Personal Data Protection Information Notice
Prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 and the Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform.
Last updated: 8 September 2026
1. Identity of the Data Controller
This information notice has been prepared, within the scope of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), by the data controller Vicenza Beauty Lounge (hereinafter referred to as “Vicenza”).
- Trade name: [Ticaret unvanı girilecek]
- Address: Küçükbakkalköy Mah. Yenidoğan Cad. No:6/3, Ataşehir / İstanbul
- Phone: 0501 545 94 93
- E-mail: [KVKK başvuru e-posta adresi girilecek]
- Tax Office / No: [Girilecek]
2. Personal Data Processed
Within the scope of the beauty, care and personal services it provides, Vicenza processes the following categories of personal data:
- Identity data: first name, last name
- Contact data: telephone number, e-mail address, contact details provided via WhatsApp
- Customer transaction data: appointment date and time, service requested, past appointment records, preferences and notes
- Visual data: only where you have given your explicit consent, before/after photographs and social media posts
- Transaction security data: cookie records relating to website use, IP address, browser and device information
- Physical premises security data: security camera footage from the common areas of the premises
Notice on special categories of personal data. Before treatments such as laser hair removal, skin care, permanent makeup and tattooing, information that qualifies as health data — such as skin sensitivity, allergy history, pregnancy or medication in use — may be requested for the safety of the treatment. Pursuant to Article 6 of the KVKK, such data is processed only with your explicit consent and is obtained through a separate consent form; it is not shared with third parties and is deleted once its purpose has ceased to exist. If you do not give explicit consent, the relevant treatment may not be able to be carried out; this does not prevent you from using our other services.
3. Purposes of Processing Personal Data
- Receiving, scheduling and managing appointment requests
- Carrying out the requested service and ensuring the safety of the treatment
- Maintaining customer communication and responding to questions and complaints
- Measuring and improving service quality
- Sending campaign, discount and promotional notifications, where explicit consent has been given
- Ensuring the security of the premises and of visitors
- Fulfilling accounting, invoicing and statutory retention obligations
- Meeting the requests of competent public institutions and organizations
4. Method of Collection and Legal Basis for Personal Data
Your personal data is collected, by partly automated and non-automated means, through your visits to our premises, telephone calls, WhatsApp messages, the contact and appointment forms on the website, the messages you send via our social media accounts and the security cameras on the physical premises.
Your data is processed under Article 5 of the KVKK on the following legal grounds:
- Establishment and performance of a contract (Art. 5/2-c) — appointment and service relationship
- Compliance with a legal obligation (Art. 5/2-ç) — tax and accounting legislation
- Legitimate interest (Art. 5/2-f) — security of the premises and service quality
- Explicit consent (Art. 5/1) — commercial electronic messages, sharing of images and processing of health data
5. Transfer of Personal Data
Subject to compliance with the conditions set out in Articles 8 and 9 of the KVKK, and only to the extent necessary, your personal data may be shared with the following parties: competent public institutions and organizations within the scope of a legal obligation; the business partners from whom we receive accounting and financial advisory services; and service providers that supply appointment, communication and website infrastructure.
Due to website hosting and communication infrastructure, some of your data may be stored with service providers whose servers are located abroad. In this case, mechanisms such as appropriate security safeguards or standard contractual clauses are applied within the scope of Article 9 of Law No. 6698. Your personal data is not sold to third parties for marketing purposes.
6. Retention Period
Your personal data is retained for as long as necessary for the purpose for which it is processed, taking into account the limitation periods stipulated in the relevant legislation. Accounting and tax records are kept, as required by the relevant legislation, for 10 years, security camera recordings for a maximum of 30 days, and appointment and communication records for 2 years from the end of the service relationship. At the end of the period, your data is deleted, destroyed or anonymized.
7. Your Rights as a Data Subject
Pursuant to Article 11 of the KVKK, by applying to the data controller you may:
- Learn whether your personal data is being processed,
- Request information about it if it has been processed,
- Learn the purpose of the processing and whether the data is used in accordance with that purpose,
- Know the third parties, in Türkiye or abroad, to whom it is transferred,
- Request its correction if it has been processed incompletely or inaccurately,
- Request its deletion or destruction within the framework of the conditions stipulated in the Law,
- Request that the correction, deletion and destruction operations be notified to the third parties to whom it has been transferred,
- Object to any outcome to your detriment arising from its analysis exclusively by automated systems,
- Claim compensation for the damage you suffer as a result of its unlawful processing.
You hold each of the rights listed above.
8. How to Apply
In accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller, you may submit your requests regarding your rights in writing to our business address together with documents verifying your identity, or by writing to [KVKK başvuru e-posta adresi] from your e-mail address registered in our system.
Depending on the nature of the request, your application will be concluded as soon as possible and within 30 days at the latest. If the process entails an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected or is not answered in time, you reserve the right to lodge a complaint with the Personal Data Protection Board.
9. Changes
This information notice may be revised in line with changes in legislation and updates to business practices. The current text is always published on this page.
Other related documents: Privacy Policy · Cookie Policy · Terms of Use