Privacy Policy

Last updated: 5 October 2026

This Privacy and Personal Data Protection Policy explains for what purposes, on which legal grounds, with whom and for how long personal data is processed through the kktcrandevum.com website, its installable app version and the business/administration panels (together, the "Platform"), as well as your rights and how to exercise them. It has been prepared under the Turkish Republic of Northern Cyprus Personal Data Protection Law (89/2007) and related legislation.

1. Data controller

The operator of the Platform ("kktcrandevum", "we") is the data controller for personal data processed to run the Platform. You can reach us at [email protected].

The businesses you book with (hairdressers, barbers, dentists, clinics, vets, etc.) are separate data controllers for the data they process within their own customer relationship (e.g. visit history, notes they take, treatment/care records, pet and vaccination details, marketing emails they send you). For such data kktcrandevum acts as a processor on behalf of, and on the instructions of, the business. You may send related requests directly to the business or write to us to have them forwarded.

2. What data do we process?

2.1. Members and guest users

Identity and contact: first name, last name, email address, phone number.
Account data: your password in irreversibly hashed form, language preference, email verification status, optional birthday (day and month only; no year).
Sign in with Google: if you choose "Continue with Google", we receive only your first and last name, verified email address and Google account ID; your Google password is never shared with us. You can remove this connection at any time in your Google account settings.
Appointment data: chosen business, services, specialist, date and time, your note, status (confirmed, cancelled, rescheduled, no-show), your "I'm coming / I can't come" answer, any discount code used and payment status (payment is made at the business; the Platform never collects card details).
Family account: if you book for someone else (child, partner, parent, pet, etc.), that person's name and relationship.
Reviews and questions: rating, review text, review photos, satisfaction survey answer, questions you ask a business. Your name is shortened when shown publicly (e.g. "Ayşe Y.").
Preferences: favourite businesses, newsletter and marketing consent, waiting-list entries.
Technical data: IP address, browser/device information, login times and failed login attempts, cookies and similar technologies (see the Cookie Policy), and your browser's push subscription if you allow notifications.
Consent records: which text and version you accepted, when, and from which IP address.

2.2. Business users

Name, email, phone, role/permission data and login records of business owners and panel users, and optional two-factor authentication data.
Business data: trade name, address, location, opening hours, services and prices, photos, staff details, verification documents, subscription and payment notifications (bank receipts).
A log of actions taken in the panel (activity history).

2.3. Special categories of data

The Platform is not designed to collect health data. However, when a healthcare business such as a dentist or clinic sees the service you chose (e.g. "root canal treatment") and your note, this may qualify as health data in some cases. We process such data only to carry out your appointment, with your explicit consent and under the responsibility of the business concerned. We recommend not writing health information in the note field unless necessary. Treatment/care records kept by businesses are the responsibility of those businesses.

3. Why do we process data?

To create your account, verify your identity and manage your account securely,
To create your appointment, pass it to the business, send confirmation/cancellation/rescheduling/reminder notices and let you add it to your calendar,
To send appointment-related information such as waiting-list alerts, rebooking reminders, review invitations and aftercare instructions,
To moderate reviews and questions before publication and block fake or inappropriate content,
To provide businesses with booking management, customer tracking, reporting and till tools,
With your explicit consent, to send promotional messages such as campaigns, newsletters and birthday gifts,
To keep the Platform secure and prevent abuse, bot attacks and unauthorised access,
To measure and improve service quality (anonymous/statistical usage data; analytics cookies only with your consent),
To comply with legal obligations and respond to legal claims.

4. Legal grounds

Entering into and performing a contract: providing membership and booking services.
Legitimate interest: security, fraud prevention, service improvement, review moderation.
Legal obligation: records and notifications required by law.
Explicit consent: marketing messages, analytics/advertising cookies, notifications and special categories of data. You may withdraw consent at any time.

5. Who do we share data with?

The business you book with: your name, contact details, chosen services, note and visit history with that business are shared so the appointment can take place. A business sees only its own customers' data.
Infrastructure and service providers: Google sign-in (only if you use it), hosting (servers), content delivery and security (Cloudflare), email delivery provider, browser push services (Google, Apple, Mozilla), map tiles (OpenStreetMap), fonts (Google Fonts), video embeds (YouTube, privacy-enhanced mode). These providers process data only to deliver their service.
Analytics and advertising partners: Google Analytics and Meta (Facebook) measurement tools run only if you choose "Accept all" in the cookie banner.
Authorities: where required by law or court order.

Your personal data is never sold and is not given to third parties for marketing without your permission. Some providers' servers may be located abroad; in that case data is transferred with the safeguards required by law.

6. Retention

Membership data: for as long as your account is open. When you delete your account your personal details are erased; past appointments kept by businesses for accounting and service records remain in anonymised form.
Guest bookings: kept in the business's records for the duration of its service and legal record-keeping obligations.
Email delivery logs: 90 days from sending.
Panel notifications: 90 days. Failed login attempts: 30 days. Password reset/verification links: 7 days after expiry.
Consent records: as proof of consent, for the statutory limitation period after the relationship ends.
"Remember me" tokens: up to 30 days (administration panel: 7 days).

7. Security

Connections are encrypted with HTTPS; passwords are stored using irreversible hashing; sensitive settings are encrypted; two-factor authentication is supported in the business and administration panels; each business can access only its own records; login attempts and abuse are rate-limited. No system is 100% secure; if we become aware of a breach we will notify the affected persons and authorities as required by law.

8. Your rights

Under the Personal Data Protection Law you have the right to learn whether your data is processed, request information about it, learn the purpose of processing and the recipients, request correction of incomplete or inaccurate data, request erasure or destruction, object to processing, and claim compensation for damage caused by unlawful processing.

Download my data: download your data in one click from the My Account page.
Delete account: permanently delete your account from the My Account page.
Marketing consent: withdraw it via the "unsubscribe" link at the bottom of every campaign email or from your profile.
For other requests write to [email protected]. Requests are answered free of charge within 30 days at the latest.

9. Children

Membership is intended for people aged 18 or over. Appointments for minors should be made by a parent or guardian (e.g. using the family account feature).

10. Changes

We may update this policy to reflect changes in the law or our services. The current version is always published on this page, and members are notified by email of significant changes.

11. Contact

Email: [email protected]
Website: kktcrandevum.com