Skip to content
Tonelle
Tonelle

Legal

Start analysis
Back to home

KVKK Privacy Notice

This notice is provided by Doribleg Trade Ltd as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform users of Tonelle about the processing of their personal data. The Turkish version of this notice is the authoritative text.

01. Data controller

Data controllerDoribleg Trade Ltd
AddressSuite 10550, 5 Brayford Square, London E1 0SG, United Kingdom
Emailprivacy@tonelleapp.com

02. Personal data processed

  • Visual data: your facial image (selfie). As a facial image may qualify as biometric data, a special category of personal data, it is processed only with your explicit consent.
  • Analysis data: undertone, skin depth, contrast, face and eye shape, colour season and shade suggestions derived from your photo (stored only on your device).
  • Preference data: questionnaire answers (skin type, eye colour, occasion, budget, experience).
  • Customer transaction data: anonymous app user ID, subscription and purchase status.
  • Transaction security data: IP address, device/browser information, request times.
  • Communication data: email address and message content if you contact us.

03. Purposes of processing

  • Performing colour and makeup analysis on your facial image and, for Premium users, generating makeup previews;
  • Providing personalised look, shade and step-by-step recommendations;
  • Managing subscriptions and purchases and checking Premium entitlement;
  • Ensuring information and transaction security, preventing abuse, rate limiting;
  • Answering requests and complaints;
  • Fulfilling legal obligations and responding to requests of authorised public bodies.

04. Method of collection and legal grounds

Personal data is collected electronically and partly by automated means through the Tonelle website and mobile applications, when you take or upload a photo, answer the questionnaire, make a purchase or contact us.

  • Facial image: your explicit consent (KVKK Art. 6(2)).
  • Preference, customer transaction data: processing is necessary for the establishment or performance of a contract (Art. 5(2)(c)).
  • Transaction security data: processing is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms (Art. 5(2)(f)).
  • Records required by law: compliance with a legal obligation (Art. 5(2)(ç)).
  • Communication data: establishment or performance of a contract and our legitimate interests (Art. 5(2)(c) and (f)).

Your photo is not stored: it is deleted when the analysis request ends. Analysis results are kept only on your device.

05. Transfer of personal data (including abroad, Art. 9)

To provide the Service we transfer personal data to service providers located abroad: hosting (Vercel Inc., servers in the EU), AI analysis and image generation (Google LLC, USA), website payments (Paddle.com Market Ltd, United Kingdom) and app subscription management (RevenueCat, Inc., USA). In-app payments are processed by Apple Inc. and Google LLC.

Transfers abroad are carried out in accordance with KVKK Article 9: primarily on the basis of standard contracts announced by the Personal Data Protection Board and notified to the Authority within five business days of signature (Art. 9(4)). Where such safeguards cannot be applied, data is transferred only occasionally and with your explicit consent (Art. 9(6)(a)).

Personal data may also be shared with authorised public institutions where required by law.

06. Your rights under Article 11

You have the right to:

  • learn whether your personal data is processed;
  • request information if it has been processed;
  • learn the purpose of processing and whether data is used in line with that purpose;
  • know the third parties in Türkiye or abroad to whom data is transferred;
  • request correction of incomplete or inaccurate data;
  • request deletion or destruction of data under the conditions of Article 7;
  • request that correction, deletion or destruction be notified to third parties to whom data was transferred;
  • object to a result against you arising from analysis exclusively by automated systems;
  • claim compensation for damages arising from unlawful processing.

You can exercise these rights by applying to us as described below.

07. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in writing to Suite 10550, 5 Brayford Square, London E1 0SG, United Kingdom or by email to privacy@tonelleapp.com from an email address you have previously shared with us. Your application must include your name, signature (for written applications), contact address and a clear description of your request.

We will respond free of charge within 30 days at the latest. If the response requires an additional cost, a fee may be charged according to the tariff set by the Board. If your application is rejected or the answer is insufficient, you may lodge a complaint with the Personal Data Protection Board within the periods set out in Article 14.