Privacy & Security Policy

Our Approach to Your Privacy

This policy explains how personal data is handled in connection with Royal Touch Spa & Turkishbath, our website, enquiries, reservations, and customer communications. It is intended to be read alongside any specific privacy notice provided when information is collected.

The principal framework addressed by this policy is Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”). Other mandatory laws may also apply, depending on the circumstances.

1. Data Controller

The data controller is the legal person or individual operating Royal Touch Spa & Turkishbath and determining the purposes and means of the processing described in this policy.

Trading Name

Royal Touch Spa & Turkishbath

Legal Name of the Data Controller

[COMPLETE: registered company name or proprietor’s legal name]

Registered / Privacy Correspondence Address

[COMPLETE: full postal address for the data controller]

Privacy Contact Email

[COMPLETE: monitored privacy contact email]

Telephone

+90 530 379 54 71

Website

royaltouchspaturkishbath.com

2. Information Collected

Depending on your interaction with us, the relevant information may include:

• Identity and contact details: your name, telephone number, and email address where provided.
• Enquiry and reservation information: requested service, appointment date and time, number of guests, and messages relating to your booking.
• Transaction and billing information: service purchased, amount, payment status, and details legally required for invoices, refunds, or accounting.
• Customer correspondence: questions, complaints, feedback, and records needed to respond to them.
• Technical information: information generated when a website is accessed, potentially including IP address, browser information, request timestamps, and security or error logs, depending on the website configuration.
• Preference records: any recorded consent, withdrawal, or communication choices.

Information is collected directly through the communication channels you use, during booking or service delivery, and, where configured, automatically through website infrastructure and permitted tracking technologies.

Please provide only information needed for your request. Do not send passwords, full payment card details, or unnecessary identity documents through enquiry messages.

3. Purposes & Legal Grounds

Enquiries, Reservations & Service Delivery

Contact details, booking preferences, and relevant correspondence are used to respond to requests, arrange appointments, deliver agreed services, and communicate changes. Where directly necessary, the legal ground is the establishment or performance of a contract under Article 5 of the KVKK.

Accounting & Legal Obligations

Transaction and identification details required by applicable rules are processed to issue invoices, maintain statutory records, and respond to lawful requests. The relevant grounds are an express legal requirement or compliance with a legal obligation, as applicable.

Security & Dispute Handling

Relevant technical records and correspondence may be processed to prevent misuse, investigate incidents, and establish, exercise, or protect legal rights. Processing may rely on the protection of a right or a legitimate interest, provided that the applicable conditions are met and your fundamental rights and freedoms are not prejudiced.

Optional Marketing & Tracking

Where explicit consent is required for promotional communications or optional tracking, that consent must be obtained separately for the relevant purpose. Refusing optional processing does not by itself prevent you from making a booking.

If information is legally or contractually necessary, we will explain this when requesting it. Not providing necessary information may prevent the relevant transaction or request from being completed.

4. Sensitive Information

Health information is special category personal data. Please do not send medical reports, diagnoses, medication lists, or other sensitive information through ordinary website enquiries or WhatsApp messages.

If a particular service requires a suitability or safety assessment involving health information, a separate notice must explain the necessary information, purpose, recipients, retention, and applicable processing condition under Article 6 of the KVKK before it is collected.

A booking request alone is not explicit consent to process health information. An ordinary contractual ground does not, by itself, authorise the processing of special category data.

5. Cookies & Website Measurement

Cookies and similar technologies can support website operation, remember preferences, or measure activity. Their actual use depends on the tools installed and enabled on this website.

• Strictly necessary technologies: support functions essential to providing a service you explicitly request or transmitting communications.
• Optional preference technologies: remember additional choices that are not essential to the requested service.
• Analytics and advertising technologies: may measure visits, button clicks, campaign performance, or interactions, where implemented.

Where consent is required, optional technologies must remain inactive until you make an affirmative choice. You should be able to reject optional tracking and withdraw consent as easily as you gave it. Continuing to browse is not a substitute for that choice.

If click measurement is enabled for WhatsApp, telephone, or location buttons, it may record an interaction with that button. A click does not establish that a reservation was completed or disclose the content of a later WhatsApp conversation.

You can also manage stored cookies using your browser settings. Blocking necessary cookies may affect website functionality. Browser settings do not necessarily replace the website’s consent-withdrawal controls.

6. WhatsApp & External Services

Our website provides links to WhatsApp for enquiries and reservations, telephone links for calls, and external map links for directions. Following an external link takes you to a service operated by another provider.

If you contact us through WhatsApp, we receive the information you send and the profile or contact information made available through that service. We use relevant messages to handle your enquiry or reservation under the grounds described above.

External providers process information under their own terms and privacy notices. Their processing may involve infrastructure outside Türkiye. Please review those notices before choosing to use their services.

Choosing an external service does not remove our responsibility for personal data that we receive or process. You may use the telephone or the privacy correspondence channels listed in this policy if you prefer another contact method.

7. Sharing & Overseas Transfers

Where necessary and supported by an applicable legal ground, information may be disclosed to the relevant recipient categories for the following purposes:

• Authorised personnel: handling enquiries, reservations, and service delivery.
• Technical service providers: hosting, maintaining, supporting, and securing website or business systems, where engaged.
• Payment and professional service providers: handling payments, accounting, legal advice, or disputes, where relevant.
• Competent public authorities: meeting a lawful disclosure obligation or request.

Any transfer abroad must satisfy Article 9 of the KVKK. Depending on the circumstances, this may require an applicable adequacy decision or an appropriate safeguard, together with the relevant processing condition. Exceptional transfer routes may be used only when their specific legal requirements are met.

Accepting this policy or clicking an external link is not a blanket authorisation for all overseas transfers.

8. Data Retention

Personal data must not be retained longer than required by applicable law or the legitimate purpose for which it is processed. The relevant period depends on the category of record and the circumstances.

• Enquiry and reservation records are assessed against the service relationship, follow-up needs, and applicable periods for legal claims.
• Invoice and accounting records are subject to the statutory retention requirements that apply to the business.
• Technical and security logs require a proportionate period based on their purpose and any applicable legal obligation.
• Consent and withdrawal records may be retained as needed to demonstrate compliance and honour your preferences.

Once the applicable grounds for retaining identifiable data cease to exist, it must be deleted, destroyed, or anonymised in accordance with the applicable rules. A lawful preservation requirement or ongoing dispute may affect the relevant period.

[COMPLETE: approved retention periods or sufficiently specific criteria for each actual data category, including backup deletion arrangements.]

9. Information Security

We are responsible for implementing appropriate technical and organisational measures against unlawful processing, unauthorised access, and unlawful loss of personal data, taking account of the nature of the information and the risks.

[COMPLETE: verified safeguards actually in operation, such as access restrictions, secure transmission, account protection, updates, backup controls, staff confidentiality, and incident-response arrangements. Do not list measures that have not been implemented.]

No website, communication channel, or storage system can guarantee absolute security. This does not limit our legal duties to protect information and respond appropriately to incidents.

Where personal data is unlawfully obtained by others, the incident must be assessed and any required notifications made to the competent authority and affected individuals within the applicable legal time limits.

If you suspect that a message claiming to come from us is fraudulent, verify it using our published telephone number. Never disclose passwords or payment authentication codes through unsolicited messages.

10. Marketing Preferences

Booking confirmations, appointment changes, and responses to your enquiries are service communications. Promotional messages are a separate purpose and are subject to the applicable privacy and commercial communication rules.

Where promotional consent is required, it must be obtained separately. You may withdraw it through the opt-out method supplied with the communication or by contacting us. Withdrawal does not affect processing lawfully carried out before withdrawal.

A limited suppression record may be necessary to ensure that your opt-out continues to be respected.

11. Your Rights

Subject to the applicable conditions and exceptions, Article 11 of the KVKK gives you the right to:

• Learn whether your personal data is processed.
• Request information about that processing.
• Learn the processing purposes and whether data is used consistently with those purposes.
• Know the third parties receiving your data in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction when the conditions under Article 7 are met.
• Request notification of relevant corrections or deletions to recipients.
• Object to a result against you arising exclusively from automated analysis.
• Seek compensation for damage caused by unlawful processing.

12. Privacy Requests & Complaints

Address formal requests to the data controller identified in Section 1. Requests may be submitted in writing to its postal address or through another legally recognised method, including an eligible registered email or electronic signature channel where available.

Your application should contain your name, surname, signature if submitted in writing, the identification details required by the applicable application rules, an address for the response, and a clear description of your request. Include relevant supporting documents where necessary. Identity verification must be proportionate to the request.

Requests must be resolved as soon as possible and no later than 30 days. They are generally free of charge; a fee may apply only where permitted under the applicable tariff. The response will be provided in writing or electronically.

If your request is rejected, the response is insufficient, or no response is provided in time, you may complain to the Personal Data Protection Board within the applicable time limits: generally within 30 days of learning of the response and, in all cases, within 60 days of your application.

Telephone and WhatsApp enquiries can help you identify the appropriate application channel, but do not automatically replace the formal application requirements.

13. Children’s Privacy

Children should not submit personal or health information through online enquiry channels without appropriate involvement from a parent or legal guardian. Where a service involves a minor, the applicable legal capacity, authorisation, and privacy requirements must be assessed separately.

Please contact the data controller if you believe a child’s information has been submitted inappropriately so that the circumstances can be reviewed.

14. Changes to This Policy

This policy may be updated to reflect changes in services, processing activities, or applicable requirements. The current version will display its update date.

Where a change requires additional notice or a new consent, publishing an updated policy alone does not replace that requirement.