KVKK Privacy Notice and Privacy Policy

1. Data controller and scope

VISION VENTURES TEKNOLOJİ TASARIM VE PAZARLAMA ANONİM ŞİRKETİ (“Watchlabb”) is the data controller for the membership, listing, store, auction, paid platform services, Trink Saat and support activities it carries out through watchlabb.com and its web app.

Address: Caferağa Mah. Şifa Sk. No: 19, Kolektif House, Kadıköy/İstanbul. Contact: destek@watchlabb.com.

This text informs you about your personal data; it is not a request for general permission to process data or for explicit consent. Where required, your preferences for biometric verification, optional cookies and commercial electronic messages are obtained separately.

2. How is information collected?

Your information is collected electronically through membership and profile fields, phone verification by WhatsApp or SMS, sign-in with Google or Microsoft, e-mail verification of existing accounts, listing and transaction forms, the identity verification service, and payment and support channels. Transaction and security records are generated as the system is used. Documents, reports and product records provided during the Trink Saat hand-over and inspection process may also be linked to the relevant transaction.

When you sign in with Google or Microsoft, we receive the authentication result and the basic account information you allow; we do not receive your password for those services. Verification codes and account access details must not be shared with others.

3. What information is processed, for what purposes and on what grounds?

Membership and communication

Your first name, surname, account ID, phone number, e-mail address, sign-in provider and the information you provide for your profile are processed to set up the account, enable sign-in, manage the profile and provide the service you request. The legal basis is processing directly related to and necessary for the formation or performance of a contract under Article 5/2-c of KVKK (Turkish Personal Data Protection Law No. 6698). Proportionate records needed for access security and the review of misuse are additionally based on legitimate interest under Article 5/2-f.

Listing, store and auction transactions

Listing content, photographs, the ownership verification image, store and authorised representative details, bid and automatic bid preferences, transaction times, and blocking and complaint records are processed to publish content, run the relevant service, put the parties to a transaction in contact with each other where necessary and review misuse. The legal bases are Article 5/2-c for performance of the service, 5/2-f for proportionate security reviews and 5/2-e for the protection of rights in specific claims and disputes.

Listing and store information that you choose to publish can be seen by visitors. Your identity document and your T.C. identity number are not published with the listing. The name, contact and report details shown in a transaction are shared only with the persons that the relevant stage requires. Disclosing the contact details of the relevant parties to each other following an auction is also limited to this purpose.

Photographs uploaded to the listing form may be processed with AI-assisted tools to suggest and check watch details. The ownership verification image and the documents uploaded with a store application may also undergo automated checks; where necessary, our editors review them.

Photographs and watch details of live listings may be shared on Watchlabb’s social media accounts. The name of an individual seller does not appear in these posts; for store listings, the store name is shown.

Identity verification

Identity verification is required for posting listings, placing bids, opening a store and related transaction security checks. Depending on the verification result, first name, surname, date of birth, nationality, T.C. identity number or the relevant personal identification number, document number and type, issuing country, the gender information shown on the document, verification status, and session and review records may be processed. Not every item is collected from every user; the scope varies by document and transaction type.

For linking a verified account to a real person and ensuring the necessary transaction security, non-biometric data are processed, to the extent necessary and proportionate, on the basis of Articles 5/2-c and 5/2-f; and for the review of specific disputes and the protection of rights, on the basis of Article 5/2-e. Where there are requests from competent authorities or an applicable record-keeping obligation, Articles 5/2-a and 5/2-ç apply, limited to the relevant obligation. These grounds do not in themselves justify collecting every identity field from every member or keeping it indefinitely.

Biometric data used for face matching and liveness checks through Didit are special categories of personal data. Biometric processing based on explicit consent is carried out with explicit consent obtained separately under Article 6/3-a of KVKK. Details are explained in the Identity and Biometric Verification Privacy Notice. The general membership process, or viewing this text, is not a substitute for biometric consent.

Paid services and payment

For purchases of Doping, store plans and auction participation tickets, order, plan, price, payment result, transaction number, invoice and contract/acceptance details are processed to provide the service, match the payment and meet financial obligations. The legal bases are Article 5/2-c and, for applicable financial and commercial record-keeping obligations, Articles 5/2-a and 5/2-ç.

Card payments are processed on the iyzico infrastructure. The fact that a card is processed in the payment form does not mean that Watchlabb stores the full card number or the security code in its own database; the payment record holds the last four digits of the card, the card type and the payment institution’s transaction references. Invoices are issued through our e-invoice service provider. The iyzico Privacy Policy applies to the processing that the payment provider carries out under its own obligations.

Trink Saat

Application, offer, net amount, pre-inspection report, objection, hand-over and payment confirmations, together with the necessary identity and IBAN/account holder details, are processed under Article 5/2-c to run the intermediation process and to ensure that hand-over or payment is made to the right person. Records needed to protect rights are kept under Article 5/2-e; applicable financial records are kept under Articles 5/2-a and 5/2-ç. The fact that an IBAN is valid in format does not mean that the account holder has been definitively verified with the bank; additional confirmation may be requested.

Photo or video recordings may be made to document the condition of the product at hand-over, its parts and the inspection procedures. Recordings are limited to the product and the transaction; unnecessary footage of faces, conversations or identity documents should not be recorded. Recordings containing personal data are based on Article 5/2-f, as a proportionate legitimate interest in protecting the parties’ rights, and on Article 5/2-e in a specific dispute. This is not general area surveillance or facial recognition.

WhatsApp and AI support

When you write to the company support line, your phone number, the messages and attachments you send, the related conversation history and the account/transaction information needed to resolve the request are processed. The first reply may be given by an AI assistant. The assistant generates replies using help content and the relevant account context; it passes to the team any matter that it cannot resolve or that requires review by the team. Actions that require authorisation and confirmation are subject to the relevant security checks.

WhatsApp messages are processed through Meta/WhatsApp and the connection infrastructure. OpenAI models and Google Gemini may be used to generate replies; images and voice messages you send may also be processed for content analysis or transcription. Only the necessary content should be passed to service providers. AI replies may contain errors; where transaction confirmation or human review is needed, you can speak to the support team.

Processing needed to fulfil a support request is based on Article 5/2-c; service security and management of the support flow on Article 5/2-f; and records needed to protect rights on Article 5/2-e. Writing to the support line does not count as permission for commercial promotion. Do not send identity documents, card details, passwords, verification codes, health information or unnecessary information belonging to other people through this line.

Security, notifications and preferences

IP address, device/browser information, and session and access records are processed under Article 5/2-f to the extent necessary to keep accounts secure, investigate errors and prevent fraud. Article 5/2-e applies to specific legal claims, and Articles 5/2-a and 5/2-ç to applicable legal obligations.

Verification codes, security alerts, the status of a service you have requested and necessary contract/transaction notifications may be sent through channels relating to the performance of the service. The commercial message consent required for promotional and campaign messages is managed separately. When this consent is withdrawn, the related promotional messages stop; transactional notifications are not treated in the same way.

Non-essential analytics and advertising technologies are used, if you switch on the relevant preference, on the basis of explicit consent under Article 5/1 of KVKK. Details are set out in the Cookie Policy.

4. Who may information be shared with?

Data may be transferred to the hosting/database, identity verification, identity provider, payment, e-invoice, messaging, e-mail, social media posting and AI service providers that provide the necessary service; to the relevant seller, buyer or store to the extent the transaction requires; and to authorised employees and to legal/financial advisers bound by confidentiality obligations. In response to lawful requests, the necessary records are provided to competent public authorities and judicial bodies.

Not every recipient has access to all data. For example, sending a report to a store does not mean that your raw biometric record or your T.C. identity number is disclosed to that store. Your personal data are not made the subject of any standalone data-selling activity; the use of service providers and the sharing required for a transaction are separate activities explained in this text.

5. Service providers abroad

Platform data are held on servers and in a database in Germany (European Union). Because of these servers and of Didit, Google, Microsoft, Meta/WhatsApp, Twilio (WhatsApp and SMS delivery), Resend (e-mail), Zernio (social media posting), browsers’ push notification services and the AI services used, personal data may be processed abroad or accessed from abroad. The use of optional analytics and advertising tools may also fall within this scope.

Transfer abroad requires the conditions in Article 9 of KVKK to be met, as appropriate to the data category and the provider relationship. Using the service, accepting the membership agreement or giving consent for biometric processing does not in itself satisfy the legal conditions for regular transfer abroad. A provider’s privacy link does not replace Watchlabb’s transfer obligations either.

6. Retention, security and deletion

Data are kept only for as long as necessary for the relevant purpose and within the limits of applicable legal obligations. An account with no transactions is not archived to the same extent as an account with listing, payment, hand-over or dispute records.

A 30-day deletion plan applies to the raw identity and face records in the Didit verification session. The verification summary that remains at Watchlabb is separate from these raw records and is kept for the duration of membership. Any valid reason requiring deletion before the period expires, or any specific legal retention requirement, is assessed separately.

Each message and attachment on the support line is deleted 30 days after the date it was sent. If a record needed for a specific complaint or dispute is set aside, it is kept only to the extent of the relevant right and for the relevant period. This period is not the retention period of your own copy on WhatsApp or of the records the provider keeps under its own legal obligations.

The retention periods are as follows: order and payment records for paid services, 10 years; invoice copies on the Platform, 5 years; after account deletion, the deleted account record, transaction archive and contract acceptance records, 10 years; commercial message consent and withdrawal records, 3 years; notification delivery records, 6 months; administrator action records, 2 years. Data whose period has expired are deleted. Database backups are kept for 7 days and are deleted automatically at the end of that period; deletion requests are applied again whenever a backup is restored. Duty-limited access, authorisation and appropriate technical/administrative measures are applied to records. Absolute security cannot be guaranteed on the internet.

Details are explained in the Account and Data Deletion Policy.

7. Your rights and how to apply

Under Article 11 of KVKK, you have the right to learn whether your data are processed; to request information if they have been processed; to obtain information about the purpose of processing and whether the data are used in line with that purpose; to know the recipients in Turkey and abroad; and to request the correction of incomplete or inaccurate data, their erasure/destruction where the conditions are met, and notification of these actions to recipients. You may also object to an outcome against you that results solely from automated analysis, and claim compensation for damage arising from unlawful processing.

You can send your requests in writing to the company address above, or from the e-mail address you have previously notified to our company and that is registered in our system to destek@watchlabb.com. Secure electronic signature, mobile signature and the other valid application methods set out in the Communiqué are also preserved. If you cannot access your account, support can help you with a suitable way to apply.

In your application, state your first name, surname, request, contact details for notification and the identity details required by the legislation; sign any written application. Necessary and proportionate information may be requested to verify that the application is yours. A copy of an identity document or a notarial procedure is not required for every application. To delete your account, you can also use the deletion function in your profile.

Applications are concluded as soon as possible and within 30 days at the latest. The acceptance of the request, or a reasoned reply, is notified in writing or electronically. As a rule, applying is free of charge; exceptional fees permitted by the legislation are reserved. Data Subjects’ rights under the legislation to complain to the Board and to make other applications are preserved.

8. Updates

This text is updated for significant changes in processing activities, and information is given at the relevant point of data collection. An update to this information does not by itself create new explicit consent; where a processing activity requires new permission, the appropriate preference is obtained separately. Rights arising from other mandatory data protection provisions are reserved.