Privacy Policy

The data controller (veri sorumlusu) for personal data processed through Sosomak is Supina Teknoloji A.Ş., Fevziçakmak, Sıla Cd. Kobisan 3, No: 73 F, 42050 Karatay/Konya, TÜRKİYE, phone +90 (0332) 503 55 25 (Tax office: 000 000 0011, Trade Registry Number: 70037).

This Privacy Policy explains how we process personal data under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the European Economic Area, the EU General Data Protection Regulation (“GDPR”). It also serves as our information notice (aydınlatma metni) under Article 10 of KVKK.

• Identity and contact data: name, email, phone number, country of residence, preferred and spoken languages, profile photo, company name.
• Account data: login details, account type, settings, notification preferences.
• Provider verification data: identity documents, business and tax registration, licences, certificates, insurance documents, legal name. These are used only for verification and are never shown publicly.
• Request and booking data: what you ask for, cities, dates, number of people, budget, special requirements, Offers, Bookings, delivery approvals, cancellations and disputes.
• Messages and Content: chats with Providers, Customers and the Sosomak Team, reviews, photos and files you upload.
• Payment data: payment status, amounts and partial card details (brand and last four digits). Full card data is processed by our licensed payment service provider, not by Sosomak. For Providers: payout bank account (IBAN) and tax details.
• Technical data: IP address, device and browser information, log records, cookies and similar technologies.
• Special categories: we do not ask for health or other sensitive data. If you choose to include such data in a Request (for example for accessibility or medical-visit support), we process it only with your explicit consent and only to arrange your Request.

• Creating and running your account, and providing the Platform: Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
• Sending Requests to Providers and Offers to Customers, matching, messaging, Bookings: Performance of a contract
• Verifying Providers and keeping the marketplace safe: Legitimate interest and legal obligation (KVKK Art. 5(2)(ç), (f); GDPR Art. 6(1)(c), (f))
• Processing Protected payments, refunds, payouts and invoices: Contract and legal obligation, including tax and commercial record keeping
• Handling disputes, complaints and legal claims: Establishing, exercising or defending rights (KVKK Art. 5(2)(e)); legitimate interest
• Customer support and service messages: Contract and legitimate interest
• Preventing fraud and abuse, keeping logs required by Law No. 5651: Legal obligation and legitimate interest
• Improving the Platform with statistics and analytics cookies: Explicit consent where required; otherwise legitimate interest
• Marketing emails and newsletters: Explicit consent, which you can withdraw at any time

• Other Users, only as needed: when you send a Request, matching Providers see its details; when you book, the Provider receives your name and the contact details needed to deliver the service. Public profiles, listings and reviews are visible to everyone.
• Payment service provider licensed under Law No. 6493, for Protected payments, refunds and payouts.
• Service providers that work for us: hosting, email and SMS delivery, customer support tools, analytics, identity and document verification. They act on our instructions and must protect the data.
• Authorities, courts and public bodies, when required by law or to protect rights.
• Professional advisers such as lawyers, auditors and accountants, under confidentiality.
• A buyer or successor of our business, if it is reorganised or sold, under the same protections.

We do not sell your personal data.

Some of our service providers may store or process data outside Türkiye, and Providers or Customers may be located abroad. Where data is transferred abroad, we do so in line with Article 9 of KVKK (as amended in 2024), for example on the basis of an adequacy decision, standard contracts notified to the Personal Data Protection Authority, or, for occasional transfers, other conditions the law allows. For EEA users, transfers follow Chapter V of the GDPR, for example using the European Commission’s Standard Contractual Clauses.

• Account data: while your account is open, then up to 2 years to handle any remaining questions or claims.
• Bookings, payments, invoices and related messages: 10 years, as required for commercial and accounting records under the Turkish Commercial Code and the Tax Procedure Law.
• Provider verification documents: while the Provider account is open, then as long as needed for legal claims, normally up to 10 years.
• Traffic and log data: as required by Law No. 5651 and related rules.
• Marketing data: until you withdraw consent.
• When data is no longer needed, we delete, destroy or anonymise it under our data retention and disposal policy.

Under Article 11 of KVKK you have the right to:

• learn whether your personal data is processed, and request information about it;
• learn the purpose of processing and whether it is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of data under the conditions in Article 7 of KVKK;
• request that third parties who received your data are notified of corrections or deletions;
• object to a result against you arising exclusively from automated analysis;
• claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time.

How to apply: use the Contact page (topic “Personal data request”), message the Sosomak Team from your account, or write to Fevziçakmak, Sıla Cd. Kobisan 3, No: 73 F, 42050 Karatay/Konya, TÜRKİYE, marked “KVKK Başvurusu”. We may ask you to confirm your identity. We answer free of charge within 30 days, unless the law allows a fee for complex requests. If you are not satisfied, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, in the EEA, to your local data protection authority.

• Strictly necessary: keep you logged in, remember your language and currency, protect forms. These are always on.
• Preferences: remember choices such as filters and favourites.
• Analytics: help us understand how the Platform is used. Used only with your consent where required.
• Marketing: we do not use advertising cookies at launch. If we add them, we will ask for your consent first.

You can change your choices at any time in your browser and in the cookie settings link in the footer of the live site.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls based on staff roles, logging of administrative actions, and regular reviews. Verification documents and bank details are stored with restricted access. If a data breach is likely to affect you, we will notify you and the authorities as required by law.

Sosomak is not intended for people under 18, and we do not knowingly collect their personal data. Services for families with children are booked by adults, who are responsible for the information they share.

We may update this Privacy Policy. We will show the date of the latest version at the top of this page and tell you about material changes by email or in your account.

For any privacy question, contact Supina Teknoloji A.Ş., Fevziçakmak, Sıla Cd. Kobisan 3, No: 73 F, 42050 Karatay/Konya, TÜRKİYE, phone +90 (0332) 503 55 25, or use the Contact page.