Data Protection Notice (GDPR / KVKK)

1. Data controller

With regard to business account data, the data controller is Dejavu (dmrio.com), contact: info@dmrio.com. With regard to the data of customers who book appointments, the data controller is the relevant business; Dejavu is the data processor.

2. Personal data processed

Identity and contact details (name, phone number, e-mail), business details (branch, services, working hours, staff), customer contact data (WhatsApp number and profile name), appointment records, text of conversations with the assistant and transcriptions of voice messages, transaction security data (session token, masked log records), subscription and payment status (card details are not stored by Dejavu).

3. Purposes of processing

Booking, rescheduling, cancelling and reminding of appointments; business panel services; formation and performance of the subscription contract; invoicing and accounting obligations; support; service security and prevention of misuse.

4. Legal grounds

KVKK Art. 5/2-c (formation or performance of a contract), Art. 5/2-ç (legal obligation), Art. 5/2-f (legitimate interest); GDPR Art. 6(1)(b), 6(1)(c) and 6(1)(f).

5. Transfers

Hosting: Hetzner Online GmbH, Germany. AI reply generation: Google, Anthropic and OpenAI; some of these providers are located outside the EU and the transfer takes place under the providers' standard contractual clauses. Google Calendar, if the business enables it. The payment service provider for subscription payments. Competent public authorities and institutions, only where legally required.

For businesses established in Türkiye, transfers abroad are limited to the sub-processors listed above within the scope of KVKK Art. 9.

6. Method of collection and retention

Data is collected automatically through the business panel forms, the WhatsApp connection and customers' WhatsApp messages. It is retained while the account is active; it is deleted 30 days after cancellation, or immediately upon a deletion request. Invoicing records are kept separately for the statutory period.

7. Rights of the data subject

Under KVKK Art. 11 and GDPR Art. 15-22: to learn whether your data is being processed, to request information, to learn the purpose of processing and whether the data is used in line with that purpose, to know the third parties to whom it is transferred, to request rectification, to request erasure or destruction, to request that these operations be notified to the third parties to whom the data was transferred, to object to a result arising against you from analysis by automated systems, to claim compensation in the event of damage, and data portability.

Send your request to info@dmrio.com. Requests are handled free of charge within 30 days at the latest. You retain the right to lodge a complaint with the Personal Data Protection Board or, if you are located in the EU, with your local supervisory authority.

Contact

For questions about these documents and for data requests: info@dmrio.com