Personal data protection (KVKK)

Data controller

Your personal data is processed by İzy Dent Ağız ve Diş Sağlığı Merkezi, which operates the İZY Dentiste dental clinic, as data controller.

Address: Mehmetçik Mah., Termesos Blv. No: 20CA, 07050 Muratpaşa/Antalya, Türkiye Registration: Antalya Kurumlar Vergi Dairesi – 3231227069 E-mail: [email protected] Phone: +90 534 778 5008

Categories of personal data processed

- Identity: first and last name. - Contact: phone/WhatsApp number, e-mail address (optional). - Health data (special category of personal data): the treatment you are interested in; photos, X-rays and information about your oral health that you choose to send us. - Customer transactions: your request, the content of our conversations, the request status and the team's notes, the date of your consent and the version of the text you accepted; if you ask us to organise your stay, travel details (dates, flight, number of companions). - Marketing: information on the origin of your request (page and language from which the form was sent, landing page, referring website, campaign link parameters: utm_source, utm_medium, utm_campaign, utm_term, utm_content; advertising click identifiers: gclid, gbraid, wbraid, fbclid). - Transaction security: server logs (IP address, date and time, requested page, response code, browser). - Data obtained through cookies and similar technologies: see our Cookie policy.

Purposes of processing

- responding to your treatment or quote request and contacting you by phone, WhatsApp or e-mail; - carrying out a preliminary assessment and preparing an estimated treatment plan and quote; - planning your appointment and, if you wish, your accommodation and transfers; - following up requests in an organised way and managing communication with patients; - identifying the channel through which requests arrive and measuring the effectiveness of our communication; - ensuring information security and preventing misuse of the website; - proving consent, complying with legal obligations and responding to competent authorities; - with your consent, producing statistics on website use and measuring the effectiveness of our Google Ads advertisements.

Method of collection and legal grounds

Your data is collected directly from you through the forms on our website, WhatsApp, phone and e-mail, and automatically during your visit through our servers and browser storage technologies.

It is processed on the following legal grounds under Article 5 of the KVKK: - processing directly related to the conclusion or performance of a contract (Art. 5/2-c): responding to your request, preparing quotes and treatment plans, planning your appointment and stay; - compliance with a legal obligation of the data controller (Art. 5/2-ç): consent records, requests from authorities, retention obligations under healthcare legislation; - establishment, exercise or protection of a right (Art. 5/2-e); - our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f): following up requests, measuring their origin, information security; - your explicit consent (Art. 5/1): analytics and advertising cookies; sending the advertising click identifier to Google Ads as an offline conversion.

Your health data is processed on the basis of your explicit consent under Article 6 of the KVKK; you give it by ticking the checkbox in the form or in the conversation in which you send us such information directly. If you are treated at the clinic, your health data is also processed for medical diagnosis and treatment, by persons bound by confidentiality, in accordance with the applicable healthcare legislation.

Transfers of personal data

Your data may be disclosed, only for the purposes above and to the extent necessary, to the following recipients: - our service providers: hosting of the website and database ([barındırma sağlayıcısı]) and, where applicable, e-mail services; - if you ask us to organise your stay, our accommodation and transfer partners, limited to the information they need; - public authorities legally entitled to receive it.

The following services may process data abroad: - the WhatsApp service provider (Meta group), if you contact us via WhatsApp; - Google (Google Ireland Limited, Google LLC — United States), for audience measurement (Google Analytics) and advertising measurement (Google Ads, including the advertising click identifier linked to your request, without your name, contact details or health data) if you consent, and if you load the map on the contact page; - Meta, to display the images of our Instagram feed when it is shown on the website.

Transfers abroad are carried out in accordance with the procedures set out in Article 9 of the KVKK (appropriate safeguards or the occasional transfer cases provided for by the law).

Retention periods

- Requests that do not lead to treatment: 2 years from our last contact, then deleted or anonymised. - If you become a patient of the clinic: your records are kept for the period required by the applicable healthcare legislation. - Proof of your consent (date and version of the text you accepted) and advertising click identifiers stored with the request: for the same period as the data of the related request. - Technical server logs: no longer than 6 months. - Cookies and data stored in your browser: see our Cookie policy.

If you withdraw your consent or ask us to erase your data, we delete it earlier, except for data we are legally required to keep.

Your rights (Article 11 KVKK)

Under Article 11 of the KVKK, you may apply to the data controller to: a) learn whether your personal data is processed; b) if so, request information about it; c) learn the purpose of processing and whether the data is used in line with that purpose; ç) know the third parties in Türkiye or abroad to whom your data is transferred; d) request the correction of incomplete or inaccurate data; e) request its erasure or destruction under the conditions set out in Article 7 of the KVKK; f) request that the actions taken under (d) and (e) be notified to third parties to whom your data was transferred; g) object to an outcome against you arising from the analysis of your data exclusively by automated systems; ğ) claim compensation for damage suffered as a result of unlawful processing of your data.

You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of earlier processing.

How to submit a request

In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may send us your request, together with information allowing us to identify you and a description of your request: - by a letter bearing your handwritten signature, delivered in person or sent by post to Mehmetçik Mah., Termesos Blv. No: 20CA, 07050 Muratpaşa/Antalya, Türkiye; - by e-mail to [email protected], signed with a secure electronic signature or mobile signature, or sent from the e-mail address you previously provided to us and that is registered in our system.

Your request will be handled free of charge as soon as possible and within 30 days at the latest. If the action involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

If your request is rejected, if you find the reply insufficient or if no reply is given in time, you may file a complaint with the Personal Data Protection Board (www.kvkk.gov.tr) within 30 days of learning of the reply and, in any case, within 60 days of the date of your request.

Updates

This notice may be updated when necessary; the current version is always published on this page and the date of the latest update is shown at the top of the page.