UK Privacy Notice

This Notice is published in Turkish and English with the same content. If you are located outside Türkiye, this English version is the authoritative version for you (see Section 18).

Data Controller Information

• Data controller: Mobiza Teknoloji
• Brand / service: Planfly
• Data protection contact: legal@planfly.app
• Customer support: support@planfly.app
• Phone: +90 850 307 90 23
• Address: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86, 16335 Osmangazi, Bursa, Türkiye
• Website: planfly.app

1. Purpose and Scope of This Notice

This UK Privacy Notice (the "Notice") explains how Mobiza Teknoloji ("we" or "us"), which operates the Planfly online appointment platform, processes the personal data of people located in the United Kingdom. It provides the information required by Articles 13 and 14 of the UK General Data Protection Regulation ("UK GDPR") and is based on the UK GDPR and the Data Protection Act 2018 ("DPA 2018"), as amended by the Data (Use and Access) Act 2025, and on the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Because we offer Planfly to businesses and individuals in the United Kingdom and, if you consent, measure the use of our marketing pages, the UK GDPR applies to the processing described in this Notice (Article 3(2) UK GDPR).

This Notice covers the processing for which we are the controller, in particular when you:

• visit planfly.app or any of its subdomains,
• create a business account, or use the business dashboard or the Planfly mobile app as a business owner, manager or authorized user,
• are invited by a business to its team and use your own Planfly user account,
• request information, a demonstration or a quote, or contact us by email, phone, the support form or the chat assistant on our website,
• purchase, renew or cancel a subscription or an add-on,
• receive service or marketing messages from us,
• sign up through a partner's referral link or take part in our partner program (for partners, the Partner Privacy Notice also applies).

Appointments booked with businesses: If you book an appointment through a business's booking page or booking widget, or if a business records you as its customer, that business is the controller of your appointment data, and we process this data only on the business's behalf (Section 3.2).

Relationship with other documents: This Notice complements the Privacy Policy, which describes our processing in more detail and applies to everyone who uses Planfly. If you are located in the United Kingdom and this Notice differs from the Privacy Policy, this Notice prevails. As a company established in Türkiye, we are also subject to Turkish Law No. 6698 on the Protection of Personal Data (KVKK), which is described in the KVKK Privacy Notice; this does not limit the rights you have under this Notice. People in the European Economic Area and Switzerland should read the GDPR Privacy Notice, and residents of the United States the US Privacy Notice.

2. Controller, UK Representative and Contact

The controller for the processing described in this Notice is Mobiza Teknoloji, established in Türkiye, whose contact details are given at the beginning of this Notice. We have no establishment in the United Kingdom.

We have not appointed a data protection officer. Please send questions about the processing of your personal data, requests to exercise your rights and complaints to legal@planfly.app; you can also send questions about your account or the service to support@planfly.app.

3. Our Role and the Role of Businesses

3.1. Processing for Which We Are the Controller

We determine the purposes and means, and are therefore the controller, of the processing relating to our website, business accounts and dashboard users, Planfly mobile app accounts, subscriptions and purchases, invoicing, customer support and the chat assistant, information security, product analytics, our own marketing communications, the partner program and compliance with the laws that apply to us.

3.2. Booking Pages: the Business Is the Controller

Businesses that use Planfly, such as hair salons, beauty centers, psychologists, dietitians, clinics, physiotherapists and studios, are the controllers of the personal data of their customers (clients, patients, members, students and similar) that they collect through their booking page, booking widget, dashboard or the Planfly mobile app, or that they enter into Planfly themselves. The same applies to the staff profiles that a business creates for its team (name, title, photo, working hours and the services provided).

For this data, we act as the business's processor within the meaning of Article 28 UK GDPR: we process it only on the business's documented instructions, only to provide the Planfly service and under the Data Processing Agreement between the business and us. Each business's booking page links to the business's own privacy notice or to the notice that Planfly prepares on the business's behalf from the business's details; that notice explains how the business uses your data and how you can exercise your rights. If you send us a request concerning appointment data, we forward it to the business without undue delay and let you know.

3.3. Payments and Purchases

• Purchases in Turkish lira: Subscriptions and add-ons paid in Turkish lira are sold by Mobiza Teknoloji, and the payment is processed by iyzico Ödeme Hizmetleri A.Ş. ("iyzico"). Card details are transmitted over an encrypted connection directly to iyzico's infrastructure and are not stored in our systems; we receive only limited payment data, such as the payment status, the transaction reference, the card type and the masked last four digits of the card (Section 4.6 of the Privacy Policy). iyzico also processes certain data as an independent controller, for example to prevent fraud and to meet its own legal obligations.
• Orders in other currencies (Paddle): Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all orders paid in currencies other than Turkish lira on our website. Paddle provides customer service for payment and billing inquiries and handles returns and refunds for these orders. Paddle.com Market Limited (company number 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom) and the Paddle group companies named in Paddle's buyer terms ("Paddle") buy the subscription from us and resell it to you; Paddle collects the payment, calculates and remits VAT or sales tax and issues the invoice or receipt. Paddle processes your payment data as an independent controller under its own privacy notice. We do not receive your card details; Paddle sends us only the order data we need to provide the service: the order and subscription ID, the plan, the amount, the currency, the country, the tax status, your name and email address, the payment status and any refund or chargeback status.
• App Store and Google Play: If you buy a subscription in the Planfly mobile app, Apple or Google is the seller and processes your payment data as an independent controller. To activate your subscription, we receive from them only transaction information about the purchase, renewal, cancellation and refund status.

4. Personal Data We Process and Where It Comes From

4.1. Categories of Personal Data

Depending on how you interact with Planfly, we process the following categories of personal data; a detailed list is given in Section 4 of the Privacy Policy:

• Website visitors: IP address, device, browser and operating system information, access times and logs, the referring page and campaign (UTM) information, cookie data and, if you consent, Google Analytics 4 measurement data.
• Prospective customers and people who contact us: first name, last name, email address, phone number, business name and industry, the content of your messages, support tickets and chat assistant conversations, attachments and communication history.
• Business account holders and dashboard users: first name, last name, email address, phone number, account identifiers, hashed password and two-factor authentication settings, the Google or Apple account identifier if you sign in with Google or Apple, Google Calendar connection data if you connect it, business details (name, industry, address, contact details, logo and cover image), billing details, subscription, order, payment and invoice records, roles and permissions, session, device and security logs, the device token used for push notifications in the mobile app, and dashboard usage data.
• Team members with their own user account: first name, last name, email address, phone number, role and permissions, sign-in and security records.
• Purchasers: the order data received from Paddle, the transaction information received from Apple or Google and the limited payment data received from iyzico (Section 3.3).
• Partner program: the partner code used for the sign-up, a masked version of the business name, the plan and the subscription status.

4.2. Sources

We collect personal data:

• directly from you, when you fill in forms, use your account, write to us or use the chat assistant,
• automatically from your device and browser when you use our website, the dashboard or the app (and, if you consent, through analytics cookies),
• from the business that invites you to its team (your name, email address and role),
• from Google or Apple, if you choose to sign in with them, and from Google, if you connect Google Calendar (Section 16 of the Privacy Policy),
• from Paddle, Apple, Google and iyzico in connection with your purchases,
• from the partner whose referral link you used (only the partner code).

5. Purposes and Lawful Bases

5.1. Our Legitimate Interests

Where we rely on legitimate interests, our interests are: providing a secure and reliable service and preventing fraud and abuse; understanding how the service is used so that we can improve it; answering inquiries and keeping our business customers informed; running the partner program; complying with the laws that apply to us as a company established in Türkiye; and establishing, exercising or defending legal claims. We use only the data needed for these interests and weigh them against your interests and fundamental rights and freedoms. You can ask us for information about this balancing test, and you can object to processing based on legitimate interests at any time (Section 11).

5.2. Consent

Where we rely on your consent, giving it is voluntary, and you can withdraw it at any time with effect for the future: for analytics, through the "Cookie preferences" link on our pages; for marketing messages, through the opt-out link or instructions included in each message or by writing to legal@planfly.app. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Is Providing Your Data Required?

You are not under a statutory obligation to provide personal data to us. However, the data marked as required in our forms is necessary to conclude and perform the contract with you: without it, we cannot open an account for you, provide the service or process a purchase. For purchases in Turkish lira, billing details are required to issue the invoice required by Turkish tax law. Consent to analytics cookies and marketing messages is entirely optional, and refusing it has no effect on your use of Planfly.

7. Special Category Data and Health Data

We do not process special category data, such as health data, for our own purposes, and we ask you not to include such data in support requests or chat assistant conversations. Businesses in the health sector may process health data through intake questions, appointment notes and customer notes. For this data, the business is the controller and determines the condition on which it relies under Article 9 UK GDPR and Schedule 1 to the DPA 2018, in particular Article 9(2)(h) together with section 10 of and paragraph 2 of Schedule 1 to the DPA 2018 (health or social care purposes), subject to the professional secrecy requirement in Article 9(3) UK GDPR and section 11 of the DPA 2018, and Article 9(2)(a) for explicit consent. On the booking forms of businesses outside Türkiye, explicit consent is always optional, and booking an appointment online is never made conditional on it. We process this data only as the business's processor and with additional safeguards: private notes on the customer card are encrypted in the database and shown only to the business's authorized users, and businesses can use the discreet message option so that reminders do not show the service name.

8. Recipients

We disclose personal data only to the extent necessary for the purposes above, to the following categories of recipients (see also Section 9 of the Privacy Policy):

• service providers acting as our processors: hosting and database providers, Cloudflare (content delivery network, file storage, DNS and network security), email delivery providers, Netgsm İletişim ve Bilgi Teknolojileri A.Ş. and other messaging providers, Google (encrypted backups on Google Drive and mobile app push notifications through Firebase Cloud Messaging) and artificial intelligence model providers for the chat assistant on our website; the sub-processors we use for businesses' customer data are listed in Annex 3 of the Data Processing Agreement,
• sign-in providers: Google and Apple, if you choose to sign in with them,
• payment and purchase partners: iyzico and banks for purchases in Turkish lira, Paddle for orders paid in other currencies, and Apple and Google for purchases in the mobile app; these recipients act as independent controllers for their own processing,
• analytics provider: Google (Google Analytics 4), only if you consent, with advertising features turned off,
• the business you work with: if you are a team member, the business's authorized users can see your profile and activity in the business's dashboard,
• professional advisers: accounting, e-invoicing, legal and audit service providers,
• public authorities: competent authorities, courts and enforcement offices, where we are legally required to disclose data or where disclosure is necessary to establish, exercise or defend legal claims.

We do not sell your personal data and do not use it for third-party advertising.

9. International Data Transfers

We are established in Türkiye, and there are no UK adequacy regulations for Türkiye. Personal data that you send us directly when you use Planfly is collected and processed by us in Türkiye. Such direct collection from you is not a restricted transfer under the UK GDPR; the UK GDPR nevertheless applies to our processing, and we protect your data with the measures described in Section 14.

When we pass personal data on to service providers outside Türkiye, we rely on:

• UK adequacy regulations for the recipient's country (for example, for the countries of the European Economic Area) and, for recipients in the United States that are certified under the UK Extension to the EU-U.S. Data Privacy Framework, the Data Protection (Adequacy) (United States of America) Regulations 2023,
• where no adequacy regulations cover the transfer, the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the European Commission's standard contractual clauses (UK Addendum), issued under section 119A of the DPA 2018, together with supplementary measures where necessary.

Transfers of the personal data of businesses' customers from businesses in the United Kingdom to us are based on the standard contractual clauses together with the UK Addendum, incorporated into the Data Processing Agreement. Paddle.com Market Limited, which collects the data needed for orders in other currencies directly from you as an independent controller, is established in the United Kingdom. You can request a copy of the safeguards we use at legal@planfly.app.

10. Retention

We keep personal data only for as long as necessary for the purposes for which it is processed. To determine retention periods, we use the following criteria: the duration of the contract and of your account; the time needed to handle your request, complaint or support case; the retention periods for invoicing, accounting and commercial records under Turkish law (as a rule, up to 10 years) and for traffic logs under Law No. 5651; the limitation periods for possible legal claims; and the time for which we must be able to prove consents and opt-outs. Data relating to your account is kept while the account is active and, after the account is deleted, only for these purposes and until the backup cycle is completed; it is then deleted or anonymized. Google Analytics data is kept for at most 14 months, and Google Analytics cookies expire after at most 12 months. The periods for each category are set out in Section 12 of the Privacy Policy. Businesses' customer data is kept according to the business's instructions and the Data Processing Agreement.

11. Your Rights

Subject to the conditions and exceptions in the UK GDPR and the DPA 2018, you have the right:

• to obtain confirmation as to whether we process your personal data, and to access the data and information about the processing (Article 15),
• to have inaccurate data rectified and incomplete data completed (Article 16),
• to have your data erased (Article 17),
• to have processing restricted (Article 18),
• to receive the data you have provided to us, where it is processed by automated means on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (Article 20),
• to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time and without giving reasons to the use of your data for direct marketing (Article 21),
• to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)),
• to complain to us and to the Information Commission (Section 16).

How to exercise your rights: Send your request to legal@planfly.app, preferably from the email address registered to your Planfly account. You can also view and correct much of your data, and delete your account, in your account settings. Requests are free of charge. We respond without undue delay and in any case within one month of receiving your request or, if later, of receiving the information we need to confirm your identity; where necessary, taking into account the complexity and number of requests, we may extend this period by two further months, in which case we tell you within the first month and explain why. If we process a large amount of information about you and reasonably need you to specify the information or processing activities your request relates to, we may ask you to do so, and the time limit is paused until you reply. For access requests, we carry out reasonable and proportionate searches. We ask only for the information reasonably necessary to verify your identity; we do not ask for a Turkish national ID number, a passport number or a handwritten signed letter. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, as permitted by the UK GDPR. We inform the recipients to whom your data has been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort (Article 19).

If your request concerns appointment data processed on behalf of a business, please send it to that business; if it reaches us, we forward it to the business and help it respond.

12. Automated Decision-Making

We do not take significant decisions about you based solely on automated processing, that is, decisions that produce legal effects concerning you or similarly significantly affect you (Articles 22A to 22D UK GDPR). In the dashboard, businesses can see attendance-probability badges for their customers, which are calculated on the business's behalf from the customer's appointment history; these badges are only indications for the business, and blocking a customer is a manual action taken by the business. Automated security controls, such as rate limits and bot checks, may temporarily limit requests; if you believe that such a control has affected you wrongly, contact us and a member of our team will look into it.

13. Cookies and Similar Technologies

Under regulation 6 of PECR, without asking for consent, we use only the cookies and similar technologies that are strictly necessary for our website, the dashboard and booking pages to work. All other cookies and similar technologies, in particular Google Analytics 4 on our marketing pages, are used only with your prior consent, which you can give or refuse in the cookie notice and change at any time through the "Cookie preferences" link; we do not rely on the exception for statistical purposes for Google Analytics. Google Analytics runs with advertising features and Google signals turned off and does not run while your browser sends a Do Not Track or Global Privacy Control signal. For visits from the United Kingdom, we do not set the partner referral cookie (the partner code is kept only in the session of that visit), we do not store anything in the browser for the information messages next to the chat button, and we do not keep the cookieless visit statistics on booking pages. Details, including the full list of cookies and their durations, are given in the Cookie Policy.

When you open the Paddle checkout for an order in a currency other than Turkish lira, Paddle may use cookies and similar technologies that are necessary for the checkout and for payment security, under its own privacy notice.

14. Security

We implement appropriate technical and organizational measures to protect personal data, including encrypted transmission (TLS) on all connections, separation of business data and role-based access control, hashed passwords and optional two-factor authentication, encryption in the database of private customer notes and third-party access tokens, rate limiting and misuse detection, logging, and regular encrypted backups (Section 13 of the Privacy Policy). If a personal data breach occurs, we notify the Information Commission and the people affected where the UK GDPR requires it.

15. Children

Planfly is intended for businesses and their customers and is not directed at children. We do not knowingly collect personal data from children for our own purposes. Where a business accepts appointments for children, the appointment is expected to be made by a parent or legal guardian, and the business is responsible for the processing as the controller (Section 17 of the Privacy Policy).

16. Complaints

Complaining to us: Under section 164A of the DPA 2018, you have the right to complain to us if you are concerned about the way we process your personal data. You can send your complaint electronically to legal@planfly.app. We acknowledge receipt of your complaint within 30 days, take appropriate steps to respond to it without undue delay, including making enquiries into its subject matter to the extent appropriate, and inform you of the outcome without undue delay.

Complaining to the Information Commission: You also have the right to complain to the Information Commission, the UK data protection regulator (formerly the Information Commissioner's Office, "ICO"), through its complaint page. The regulator generally expects you to raise your concern with us first and to give us the opportunity to respond. You also have the right to bring proceedings before the courts.

17. Changes to This Notice

We may update this Notice if the law, our services or our service providers change. This version was last updated on October 10, 2026. For significant changes, we may also inform business users by email or by a notification in the dashboard.

18. Language of This Notice

This Notice is published in Turkish and English with the same content. For people located outside Türkiye, the English version is authoritative.