KVKK Privacy Notice

VAYABO PLATFORM USERS

KVKK Privacy Notice (“Notice”)

Last updated: July 22, 2025

In accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the “Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform,” DMY Teknoloji ve Pazarlama Anonim Şirketi (“Vayabo” or “Company”), in its capacity as data controller, has prepared this KVKK Privacy Notice to inform its users and content creators (“Creator” and/or “Content Creator”) regarding the processing of personal data obtained within the scope of services offered through the Vayabo mobile application and website (www.vayabo.com).

Since platform users can also be  sellers (Creators), and content creators can also be platform users and buyers, data processing activities related to the relevant individuals are explained separately but interdependently within this text.

The general principles and rules regarding the processing of personal data are detailed in the Company’s Privacy and Cookie Policy documents. This Notice should be evaluated as a whole with these documents.

 

1. WHICH OF YOUR PERSONAL DATA IS PROCESSED?

a) General Users and Buyers:

  • Identity Information: (Name, Surname, username)
  • Contact Information: (Email address, associated social media accounts, phone number, address)
  • Account Information: (Password, login method, membership status, username, profile photo, profile descriptions)
  • Customer Transaction Information: (Purchased product/service, payment status, order history, billing information, information regarding the payment instrument used, information regarding blocked accounts)
  • Request/Complaint Information and Communication Records: (Your voice in visual and audio recording categories and your preferences based on directions)
  • Location Information: (Via device settings, with explicit consent)
  • Device and Application Usage Information: (From your transaction security data; IP, transaction time, device type, browse history, login information, and other favorite additions, comments.)
  • Legal Process Information: (Information in correspondence with authorized persons, institutions, and organizations, information in litigation and enforcement files, your legal information request information; information regarding your preferences in contracts and consent texts)
  • Marketing Data: (User experience data, usage information collected via cookies, viewing frequencies, click-through rates, purchase and return rates, communication data processed for electronic commercial communication processes (phone number, email address, preference data, interaction data), comments on content, preferred content types, and other data for measuring the effectiveness of marketing strategies)

b) Seller-Users/Content Creators (“Creators”): In addition to the user data listed above:

  • Tax Identification Number, Turkish ID Number (if the creator is a real person)
  • Personal data contained in the identity document, if required for identity verification processes
  • Trade Name, Tax Office, MERSIS No (if a legal entity)
  • IBAN and payment information
  • Social media profiles, past experience information, resume content
  • Content/product/service information (tour content, route, consultancy text.)
  • Revenue information and transaction movements
  • Platform performance information (views, sales, return rate, comments)

 

2. FOR WHAT PURPOSES, BY WHAT METHODS, AND ON WHAT LEGAL GROUNDS IS YOUR PERSONAL DATA PROCESSED?

Your personal data is processed in accordance with the personal data processing conditions specified in Articles 5 and 6 of the KVKK, and is obtained and processed electronically through automated means (platform membership, transactions via mobile application and website, application forms, information and documents transmitted to the Company via notifications and/or other means, user activity records). The processing purposes and their legal grounds are categorized below:

a) General Users and Buyers:

  • Execution of membership procedures and management of user accounts: (KVKK Art. 5/2-c – [Processing of personal data is necessary for the conclusion or performance of a contract.])
  • Receiving orders, making content accessible, performance of service: (KVKK Art. 5/2-c – [Processing of personal data is necessary for the conclusion or performance of a contract.])
  • Execution of payment and invoicing processes: (KVKK Art. 5/2-ç – [Processing of personal data is mandatory for the data controller to fulfill its legal obligations.])
  • Management of requests and complaints: (KVKK Art. 5/2-f – [Processing of personal data is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.])
  • Improvement of user experience, statistical analysis: (KVKK Art. 5/2-f – [Processing of personal data is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.])
  • Processing of location information: (KVKK Art. 5/1 – [Explicit consent of the data subject.])
  • Processing of marketing data: (KVKK Art. 5/1 – [Explicit consent of the data subject.])

Your communication data processed for sending electronic commercial communications will be considered under the marketing data category, and your explicit consent will be sought for the personal data processed in these processes.

b) Creators:

  • Execution and evaluation of the Creator application process: (KVKK Art. 5/2-c – [Processing of personal data is necessary for the conclusion or performance of a contract.])
  • Establishment and performance of the contract with the Creator: (KVKK Art. 5/2-c – [Processing of personal data is necessary for the conclusion or performance of a contract.])
  • Fulfillment of tax obligations: (KVKK Art. 5/2-ç – [Processing of personal data is mandatory for the data controller to fulfill its legal obligations.])
  • Publishing content, making payments, managing return and complaint processes: (KVKK Art. 5/2-c – [Processing of personal data is necessary for the conclusion or performance of a contract.])
  • Performance analyses and statistical reporting: (KVKK Art. 5/2-f – [Processing of personal data is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.])
  • Collection of social media information and experience information: (KVKK Art. 5/1 – [Explicit consent of the data subject.])

 

3. TO WHOM AND FOR WHAT PURPOSES IS YOUR PERSONAL DATA TRANSFERRED?

Your personal data is transferred to the recipient groups listed below for the specified purposes:

  • Payment Institutions (PayTR, Apple Store, etc.): For conducting payment and refund transactions.
  • Cloud Server Service Providers: For hosting and maintaining the service (AWS, Turkey-based providers).
  • Content Creators (Sellers): For communication with the buyer and performance of the service.
  • Support Service Providers: For conducting user support and operational processes, planning electronic commercial communication delivery and legally compliant organizational processes.
  • Authorized Public Institutions: For fulfilling audit, notification, and legal obligations arising from legislation.

 

4. TRANSFER OF YOUR PERSONAL DATA ABROAD

Although the company from which we receive server services is a Turkey-based cloud service provider, it uses Amazon Web Services (AWS) infrastructure. Therefore, your personal data is transferred abroad; this transfer is ensured with adequate safeguards under KVKK Article 9/2-c through:

  • A data processing agreement signed with the data processor service provider,
  • Standard contracts (Turkish SCC) signed by this provider with AWS, as announced by the Personal Data Protection Board.

 

5. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

In accordance with Article 11 of the KVKK, you have the following rights regarding your personal data:

  • To learn whether your personal data is being processed,
  • To request information if your personal data has been processed,
  • To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
  • To know the third parties to whom your personal data is transferred domestically or abroad,
  • To request correction of your personal data if it is incomplete or incorrectly processed,
  • To request the erasure or destruction of your personal data if the reasons for processing cease to exist, despite being processed in accordance with the KVKK and other relevant laws,
  • To request notification of these operations to third parties to whom your personal data has been transferred,
  • To object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
  • To demand compensation for damages if you suffer damage due to unlawful processing of your personal data.

 

6. INFORMATION REGARDING THE USE OF COOKIES

The Vayabo website and mobile application use cookies to improve user experience, enable the provision of services, analyze user movements, and deliver content according to preferences. The types of cookies used and the legal grounds for processing these cookies are stated below:

  • Strictly Necessary Cookies: These are cookies essential for the proper functioning of the website. They enable basic functions such as logging in, security, and filling out forms. These cookies are used under KVKK Art. 5/2-(c) as they are necessary for the conclusion and performance of the contract.
  • Functionality Cookies: Used to remember user preferences (language selection, location, etc.). These cookies are processed solely based on the user’s explicit consent (KVKK Art. 5/1).
  • Performance and Analytical Cookies: Collect statistical information about how visitors use the website. They enable the analysis of user behavior through tools like Google Analytics. These cookies are processed based on legitimate interest to improve user experience (KVKK Art. 5/2-(f)). In cases where explicit consent is required, they are used based on consent.
  • Advertising/Marketing Cookies: Used to deliver content and advertisements based on interests. They may be placed by third-party advertising providers. The use of such cookies is based on explicit consent (KVKK Art. 5/1).

Users can always change their cookie preferences by adjusting their browser settings. However, disabling strictly necessary cookies may prevent some parts of the site from functioning correctly.

 

7. METHODS OF APPLICATION FOR YOUR RIGHTS AND REQUESTS

You can submit your requests regarding your rights mentioned above in writing, via registered electronic mail (KEP) address, secure electronic signature or mobile signature, or via the Company’s email address.

Applications will be concluded free of charge within a maximum of 30 (thirty) days. If the process requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. To submit your applications, you can fill out and send the Data Subject Rights Request Form to us.

Contact: info@vayabo.com

  •