Messaging Privacy Notice

Within Messaging, the following personal data may be processed:

• Identity and profile data: first name, last name and profile photo; for Experts, also title and username.
• Contact data: your email address, so that we can send you notification emails about messages.
• Message content: the messages and message requests you write in conversations and the image and PDF files you attach to them.
• Transaction data: your appointment relationship with the Expert (whether a paid session or a free intro took place), your message allowance and messaging windows, the status of message requests (pending, accepted, not answered), whether a conversation was closed or blocked, and read receipts.
• Request and complaint data: if you report a conversation, the reason, your explanation and the outcome of the report.
• Transaction security data: the times at which messages are sent, system logs and a record of every access to conversation content by authorised staff (who accessed it, when and why).

Your personal data is processed for the following purposes:

• providing Messaging: delivering your messages and attachments to the other party and allowing both parties to view the conversation history;
• determining message allowances and messaging windows linked to appointments; delivering, accepting and declining message requests and closing expired requests;
• sending in-platform notifications and email notifications about messages (reply notifications and the daily summary);
• operating the controls offered to Experts, such as closing a conversation, blocking a person and turning off message requests;
• receiving, reviewing and resolving complaints;
• preventing unwanted messages, harassment, fraud and misuse of the Platform, and ensuring information security;
• establishing, exercising or protecting rights in legal disputes and responding to requests from competent authorities under the legislation.

This data is processed on the following legal grounds under Article 5(2) of the Law:

• (c) — processing is necessary, provided that it is directly related to the establishment or performance of a contract, for the personal data of the parties to the contract: providing Messaging, managing message allowances and sending notifications under the Membership Agreement and the appointment service.
• (ç) — processing is necessary for the data controller to comply with a legal obligation: requests from competent authorities under the legislation.
• (e) — processing is necessary for the establishment, exercise or protection of a right: resolving complaints and disputes.
• (f) — processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject: ensuring Platform security, preventing misuse and recording accesses to content.

• Your messages are seen by the parties to the conversation, that is, you and the Expert or User you are writing to.
• Devolay staff do not read message content in the ordinary course. Content may be viewed only by specifically authorised staff, with a written reason, when reviewing a complaint, carrying out a check on Platform security or misuse, or complying with a legal obligation.
• Every access to content is logged with who accessed it, when and why. Attachments can be accessed only after such a reasoned access record has been created, through short-lived links.
• Message content is never included in notification emails; emails only say who wrote to you.

Your personal data may be transferred to the following recipients, limited to the purposes above:

• The other party to the conversation: by the nature of Messaging, your messages and attachments, together with your profile information, are delivered to the Expert or User you are writing to. To assess message requests, Experts also see whether you have had an appointment relationship with them before.
• Service providers: cloud infrastructure, database and file storage providers hosting the Platform, and email delivery providers. Their servers may be located abroad; in such cases transfers are carried out in accordance with the procedures and principles set out in Article 9 of the Law.
• Competent public authorities: under requests and obligations arising from the legislation, limited to the information requested.

Under Article 11 of the Law, by applying to the data controller you have the right to:

• learn whether your personal data is processed;
• request information if your personal data has been processed;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties to whom your personal data is transferred in Türkiye or abroad;
• request rectification if your personal data is incomplete or inaccurate;
• request erasure or destruction of your personal data under the conditions set out in Article 7 of the Law;
• request that rectification, erasure and destruction be notified to third parties to whom your personal data has been transferred;
• object to a result against you arising from the analysis of your data exclusively by automated systems;
• claim compensation for damage suffered as a result of unlawful processing of your personal data.