1. Introduction

Vitaluxe Istanbul ("we," "us," or "our") operates the website https://vitaluxeistanbul.com (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We are committed to protecting your privacy and handling your personal data in a transparent and secure manner, in compliance with applicable regulations, including the Turkish Personal Data Protection Law (KVKK — Law No. 6698), the European General Data Protection Regulation (GDPR — Regulation EU 2016/679), and the UK Data Protection Act 2018.

2. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Personal Data

While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you:

• First name and last name
• Email address
• Phone number (for WhatsApp and direct contact)
• Country of residence, city
• Treatment preferences and case scope
• Medical history, photos, or X-rays you voluntarily submit for treatment planning
• Cookies and usage data

Usage Data

We may also collect information on how the Service is accessed and used: IP address, browser type and version, the pages of our Service that you visit, the time and date of your visit, time spent on those pages, unique device identifiers, and other diagnostic data.

Health-Related Data (Special Category)

Photos, X-rays, panoramic radiographs, or descriptions of dental conditions you submit are classified as special category data under GDPR Article 9 and KVKK Article 6. We process such data only with your explicit consent and solely for the purpose of preparing a personalized treatment plan.

Tracking & Cookies

We use cookies and similar tracking technologies. Cookies are files with small amounts of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies. However, if you do not accept cookies, some portions of our Service may not function properly.

3. Use of Data

Vitaluxe Istanbul uses the collected data for the following purposes:

• To provide and maintain our Service
• To prepare your personalized dental treatment plan
• To contact you via WhatsApp, email, or phone regarding your inquiry or treatment
• To coordinate travel, hotel, and clinic appointments for international patients
• To notify you about changes to our Service
• To provide customer support and post-treatment follow-up
• To gather analytics to improve our Service
• To detect, prevent, and address technical issues
• To send you marketing communications about treatments, offers, or events — only with your explicit consent (which you may withdraw at any time)

4. Lead Forms & CRM Integration (Privyr)

Information you submit through our website forms (treatment requests, consultations, contact form) is securely transmitted to and stored in our customer relationship management platform, Privyr. This data is used to prepare your personalized treatment plan and to contact you for follow-up. Privyr complies with GDPR and uses encrypted data transmission. For more information about Privyr's privacy practices, please visit privyr.com/privacy-policy.

5. Meta Pixel & Conversions API

For marketing optimization and ad performance measurement, we use Meta Pixel and Meta Conversions API. These tools collect anonymized event data (such as form submissions and page views) that may be linked to your Facebook or Instagram account by Meta. Hashed personal identifiers (email, phone) may be transmitted to Meta in line with their Customer Information Parameters specification.

You can opt out via your Meta ad preferences (facebook.com/settings/?tab=ads) or by rejecting non-essential cookies on our website.

6. WhatsApp Business Communications

When you contact us via WhatsApp (using the buttons on our website or our published phone numbers +90 543 302 87 77 and +90 543 309 87 77), Meta processes that communication according to its own WhatsApp Privacy Policy. We use WhatsApp Business for patient inquiries, treatment coordination, and follow-up care. Messages and contact information are stored in our CRM platform for continuity of care.

7. Legal Basis for Processing (GDPR)

If you are from the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the type of data and context. We process your Personal Data on the following bases:

• Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for marketing communications, sensitive medical data processing
• Contract (Art. 6(1)(b)) — for treatment planning and service delivery
• Legitimate interests (Art. 6(1)(f)) — for analytics, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c)) — for tax records, statutory medical recordkeeping

8. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

• Treatment inquiries / unconverted leads: 3 years from last interaction
• Patient medical records: 20 years from last treatment (Turkish health law minimum)
• Financial / billing records: 10 years (Turkish Tax Procedure Law)
• Marketing consent records: Until you opt out
• Analytics cookies: Up to 24 months
• Session cookies: Until you close your browser

After the retention period, your data is either securely deleted or anonymized for statistical purposes.

9. Data Disclosure & Transfers

Vitaluxe Istanbul does not sell your personal data. We may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation (KVKK Article 8, GDPR Article 6)
• Protect and defend the rights or property of Vitaluxe Istanbul
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public

International Transfers: Your information may be transferred to and maintained on computers located outside your country (e.g., Privyr servers may be in the UK/EU; Meta servers may be in the US). For transfers to non-adequacy countries under GDPR, we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission. For KVKK transfers, we rely on explicit consent or commitments approved by the KVKK Board.

10. Data Security

The security of your data is important to us. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• HTTPS/TLS encryption for all website traffic
• Access controls and role-based permissions for clinic staff
• Encrypted CRM and patient data storage
• Regular security reviews and updates
• Staff training on data protection

However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

11. Your Data Protection Rights

Under KVKK (Turkey):

• Learn whether your personal data is being processed
• Request information if your data has been processed
• Learn the purpose of processing and whether data is used in accordance with that purpose
• Know the third parties to whom your data is transferred
• Request rectification if data is incomplete or inaccurate
• Request deletion or destruction of your data
• Object to results produced exclusively by automated systems
• Request compensation for damage arising from the unlawful processing of your data

Under GDPR (EEA / UK):

• Access: Receive confirmation and a copy of your data
• Rectification: Correct inaccurate or incomplete data
• Erasure (Right to be Forgotten): Delete your data under certain conditions
• Restriction: Request we restrict processing of your data
• Data Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests or for marketing
• Withdraw Consent: At any time where processing is based on consent

To exercise any of these rights, contact us using the details in Section 14. We respond within 30 days. We may ask you to verify your identity before processing your request.

12. Right to Lodge a Complaint

In addition to the rights above, you have the right to lodge a complaint with the relevant supervisory authority:

• Turkey: Kişisel Verileri Koruma Kurumu (KVKK) — kvkk.gov.tr
• EEA: Your local Data Protection Authority — edpb.europa.eu
• Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — dataprotection.ro
• Portugal: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

13. Cookie Policy & Consent

We use cookies and similar tracking technologies. Upon your first visit, you will see a Cookie Consent Banner where you can accept all, reject non-essential, or customize your preferences. You can change your choices at any time via the "Cookie Settings" link in the footer.

Cookie Categories:

• Essential: Required for the website to function (cannot be switched off)
• Analytics: Google Analytics — measure traffic and site performance
• Functionality: Remember your language preference, form data
• Advertising/Targeting: Meta Pixel, retargeting — build interest profiles, show relevant ads

14. Children's Privacy

Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information.

15. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For material changes, we may also send you a direct notification (via email or WhatsApp). You are advised to review this Privacy Policy periodically.

16. Contact Us