Data Protection Notice (KVKK)

Pursuant to the KVKK, your personal data is processed by OXIO Solutions (the SalonSync brand) in its capacity as data controller. Contact: info@salonsync.cloud · Web: salonsync.cloud · Application: app.salonsync.cloud. With respect to the data that salons enter into the system regarding their own customers, SalonSync is in the position of data processor; the data controller of this data is the relevant salon operator.

The categories of personal data we process within the scope of this notice are as follows:

• Identity information: Name, surname, business title.
• Contact information: E-mail address, phone number, business address.
• Customer transaction information: Subscription, billing, and service usage records.
• Transaction security information: IP address, device and browser information, log records, session data, password (hashed).

Your personal data is processed for the following purposes:

• Conducting membership and account operations and identity verification;
• Providing salon management services (appointments, POS, customer and staff management, reporting);
• Delivering transactional notifications and reminders via SMS and e-mail;
• Conducting contractual processes, billing, and collection operations;
• Conducting information security processes and preventing misuse;
• Providing information to authorized institutions and organizations and fulfilling legal obligations;
• Conducting promotional and marketing activities where explicit consent is present.

Your personal data is processed based on the following legal grounds specified in Articles 5 and 6 of the KVKK:

• Being directly related to the establishment or performance of a contract (Art. 5/2-c);
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2-ç);
• Being mandatory for the legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f);
• The existence of the data subject's explicit consent in cases where the above conditions are not present (Art. 5/1).

In order to provide the service and in compliance with the conditions stipulated in Articles 8 and 9 of the KVKK, your personal data may be transferred to our service providers that provide hosting (MongoDB Atlas), e-mail delivery (Hostinger SMTP), and SMS transmission; and, within the scope of our legal obligations, to authorized public institutions and organizations. Since your data is hosted on the MongoDB Atlas infrastructure in the European Union (Frankfurt / Germany) region, the transfer abroad is carried out in compliance with the KVKK's provisions on transfers abroad and with the necessary safeguards in place.

Your personal data is collected via account creation, registration, and login forms, automatically during the electronic use of the service (log records, cookies), and through the communication channels you establish with us, by partly automated and automated methods. The legal grounds for the collected data are the KVKK Art. 5 and Art. 6 bases specified in the "Legal Grounds" section of this notice.

Pursuant to Article 11 of the KVKK, by applying to the data controller you may exercise the following rights:

• To learn whether your personal data is being processed;
• To request information if it has been processed;
• To learn the purpose of processing and whether it is used in accordance with its purpose;
• To know the third parties to whom the data is transferred domestically or abroad;
• To request the correction of incompletely or incorrectly processed data;
• To request the deletion or destruction of the data within the conditions stipulated in the KVKK;
• To request that correction, deletion, and destruction operations be notified to the third parties to whom the data has been transferred;
• To object to a result arising against you through the analysis of the processed data exclusively by automated systems;
• To request compensation for the damage in the event that you suffer damage due to the unlawful processing of the data.

You may submit your requests regarding the rights listed above to us by sending them, together with information verifying your identity, to info@salonsync.cloud. Your application will be concluded free of charge as soon as possible depending on the nature of the request, and in any event within a maximum of thirty (30) days from the date your application reaches us. However, if the process additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

If you are a customer of a salon that is a SalonSync subscriber, the data controller of the personal data concerning you is the relevant salon operator; SalonSync is only a data processor with respect to this data. Therefore, you must first submit your requests under KVKK Art. 11 to the salon from which you receive service. We forward any such requests that reach us to the relevant salon in our capacity as data processor and provide support in accordance with the salon's instructions.