Identity and Biometric Verification Privacy Notice

1. Data controller and purpose of verification

The data controller is VISION VENTURES TEKNOLOJİ TASARIM VE PAZARLAMA ANONİM ŞİRKETİ (“Watchlabb”); its address is Caferağa Mah. Şifa Sk. No: 19, Kolektif House, Kadıköy/İstanbul, and its contact address is destek@watchlabb.com.

For transactions that require verification, such as posting a listing, bidding in an auction, opening a store and Trink Saat, we check that the account belongs to a real person and that the person carrying out the transaction is the person on the identity document. The purpose is to reduce the risk of transactions on someone else’s behalf and of the use of false accounts and identities, to identify the person behind a transaction and to be able to respond to necessary legal requests with accurate records.

Verification does not guarantee that a watch is original, its ownership, a person’s ability to pay, or that all of their conduct in a transaction is safe. Functions that require identity verification may not be available until verification is complete; general viewing of listings is not covered in the same way.

2. How is it done and what information is processed?

Verification is carried out on the Didit infrastructure. An identity document is submitted; in the enabled verification steps, the face photo on the document is compared with a selfie/face image and a liveness check is performed. Biometric data derived from facial features may be processed for face matching and the liveness assessment. A camera image or a short image sequence/video may be captured, depending on the verification step used.

Depending on the document type, first name, surname, date of birth, nationality, T.C. identity number or the relevant personal identification number, document number, document type, issuing country and other verification information on the document are processed. Verification session, timestamp, IP/device information, result, alert and review records may also be generated. Not every field found on a document type is collected from all users.

On Watchlabb’s side, first name/surname, date of birth, nationality, personal identification and document number/type, issuing country, the gender information shown on the document, verification status, session reference and necessary review records may be held. The raw identity photo, the selfie and biometric templates are not the same data as the summary of the verification result. In the integration as reviewed, this raw media is not copied to Watchlabb’s membership database; it is processed through the verification service.

A user reference separate from the verification session may also be created on Didit, and the account/verification status may be synchronised. This record is not assessed on the assumption that deleting the verification session automatically deletes all of the provider’s records.

3. Legal grounds and biometric consent

Verifying identity with non-biometric fields and linking the account to a real person are based, to the extent necessary and proportionate, on Article 5/2-c of KVKK (Turkish Personal Data Protection Law No. 6698) for performance of the service; on Article 5/2-f for a legitimate interest, which does not harm fundamental rights, in preventing fraud and misuse; and on Article 5/2-e for specific rights and disputes. Where there is a valid legal obligation or a request from a competent authority, Articles 5/2-a and 5/2-ç apply within the relevant scope.

Biometric data are special categories of personal data. For face matching and liveness operations based on explicit consent, separate, specific and informed explicit consent is obtained under Article 6/3-a of KVKK. Legitimate interest is not, on its own, a condition for processing biometric data.

Reading this notice, accepting the membership agreement, technically enabling camera permission or browsing the site does not replace explicit biometric consent. The Biometric Identity Verification Explicit Consent text is presented separately before the process begins.

If you have a question about the biometric method, or would like an assessment by a method other than this one, you can contact the support channel. The request is reviewed in the light of the security purpose and the verification options available; this application does not give a right to automatic verification or to carry out transactions unconditionally. The requirement for identity verification is not the same as giving consent to a particular biometric method.

4. Sharing and processing abroad

Didit acts as a service provider/data processor with regard to the verification purpose and the enabled steps determined by Watchlabb. Its limited independent purposes, such as its own security and applicable legal obligations, are explained separately in Didit’s documents. Authorised infrastructure providers involved in the service on Watchlabb’s behalf may also access the necessary data.

The verification result may be reviewed by Watchlabb employees with the necessary authorisation. Raw face data or an identity document is not disclosed to the other party merely because a match has occurred in an auction or a report has been sent to a store. Records required by a lawful request may be provided to competent authorities.

Data may be processed or accessed abroad because of Didit and its service chain. This transfer must be set up in compliance with the conditions in Article 9 of KVKK. Consent to biometric processing does not on its own satisfy the requirements for regular transfer abroad.

5. Retention and deletion distinctions

Our retention plan for raw identity images and face records in the Didit verification session is 30 days. If the purpose ends earlier or a valid reason for deletion arises, action is taken accordingly; mandatory exceptions relating to a specific legal obligation or dispute are assessed separately. This plan does not allow raw biometrics to be kept indefinitely merely because the verified membership continues.

The verification summary at Watchlabb (the necessary identity fields, the verification result and the session reference) is kept for the duration of membership. When an account is deleted, the first name, surname and T.C. identity number of a member with a transaction history are kept in the deleted account record for 10 years; the other fields are deleted. The need to identify the person behind a transaction is not a reason to keep raw documents and face data indefinitely.

Account deletion, withdrawal of biometric consent, deletion of the verification session and closure of the Didit user record may affect different scopes. When a request is received, which records will be deleted, the instruction to be given to the provider and the limited evidence that must legally remain are assessed together. When an account is deleted, the Didit verification sessions and user record of a member with no transaction history are deleted; for a member with a transaction history, these records are deleted after 10 years. Access rights and the backup/destruction cycle are also managed with this distinction in mind.

6. Objecting to the result and withdrawing consent

The verification result may be produced by automated checks or may be put under review. You can ask support for a human review of an incorrect rejection, a match or a result against you. Reviewing the request does not mean that the verification result will necessarily change.

You can withdraw your explicit consent, with effect for the future, via destek@watchlabb.com. After notification, new biometric processing based on consent is stopped and an appropriate deletion instruction for the relevant data is considered. Withdrawal does not retroactively invalidate lawful processing carried out in the past; nor does it mean that necessary processing based on another valid ground and all evidence of consent will be deleted.

Your rights under KVKK to information, correction, erasure, notification of recipients, objection to an automated result and your other rights, together with the application procedure, are explained in the KVKK Privacy Notice and Privacy Policy. Applications are concluded within 30 days at the latest.

7. Didit’s related documents

Further explanations about the verification service are available in the Didit Verification Privacy Notice, the Didit Biometric Data Retention and Destruction Policy and the Didit Identity Verification End User Terms. These documents do not replace Watchlabb’s notice or its own obligations.