KVKK Privacy Notice

1. Data Controller

Your personal data is processed by the following company acting as the data controller:

• ITHINGS YAZILIM VE TEKNOLOJİ A.Ş.
• Address: Yıldız Teknik Üniversitesi Teknopark — Kuluçka Merkezi, Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. A1 Blok No:151/1C İç Kapı No:B35, 34220 Esenler/İstanbul
• MERSIS No: 0469161209200001
• Email: info@wishmate.net

2. Categories of Personal Data Processed

Depending on the features you use, the following personal data may be processed:

• Identity: first and last name, username, date of birth (optional) and profile photo (optional).
• Contact: email address, phone number (if you use phone sign-in or verification) and delivery address (optional).
• Account and security: sign-in method (email, Google, Apple or phone), account identifiers, session and security records.
• Social interaction: friendships and friend requests, friend groups, blocked users, likes and saved items; if you grant contacts permission, contact details in your address book for finding friends.
• Content: wishlists and items (name, link, image, price, note), reservations and gift requests, feed posts, messages and support conversations, events, polls and Secret Santa assignments.
• Campaigns and prize draws: prize draw entries and results, coupon usage and clicks on partner links.
• Device and usage: device type and operating system, app version, notification tokens, in-app interactions, error and performance logs; cookies and similar technologies on the website.
• WishNe gift assistant (only if you use it): the messages you write to the assistant.

3. Purposes of Processing

• Creating your membership, verifying your identity and managing your account
• Providing wishlist, reservation, gift request, event, messaging and feed features
• Sharing your delivery address with the relevant user, according to your address setting, so that a reserved gift can reach you
• Sending notifications about special days, reservations, friendships and events
• Running prize draws and campaigns, selecting winners and delivering prizes
• Redirecting you to partner stores and matching affiliate commissions
• Answering support requests and communicating with you
• Ensuring information security and preventing abuse and fraud
• Improving the service, fixing errors and producing aggregate usage statistics
• Sending commercial electronic messages (newsletter, announcements) if you consent
• Fulfilling legal obligations and responding to requests from competent authorities

4. Legal Grounds

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:

• Establishment and performance of a contract (Art. 5/2-c): providing the services you request, such as membership, lists, reservations, messaging, events and prize draws.
• Legal obligation (Art. 5/2-ç): record-keeping, retention and disclosure obligations arising from legislation.
• Data made public by the data subject (Art. 5/2-d): lists whose visibility you set to "Everyone" and the profile details shown with them.
• Establishment, exercise or protection of a right (Art. 5/2-e): records to be used as evidence in potential disputes.
• Legitimate interest (Art. 5/2-f): service security, abuse prevention, error fixing and aggregate usage statistics.
• Explicit consent (Art. 5/1): commercial electronic messages, analytics cookies, contact matching and the transfer of messages written to the WishNe gift assistant to a service provider abroad. You may withdraw your consent at any time.

5. Method of Collection

Your personal data is collected electronically through the forms you fill in, the content you create and the permissions you grant in the app and on the website; from Google or Apple when you sign in with them; and automatically through cookies and similar technologies while you use the app and the website.

6. Information Visible to Other Users

• Your name, username and profile photo are visible to other WishMate users.
• Lists whose visibility you set to "Everyone" may also appear, together with your name and profile photo, in the feed and discovery areas of users you do not know.
• If your address setting is "Share with reservers", your delivery address is shown only to a user who reserves an item from your list, so that the gift can reach you. You can turn sharing off with the "Only me" option and accept or decline address requests one by one.
• Content you share in events and chats is visible to the participants of that event or chat.

7. Transfer of Personal Data

Your personal data may be transferred to the following recipients, limited to the purposes above:

• Service providers: Google (Firebase, Google Cloud) for hosting, database, authentication, notifications, error and usage analytics; Cloudflare for content delivery and security; email service providers for sending emails and newsletters; SMS and messaging providers for phone verification.
• Sign-in providers: Google or Apple, for authentication, if you choose to sign in with them.
• Artificial intelligence provider: if you use the WishNe gift assistant, the messages you write to it are transferred to DeepSeek (People's Republic of China) to generate replies. This feature is optional and based on your explicit consent.
• Partner stores and affiliate networks: when you click a partner link, only a click number that does not directly identify you is passed on; commissions are matched with this number. Your name, email address or phone number is not shared.
• Prize draw rewards: if you win a prize draw, the contact and address details needed to deliver the prize may be shared only with the partner or courier company delivering it, solely for that purpose.
• Competent authorities: public institutions and judicial authorities authorised by law, upon request and to the extent required by legislation.

Transfers abroad: Because our service providers' servers are located abroad, mainly in the United States and European Union countries, your personal data is transferred abroad. These transfers are carried out in accordance with Article 9 of the KVKK, with appropriate safeguards such as standard contracts set by the Personal Data Protection Board and, where required, your explicit consent.

8. Retention Period

Your personal data is retained as long as your account remains open and the purpose of processing continues. When you delete your account, your data is deleted, destroyed or anonymised, except for the periods required by legal retention obligations and potential disputes.

More information: Data Deletion Policy

9. Your Rights Under Article 11 of the KVKK

By applying to the data controller, you may exercise the following rights:

• To learn whether your personal data is processed
• To request information if your personal data has been processed
• To learn the purpose of processing and whether your data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom your personal data is transferred
• To request correction if your personal data is incomplete or inaccurate
• To request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK
• To request that corrections, deletions or destructions be notified to third parties to whom your data was transferred
• To object to a result against you arising from analysis of your data exclusively through automated systems
• To claim compensation if you suffer damage due to unlawful processing of your personal data

10. How to Apply

You can submit requests concerning your rights, together with information that identifies you, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following methods:

• By sending an email to info@wishmate.net from the email address registered to your WishMate account, or signed with a secure electronic or mobile signature
• By delivering a wet-signed petition in person to the address above or sending it through a notary public

Your application will be concluded free of charge as soon as possible according to the nature of the request, and within 30 days at the latest. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged.