests and sending service-related notices,
• Ensuring information security and preventing abuse and fraud,
• Complying with legal obligations (tax, commercial and e-commerce law) and responding to competent authorities,
• Protecting our rights in legal disputes,
• Informing you about offers and news, if you have given explicit consent.

4. Legal grounds

Under KVKK Article 5/2, your data is processed because it is necessary for the conclusion or performance of a contract (c), for compliance with a legal obligation (ç), for the establishment, exercise or protection of a right (e), and for the Company’s legitimate interests provided that your fundamental rights are not harmed (f). Your explicit consent under Article 5/1 is requested for marketing messages and for cross-border transfers that require consent.

5. How we collect data

Your data is collected electronically, by fully or partly automated means, through forms on the website, during sign-up and use of the mobile apps and web panel, via iyzico during payment, and in support conversations by email and WhatsApp.

6. Transfers

Within the limits of the purposes above and in line with KVKK Articles 8 and 9, your data may be shared with:

• Our payment service provider (iyzico Ödeme Hizmetleri A.Ş.) and banks,
• Providers of hosting, database, email and messaging infrastructure (Meta Platforms for WhatsApp messages),
• Accounting, e-invoicing and legal advisory partners,
• Competent public authorities and courts, upon request.

Some of our infrastructure providers operate servers outside Turkey. These transfers are made with appropriate safeguards such as standard contracts under KVKK Article 9 or, where these are not available, on the basis of your explicit consent.

7. Data of salon clients

For data that businesses using 3 Numara record about their own clients (names, phone numbers, appointment and payment history), the business is the data controller. The Company processes this data as a “data processor” only on the business’s instructions and to provide the service. Requests about such data should first be directed to the relevant business.

8. Your rights

Under KVKK Article 11 you have the right to learn whether your data is processed and request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction under Article 7 and notification of these actions to third parties; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

9. How to apply

You can send requests about your rights from your registered email address to [email protected], or in writing to Karacaahmet Mah. 38008 Nolu Cad. No:17/B İç Kapı No:10, Şehitkamil, Gaziantep, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee set by the Personal Data Protection Board may apply.