1. Who is the controller?
Termindo acts in two different roles, and which one applies depends on whose data it is.
If you are booking an appointment: the business you are booking with is the data controller. Termindo is a processor acting on that business’s instructions. Address requests about your appointment to the business first; if you cannot reach them, write to us at the address below and we will pass your request on and help see it through.
If you run a business here, or work in one: Trius is the controller for your account, sessions, billing and platform usage data. For what a business publishes on its own page about its staff, such as their names and photographs, the controller is the business that entered it.
For the moderation of reviews: Trius publishes the reviews customers write and hides them where necessary, and is the controller for that processing.
Controller: Trius — Tepebaşı/Eskişehir — E-mail: kvkk@termindo.com
2. What we process
As a customer: name, e-mail address, mobile number, the date and time of your appointment, the service and staff member chosen, your answers to the business’s booking form, the status and history of the appointment, a record of the e-mails and text messages sent about it, one-time sign-in code records, and security records (IP address, timestamp). Your e-mail address is used to create your account and to send you sign-in codes and appointment notifications; your phone number is asked for so that the business can reach you, and is not verified for now.
Your location when you search: To show businesses near you, your browser shares your location if you allow it. It is rounded to about 1 km and used only for that search; Termindo does not store it, link it to your account or write it to its logs. If you prefer not to share it, you can search by province and district instead.
If you write a review: the stars you give (1–5) and up to 200 characters of comment. It is published on the business’s page without your name, your initial, the service you had or the date of your appointment, and the business cannot see who wrote it either. Only a completed appointment can be reviewed, and only once.
As a business owner or team member: name, e-mail address, mobile number, an irreversible digest of your password (the password itself is never stored), business name, address and page address, opening hours, service and staff records, business and staff photographs where uploaded, the e-mail address of anyone invited to the team, and session and security records.
Health and other special-category data: processed only where a sector’s booking form asks for it — clinics, chiefly — and only where you have given separate explicit consent. Declining does not prevent you from booking; you may leave that part of the form empty.
What is public: everything a business publishes on its page — business name, address, description, photographs, the names and (where uploaded) photographs of staff who take appointments, and published reviews — can be seen by anyone on the internet.
3. Purposes and legal bases
Passing your request to the business, having it confirmed, and telling you and reminding you by e-mail (and by text message once that channel is open); opening your customer account with your e-mail address and sending sign-in codes to it — performance of a contract (KVKK art. 5/2-c).
Creating your account, verifying your phone number or e-mail address and keeping your session secure — performance of a contract and legitimate interest (art. 5/2-c and 5/2-f).
Publishing a business’s page, staff and photographs — performance of our contract with the business (art. 5/2-c); for staff details, the business’s own legal basis.
Publishing your review, and reviewing and hiding reviews that contain insults, personal data or unlawful content — your having sent it for publication (made public by the data subject, art. 5/2-d) and our legitimate interest in offering trustworthy assessments of businesses (art. 5/2-f).
Keeping the records behind the text-message credit invoices issued to businesses — legal obligation and performance of a contract (art. 5/2-ç and 5/2-c).
Preventing abuse, fake bookings and automated attacks, and keeping records of it — legitimate interest (art. 5/2-f).
Retention and disclosure obligations imposed on us by law — legal obligation (art. 5/2-ç).
Commercial electronic messages — explicit consent (art. 5/1 and Law no. 6563). Always optional; no service depends on it.
Health and other special-category data — explicit consent (art. 6).
5. How long we keep it
Appointment records and the personal data attached to them (form answers included) are kept for as long as the business remains a Termindo member, and for no more than 10 years after the appointment (the general limitation period under art. 146 of the Turkish Code of Obligations). When a business leaves, this data is erased or anonymised within 6 months at the latest.
Reviews are kept for as long as they are published. If you ask for erasure, the words of your review are deleted; the stars stay in the business’s average in a form that cannot be linked to anyone.
One-time codes delete themselves when they expire: sign-in codes after 5 minutes, password-reset codes after 15 minutes, e-mail verification links after 24 hours.
Sessions last 30 days at most. Changing your password ends every earlier session.
Team invitations that are not accepted lapse after 7 days, and the invited e-mail address is deleted.
Consent records (which version of which text you accepted, when, and your IP address) are kept so that we can prove the consent was given: acceptance of this notice and explicit consent for special-category data for 10 years after withdrawal or account deletion; consent to commercial messages for 3 years after it ends (Regulation on Commercial Communication and Commercial Electronic Messages).
Text-message delivery records (recipient number, time sent, number of message parts) are the basis of the invoice issued to the business, and are kept for 5 years after the end of the year they belong to (Tax Procedure Law art. 253). After an erasure request they are kept for that period for that purpose only.
Security records: IP-address counters used to limit abuse are kept for 1 hour at most; application and access logs at our hosting provider for 90 days at most.
When you delete your account, your name, phone number, e-mail address and form answers are erased or irreversibly anonymised; the appointment itself remains, in a form that cannot be linked to anyone, so that the business’s statistics stay correct. The consent and text-message records given retention periods above are deleted at the end of those periods.
6. Your rights (KVKK art. 11)
To learn whether your personal data is processed, and if so to request information about it.
To learn the purpose of processing and whether it is used accordingly.
To know the third parties to whom your data is transferred, in Türkiye or abroad.
To request rectification where it is incomplete or inaccurate.
To request erasure or destruction under the conditions in art. 7.
To request that rectification, erasure and destruction be notified to third parties to whom the data was transferred.
To object to a result reached solely by automated analysis that works against you.
To claim compensation for damage arising from unlawful processing.
7. How to apply
By e-mail: write to kvkk@termindo.com from the e-mail address registered with us.
If no e-mail address of yours is registered with us — which only applies to older customer accounts opened with a phone number before an e-mail address was asked for — write to the same address and give the phone number registered to your account. We confirm that the request is yours with a one-time code sent to that number.
In writing: send a signed letter to Trius, Tepebaşı/Eskişehir.
Your application must state your full name, your Turkish ID number (for foreign nationals, nationality and passport or ID number), an address for notices, your e-mail address if any, your phone number, and what you are asking for.
The same routes are open for a machine-readable copy of the data in your account, or for having your account deleted.
We answer as quickly as the request allows and within 30 days at the latest, free of charge; where an action carries a separate cost, only the fee in the tariff set by the Board may be charged (KVKK art. 13).
If your application is refused, the answer is inadequate, or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of applying (KVKK art. 14).
8. How we collect it
Directly from you, electronically, when you fill in a booking form, write a review, create an account and use the platform; staff details come from the business itself.
Termindo sets no advertising or tracking cookies. Your browser keeps only the technical records needed to keep you signed in and to remember your language.
To see which pages of the site are visited and how often, we use Vercel Web Analytics. It sets no cookies, stores nothing on your device and does not identify you: it only counts, in aggregate, the path of the page visited, the referring site, the country, and the browser and device type.
9. Changes to this notice
Every version of this text is numbered and dated. When something material changes you will be asked to accept the new version the next time you use the app; an older acceptance is not carried over.