Privacy policy

Data controller

The data controller is İzy Dent Ağız ve Diş Sağlığı Merkezi, which operates the İZY Dentiste dental clinic.

Address: Mehmetçik Mah., Termesos Blv. No: 20CA, 07050 Muratpaşa/Antalya, Türkiye Registration: Antalya Kurumlar Vergi Dairesi – 3231227069 E-mail: [email protected] Phone: +90 534 778 5008

Representative in the European Union (Article 27 GDPR): [AB temsilcisi]

For any question about your data, including exercising your rights, please write to [email protected].

Data we collect

When you fill in one of our request forms (treatment plan request, contact form): - your first and last name (required); - your phone number, which we may use to call you or message you on WhatsApp (required); - your e-mail address (optional); - the treatment you are interested in (optional); - your agreement to the consent checkbox, together with the date and time of that agreement and the version of the text you accepted.

The form also automatically records the context of your request: the language and address of the page you sent it from, the first page you viewed during your visit, the website you came from (address without parameters) and, if you arrived via a campaign link, the parameters of that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and any advertising click identifiers (gclid, gbraid, wbraid for Google Ads; fbclid for Meta), as well as a random technical identifier for the submission.

When you contact us via WhatsApp, phone or e-mail: your number or address, the name associated with your account, the content of our conversations and any documents you choose to send us (for example photos of your teeth or an X-ray). If you ask us to organise your trip, we also collect the travel details needed for this (arrival and departure dates, flight, number of companions).

When you browse the website: like any web server, our servers record technical data (IP address, date and time, requested page, response code, browser type) for security and operational purposes. The content of forms is not written to these logs. Your IP address is also used temporarily to limit abusive form submissions and, where applicable, to suggest the language of the website that matches your country.

Information stored in your browser (chosen language, display of announcements, origin of your visit) is described in our Cookie policy.

Health data

The treatment you are interested in, as well as the photos, X-rays or information about your oral health that you send us, are data concerning health. They enjoy enhanced protection (Article 9 GDPR, Article 6 KVKK).

We process them on the basis of your explicit consent, which you give by ticking the checkbox in the form or, when you send them to us directly (for example on WhatsApp), as part of that conversation. They are used only to review your request, carry out a preliminary assessment and propose an estimated treatment plan.

Please only send us information that is relevant to your request. A remote preliminary assessment does not replace a clinical examination: the final treatment plan is set by the dentist after an examination at the clinic.

If you become a patient, your medical records are then kept in accordance with the healthcare legislation applicable in Türkiye.

Purposes and legal bases

- Responding to your request, getting back to you, carrying out a preliminary assessment and preparing a quote, arranging your appointment and, if you wish, your stay: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for health data, your explicit consent (Art. 9(2)(a) GDPR). - Following up requests in an organised way (request status, internal team notes): pre-contractual steps and our legitimate interest in providing a good-quality follow-up (Art. 6(1)(f) GDPR). - Keeping proof of your consent: compliance with our legal obligations (Art. 6(1)(c) and 7(1) GDPR). - Knowing through which channel or campaign your request reached us, in order to assess the effectiveness of our communication: our legitimate interest (Art. 6(1)(f) GDPR). - Keeping the website secure and preventing abuse (automated submissions, intrusion attempts): our legitimate interest (Art. 6(1)(f) GDPR). - Measuring website audience, only if you agree: your consent (Art. 6(1)(a) GDPR); see our Cookie policy. - Measuring the effectiveness of our Google Ads advertisements, only if you accept advertising cookies: your consent (Art. 6(1)(a) GDPR). Only in that case may the advertising click identifier linked to your request (gclid, gbraid or wbraid) be sent to Google Ads to report that an ad click led to a request ("offline conversion"); your name, phone number, e-mail and health data are not sent. Without this consent, the identifier stays in our records only to show where the request came from. - Complying with our legal obligations and, where necessary, establishing, exercising or defending legal claims (Art. 6(1)(c) and 6(1)(f) GDPR).

We do not use your contact details to send you marketing communications without your separate agreement. We do not sell your data and we do not make any solely automated decisions that produce legal effects concerning you.

Who receives your data

Your requests can only be accessed by authorised members of the İZY Dentiste team who need them to respond to you (patient advisers, dentists), through an administration area protected by personal accounts and role-based access rights.

We use service providers who act on our instructions: - hosting of the website and its database: [barındırma sağlayıcısı]; - where applicable, e-mail services used to correspond with you or to notify the team of a new request; - if you ask us to organise your stay, accommodation and transfer partners, who receive only the information they need (name, dates, number of people).

Some third-party services receive data when you use them: - WhatsApp (Meta group), if you choose to contact us through this channel; - Google (Google Ireland Limited and Google LLC, United States), if you accept audience measurement or advertising cookies (Google Analytics, Google Ads), or choose to display the Google Maps map on the contact page; - Meta, whose servers deliver the images of our Instagram feed when it is displayed on the website. These companies process such data under their own privacy policies.

Finally, we may disclose data to public authorities where required by law. We do not sell or rent your data.

International transfers

İZY Dentiste is established in Türkiye. If you live in the European Union, the data you send us is therefore received and processed in Türkiye, where the clinic reviewing your request is located. The website and its database are hosted by [barındırma sağlayıcısı].

WhatsApp, Google and Meta may process data in other countries, in particular the United States. These companies state that they cover such transfers with the safeguards provided for by the GDPR. For Google Analytics and Google Ads, data may be transferred to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework; Google also relies on standard contractual clauses.

Under Turkish law, transfers of data abroad are carried out in accordance with Article 9 of the KVKK.

How long we keep your data

- Requests that do not lead to treatment: 2 years from our last contact, then deleted or anonymised. - If you become a patient of the clinic: your records are kept for the period required by the applicable healthcare legislation. - Proof of your consent (date and version of the text you accepted) and advertising click identifiers stored with the request: for the same period as the data of the related request. - Technical server logs: no longer than 6 months. - Cookies and data stored in your browser: see our Cookie policy.

If you withdraw your consent or ask us to erase your data, we delete it earlier, except for data we are legally required to keep.

Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access to the administration area restricted to authorised persons with personal accounts and role-based rights, passwords stored in hashed form, encrypted access keys for third-party services, and technical logs that do not contain the content of forms.

As no measure can guarantee absolute security, we invite you to share only the information needed for your request.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to object to processing based on our legitimate interest and to the portability of the data you provided to us. You may withdraw your consent at any time; this does not affect processing carried out before the withdrawal.

The rights provided for by the KVKK are described on our "Personal data protection (KVKK)" page.

To exercise your rights, write to [email protected] or by post to the address given above. We may ask you to verify your identity. We will reply within one month at the latest (30 days under the KVKK).

Complaints to a supervisory authority

If you believe your rights have not been respected, you may lodge a complaint with a supervisory authority, in particular in your country of residence. In France, this is the Commission nationale de l'informatique et des libertés (CNIL, www.cnil.fr). In Türkiye, the competent authority is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, www.kvkk.gov.tr).

We invite you to contact us first so that we can try to find a solution with you.

Minors

Our forms are intended for adults. For a patient who is a minor, the request must be made by one of their legal representatives.

Changes to this policy

We may update this policy, in particular when the website or the regulations change. The date of the latest update is shown at the top of the page. If we make significant changes, we will inform you by appropriate means.