Randeu Privacy Policy and KVKK Disclosure Notice

This Privacy Policy and KVKK Disclosure Notice ("Policy") explains the principles governing the processing of personal data of individuals who use the Randeu website, mobile applications, and related services.

The data controller information under Law No. 6698 on the Protection of Personal Data ("KVKK") is as follows:

Name Surname / Sole Proprietor: Zeynel Özyaşar
Brand: Randeu
Address: KIRKKONAKLAR MAH. 329 CAD. PALA NO:12 İÇ KAPI NO:9 ÇANKAYA/ANKARA
Email: [email protected]
Telephone: +90 312 911 34 88
Website: www.randeu.com
Tax Office: Cumhuriyet Tax Office Directorate
Tax Identification Number (VKN): 7170221551

In this Policy, "Randeu," "we," or "data controller" refers to Zeynel Özyaşar.

This Policy covers:

• visitors to the www.randeu.com website,
• users who create a Randeu account or benefit from Randeu services,
• business owners and employees who use paid or free Randeu packages,
• individuals who communicate with us,
• other relevant persons participating in Randeu's promotion, support, sales, billing, and service processes.

As a rule, the relevant business using Randeu is the data controller for data it enters into the system about its customers, employees, or other third parties. Randeu may process such data as a data processor in accordance with the relevant business's instructions. These individuals may need to direct requests concerning their data first to the business from which they receive services.

During the use of Randeu services, the following categories of personal data may be processed depending on the nature of the service and the relevant person's relationship with Randeu:

3.1. Identity and profile information

Name, surname, user or business name, profile information, and other information optionally provided by the user.

3.2. Contact information

Email address, telephone number, address, and communication channels preferred by the user.

3.3. Account and transaction information

User account, subscription package, membership status, transaction history, subscription start and end dates, application preferences, and account settings.

3.4. Appointment and service information

Appointment date and time, appointment notes, service provided, personnel or resource selection, booking status, and related business-process information recorded by users in the Randeu system.

Users are expected not to enter sensitive personal data in appointment notes or free-text fields unless necessary to provide the service.

3.5. Finance and billing information

Billing information, tax information, purchased package, payment amount, and payment status. Where payment is made through an authorized payment institution or application store, credit or debit card information may be processed directly by the relevant payment service provider; Randeu may not have access to complete card information.

3.6. Transaction security and technical data

IP address, device and browser information, session records, date-time information, error logs, security records, cookie identifiers, and technical data concerning use of the service.

3.7. Request and communication information

Support requests, complaints, conversations, feedback, and the content of correspondence with us.

3.8. Marketing and preference information

Commercial electronic communication preferences, campaign interactions, and marketing analysis information where explicit consent has been given.

Personal data may be processed, where appropriate, for the following purposes:

• creating and managing user accounts,
• providing, operating, and personalizing Randeu services,
• providing appointment, calendar, customer, personnel, and notification features,
• conducting subscription, payment, cancellation, refund, and billing processes,
• performing identity and account verification,
• responding to user requests and support applications,
• ensuring system security and preventing misuse, unauthorized access, or fraud,
• conducting error detection, maintenance, updates, performance measurement, and service development,
• fulfilling legal obligations and responding to requests from authorized institutions,
• resolving disputes and establishing, exercising, or protecting rights,
• managing user preferences,
• conducting campaigns, promotions, and commercial electronic communication activities where the necessary permissions exist.

Personal data is processed in a manner connected with, limited to, and proportionate to the purposes stated here.

Personal data is processed on the basis of the applicable conditions specified in Articles 5 and, where necessary, 6 of the KVKK. The principal legal grounds are:

• processing being directly related to the establishment or performance of a contract,
• processing being mandatory for the data controller to fulfill a legal obligation,
• processing being mandatory for the establishment, exercise, or protection of a right,
• processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person,
• being expressly prescribed by law,
• having been made public by the relevant person,
• the explicit consent of the relevant person where required.

Consent given for processing based on explicit consent may be withdrawn at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Personal data may be collected through:

• membership, contact, appointment, payment, and other forms on the website and mobile applications,
• use of the user account and Randeu features,
• support, email, telephone, and other communication channels,
• cookies, logs, and similar technical tools,
• payment institutions and application stores,
• data entered into the system by businesses using Randeu,
• legally authorized public institutions and organizations,

by fully or partially automated means, or by non-automated means provided that they form part of a data recording system.

Personal data may be transferred to the following recipient groups, limited to the purposes of processing and provided that necessary security measures are taken:

• hosting, cloud computing, database, security, backup, and technical infrastructure providers,
• email, SMS, notification, and customer support service providers,
• payment institutions, banks, and application stores such as the Apple App Store and Google Play Store,
• accounting, financial advisory, legal, and audit service providers,
• analytics and performance measurement service providers,
• business partners and suppliers necessary for providing the service,
• public institutions and organizations authorized by law and judicial or administrative authorities.

Transfers are carried out in accordance with the conditions in Article 8 of the KVKK. Personal data is shared only to the extent required by the purpose of transfer.

Personal data may be transferred abroad where the infrastructure of cloud computing, application store, email, notification, analytics, or technical support services used by Randeu is located abroad.

Transfers abroad are carried out on the basis of an applicable adequacy decision, appropriate safeguards, or incidental transfer condition stipulated in Article 9 of the KVKK. Where necessary, standard contracts published by the Authority are used and relevant notification obligations are fulfilled.

Where a transfer is based on explicit consent, the user is separately informed before the transfer and their explicit consent is obtained.

Businesses using Randeu are responsible for lawfully obtaining personal data they enter into the system about their customers, employees, and other third parties; informing the relevant persons; obtaining explicit consent where necessary; and ensuring that legal conditions exist for transferring the data to the Randeu system.

Randeu processes such data within the framework of the relevant business's instructions, the service relationship between the parties, applicable legislation, and data-security obligations. Business users must not record unnecessary or unlawfully obtained personal data in the system.

Personal data is retained for the period required by the relevant processing purpose, taking into account limitation and retention periods prescribed by applicable legislation.

When determining the retention period, the following are considered:

• the duration of the service and subscription relationship,
• statutory periods prescribed for financial and commercial records,
• legal obligations and requests from authorized authorities,
• limitation periods relating to potential disputes,
• security, backup, and business-continuity requirements.

When the reasons requiring processing cease to exist, personal data is deleted, destroyed, or anonymized in accordance with legislation and Randeu's retention and disposal processes.

Randeu takes appropriate technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure that personal data is stored securely.

These measures may include restricting access authorizations, authentication, recording and monitoring, backups, security updates, encryption or similar protection methods, and security assessments of service providers.

It should be recognized that no method of transmitting or storing data over the internet can provide absolute security. Where a security incident is detected, the necessary actions are taken under applicable legislation.

Cookies and similar technologies may be used on the Randeu website and applications to operate the service, remember preferences, ensure security, measure performance, and, where the necessary permissions exist, for analytics or marketing purposes.

Non-essential cookies are activated according to the user's preference where required by applicable legislation. Detailed information about cookie types, providers, purposes, and retention periods is provided in the Randeu Cookie Policy.

Commercial electronic communications for marketing, campaign, and promotional purposes are sent on the basis of the user's prior consent where required by applicable legislation.

Users may change their commercial electronic communication preferences using the opt-out methods provided to them. Account, security, payment, invoice, subscription, and operational notifications required to provide the service may not constitute commercial electronic communications.

Under Article 11 of the KVKK, you have the right to apply to the data controller to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• know the third parties to whom your personal data is transferred domestically or abroad,
• request correction if your personal data has been processed incompletely or inaccurately,
• request deletion or destruction of your personal data under the conditions prescribed by the KVKK,
• request notification of correction, deletion, or destruction operations to third parties to whom the personal data has been transferred,
• object to a result arising against you through the analysis of processed data exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing of your personal data.

You may submit your applications under the KVKK using the following methods:

• Written application: KIRKKONAKLAR MAH. 329 CAD. PALA NO:12 İÇ KAPI NO:9 ÇANKAYA/ANKARA
• Email: [email protected]

Your application must include your name and surname, information used to verify that the application belongs to you, your contact details for notification, the subject of your request, and explanations relating to your request. Where necessary, information and documents supporting your request must also be attached.

Applications are concluded as soon as possible according to the nature of the request and within thirty days at the latest. If the process requires an additional cost, fees in the tariff determined by the Personal Data Protection Board may apply.

Applications relating to data entered into the system by a business using Randeu about its customers or employees may be directed to the relevant business acting as data controller.

Randeu services are not directed at children. If a business records appointment or service data concerning children in Randeu, that business is responsible for lawfully obtaining such data and carrying out the necessary information and permission processes.

Randeu may contain links to third-party websites, application stores, or services. The personal data processing activities of those third parties are subject to their own privacy policies. Randeu is not responsible for the independent data processing activities of third parties.

This Policy may be updated in line with changes to services, personal data processing activities, or legislation. The current text is published on www.randeu.com and the last-updated date at the beginning of the text is changed.

Where there are significant changes, users may also be notified through appropriate communication channels.

You may contact us with questions about this Policy or the processing of your personal data:

Zeynel Özyaşar / Randeu
Address: KIRKKONAKLAR MAH. 329 CAD. PALA NO:12 İÇ KAPI NO:9 ÇANKAYA/ANKARA
Email: [email protected]
Telephone: +90 312 911 34 88
Website: www.randeu.com

© 2023–2026 Randeu / Zeynel Özyaşar. All rights reserved.