Privacy and KVKK Notice

1. Controller and roles

For platform operations, user accounts, security, support, subscriptions, and legal obligations, the controller is Taha Erel, owner of the Reseryo trademark application. Privacy requests may be sent to support@reseryo.com.

For booking forms and customer records determined by a business, that business may be the controller and Reseryo its processor. Reseryo’s independent purposes and the business purposes are treated separately.

2. Data categories

• Identity and account: name, user identifier, role, and verification records
• Contact: email, phone number, and communication preferences
• Booking: business, service, staff, date, time, status, guest name, and booking notes
• Business: name, representative, address, phone, email, services, schedule, images, and plan data
• Support: contact forms, complaints, suggestions, correspondence, and transaction history
• Technical and security: request and IP data, device/browser, session, error, audit, and abuse records
• Sensitive data: a limited health note requested by an eligible healthcare business under a separate legal basis
• Google sign-in: the name and email address on the Google account, and nothing else. This data is used only to create and sign you in to your Reseryo account. It is never sold, used for advertising, or used to train generalised machine learning models.

3. Purposes

• Create accounts, verify identity, and maintain sessions
• Create booking requests, transmit them to businesses, show status, and send transactional notices
• Provide business profiles, calendars, plans, and panel features
• Provide support and review complaints and appeals
• Prevent fraud, conflicting or abusive activity, and security incidents
• Measure performance, resolve errors, and improve the product
• Meet legal obligations and establish, exercise, or defend rights

4. Legal bases and collection

Data is collected through web and mobile interfaces, account and booking forms, Google sign-in, support communications, the business panel, necessary cookies, and system logs by automated or partly automated means.

Processing relies on contract necessity, legal obligations, legal claims, and legitimate interests that do not override fundamental rights. Health data and future marketing communications that require consent are handled through separate, specific choices. Reading this notice is not consent.

5. Recipients

Reseryo does not process customer card or bank account data because customer payments are not collected through the platform. No SMS provider is currently used; this notice will be updated before one is added.

• The selected business and its authorized staff for fulfilling a booking
• Vercel for hosting and delivery
• Supabase in the Germany (Frankfurt, eu-central-1) region for database, authentication, and storage
• Google when the user chooses Google sign-in
• Hostinger email infrastructure for transactional email and support
• Sentry for error and performance monitoring; only technical error records are sent, without IP addresses or request bodies
• Courts, regulators, and public authorities when legally authorized

6. International transfers

Some data may be processed outside Türkiye because of Vercel, Supabase’s Germany (Frankfurt, eu-central-1) region, Google, Sentry, and global infrastructure providers. Transfers are handled under the applicable safeguards, agreements, and security measures required by Article 9 of Law No. 6698.

Google sign-in is optional where email and password sign-in is available.

7. Retention and deletion

Data is retained for the period needed for its purpose, the relevant contract, legal claims, and mandatory retention duties. At the end of that period, it is deleted, destroyed, or anonymized.

• Account data while the account is active and for required claim periods after closure
• Booking records for disputes, proof, and applicable business obligations
• Support records until the request and a reasonable follow-up period end
• Security logs for a limited period needed for incident review and abuse prevention
• Health notes only under the healthcare business’s lawful retention instructions

8. Health data

A health note is not required for ordinary bookings. Only an eligible healthcare business may enable it where genuinely necessary. That business must separately explain the purpose, legal basis, access, and retention period.

Where explicit consent is required, the note is not recorded without a separate choice. Health data concerning a person under 18 requires a separate parent or legal guardian process.

9. Children

People under 18 must use Reseryo with the knowledge and supervision of a parent or legal guardian. The relevant guardian must provide any representation or authorization needed for a contractual act or sensitive-data disclosure.

If you believe a child’s data was provided without authority, request review or deletion at support@reseryo.com.

10. Security

Reseryo applies risk-appropriate measures such as access control, role and tenant separation, encrypted transport, logging, backup, and security checks. No online system is absolutely secure, so suspicious activity should be reported promptly.

11. KVKK rights and requests

Under Article 11 of Law No. 6698, you may ask whether your data is processed, request information and recipients, verify purpose, request correction or deletion, object to solely automated outcomes, and claim compensation for unlawful processing where applicable.

Send your name, sufficient identity-verification information, contact address, and clear request from your registered email address to support@reseryo.com. Only necessary verification data will be requested. Applications are handled within the statutory period and generally free of charge.

12. Updates

This notice is updated when features, providers, data categories, or law change. Material changes will be announced. The operator’s trade name, registration, and service address will be added when the sole proprietorship is established.