Privacy Notice and Privacy Policy

VELORA PRIVACY NOTICE AND PRIVACY POLICY

EFFECTIVE DATE: 01.04.2026

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is:

Serdar Ziya Akova

Tax ID: 0330403073

Address: Kemalpaşa Mahallesi, 7081 Sokak No:21/2, Bornova, İzmir, Türkiye

Email: iletisim@veloraappy.com

This notice explains how personal data is processed when using the Velora application operated by the data controller.

The following categories of personal data may be processed through Velora:

• Identity data: first name and surname;
• Contact data: telephone number, email address, and address information;
• User account data: login details, user role, and business information;
• Client and appointment data: client name, telephone number, appointment times, service history, and notes;
• Financial data: payment records, collection summaries, revenue, and sales data;
• Technical data: IP address, device information, session records, and log records;
• Usage data: dashboard activity, report views, and transaction history;

Integration data: data relating to WhatsApp, Instagram, SMS, and payment-system connections.

Your personal data is processed for the following purposes:

• Providing and maintaining Velora services;
• Creating and managing user accounts;
• Managing appointments, clients, staff, inventory, and reporting processes;
• Completing payment, invoicing, and subscription processes;
• Managing user requests, support processes, and complaints;
• Improving service quality, developing the application, and ensuring security;
• Complying with legal obligations;

Responding to requests from authorised public authorities and institutions.

Your personal data is collected electronically, through automated or partially automated means, via:

• the website;
• mobile and web application interfaces;
• user registration forms;
• integrations;
• support requests;

automated logs and technical records.

The legal bases for processing include:

• Processing being directly related to the establishment or performance of a contract;
• The data controller's ability to fulfil a legal obligation;
• The establishment, exercise, or protection of a right;
• The data controller's legitimate interest;

Your explicit consent where required.

Personal data may be shared to a limited extent, in accordance with applicable law and where necessary to provide the service, with:

• server and infrastructure providers;
• database and cloud-service providers;
• SMS and communications-service providers;
• payment institutions and financial-service providers;
• integration and software-service providers;

legally authorised public institutions and organisations.

Reasonable technical and organisational measures are taken to protect personal data processed through Velora. Appropriate safeguards are applied to reduce the risks of unauthorised access, data loss, misuse, and unlawful processing.

Personal data is retained for as long as required by the purposes of processing and for the retention periods specified by applicable legislation. When the retention period ends, data is deleted, destroyed, or anonymised.

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is processed;
• Request information if it has been processed;
• Learn the purpose of processing and whether it is used in accordance with that purpose;
• Know the third parties to whom it is transferred in Türkiye or abroad;
• Request correction where it has been processed incompletely or inaccurately;
• Request deletion or destruction in accordance with the KVKK;
• Request notification of correction, deletion, or destruction to third parties to whom data has been transferred;
• Object to a result against you that arises solely from analysis by automated systems;

Request compensation for loss arising from unlawful processing.

You may submit your requests to iletisim@veloraappy.com.