PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
Effective date: 17 October 2026
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform, by the data controller operating under the Renew & Revive brand, to explain how your personal data is processed. In case of any discrepancy, the Turkish version prevails.
1. Data Controller
FKT GÜZELLİK AKADEMİ KOZMETİK DANIŞMANLIK LTD. ŞTİ. ("Renew & Revive" or the "Company")
Address: Merkez Mah., Abide-i Hürriyet Cad. Üçler Apt. No:141 Kat:1 D:1, 34365 Şişli/Istanbul, Türkiye
Email: hello@renewandrevive.co
Phone: +90 533 038 48 24
2. Categories of Personal Data
- Identity: name, surname; where needed for the service and invoicing, national ID number, date of birth, gender.
- Contact: phone number, email address, address.
- Customer transaction: requests and complaints, appointment details, services received, form contents, and your messages and calls with us via WhatsApp, Instagram, Facebook Messenger, phone and the website chat.
- Financial: invoice and payment details (card details are not stored by the Company; they are processed by the payment institution).
- Marketing: services you are interested in, campaign preferences, commercial electronic message consents.
- Transaction security and digital trace: IP address, browser and device information, pages visited, data obtained through cookies and similar technologies, and information about the advertisement or link through which you reached our website (e.g. campaign parameters and ad click identifiers).
- Visual records: before and after photos, subject to your explicit consent.
- Special category data (health): health information you declare so that beauty and care treatments can be performed safely (allergies, medication, skin condition, any condition preventing a treatment, etc.).
3. Purposes and Legal Grounds
- Responding to your request, booking appointments and providing the service (information form, call-back request, WhatsApp and other messaging channels): necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).
- Invoicing, accounting and statutory retention: expressly provided for by law and necessary to comply with a legal obligation (Art. 5/2-a, ç).
- Customer relationship management, measuring service quality, appointment reminders, handling requests and complaints: legitimate interest (Art. 5/2-f).
- Information security, preventing misuse and spam submissions: legitimate interest (Art. 5/2-f).
- Protecting rights in legal disputes: establishment, exercise or protection of a right (Art. 5/2-e).
- Sending campaigns and promotions by commercial electronic message (SMS, email, WhatsApp): your approval under Law No. 6563; not giving it does not prevent you from receiving our services.
- Analytics and marketing cookies, measuring advertising performance and sending conversion information to advertising platforms: your explicit consent (Art. 5/1). Details are in the Cookie Policy and the Explicit Consent Text.
- Health data and before/after photos: your explicit consent (Art. 6/2).
4. Method of Collection
Your personal data is collected, by partly or fully automated means or as part of a data filing system, through the forms and cookies on our website, phone calls, WhatsApp, Instagram and Facebook Messenger messages, the website chat, email, physical or electronic forms you complete at the salon, and Google/Meta lead forms.
5. Transfers
Within the limits of the purposes above and in line with KVKK Articles 8 and 9, your personal data may be transferred to:
- Our service providers (data processors): customer communication, appointment and CRM software (ConnectWiz), website hosting and content delivery (including Cloudflare), email delivery, accounting and financial advisory services.
- Messaging platforms: Meta Platforms Ireland Ltd. / Meta Platforms, Inc., if you contact us via WhatsApp, Instagram or Facebook Messenger.
- Analytics and advertising providers — only with your explicit consent: Google Ireland Ltd. / Google LLC (Google Analytics, Google Ads, Google Tag Manager), Meta Platforms Ireland Ltd. (Meta Pixel, Conversions API), Microsoft (Clarity), Yandex (Metrica), OpenAI (ad measurement). Contact details such as phone number and email address are irreversibly hashed (SHA-256) before being sent.
- Authorised public authorities and courts: where required by our legal obligations.
Transfers abroad: Some of the providers above have servers outside Türkiye. Transfers abroad are made with appropriate safeguards under KVKK Article 9 (standard contractual clauses) and, for analytics and advertising purposes, on the basis of your explicit consent.
6. Retention Periods
- Customer and invoice records where you received a service: 10 years as required by law.
- Health declarations, consent forms and treatment photos: 10 years from the last treatment, to protect rights in possible disputes.
- Requests that did not lead to a service (form, call-back, messaging): 2 years from the last contact.
- Advertising source and click identifier information: 13 months.
- Commercial electronic message consent and opt-out records: 3 years from withdrawal.
- Cookies: as stated in the Cookie Policy.
Data whose retention period has expired is deleted, destroyed or anonymised.
7. Your Rights
Under KVKK Article 11 you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of Article 7; to request that these actions be notified to the third parties to whom the data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing. You may withdraw your explicit consent and your commercial electronic message approval at any time.
8. How to Apply
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:
- in writing with a wet signature, in person or through a notary, to the address above;
- to hello@renewandrevive.co from the email address previously notified to us and registered in our systems, or with a secure electronic/mobile signature.
You may use the KVKK Application Form on our website. Requests are concluded free of charge as soon as possible and within 30 days at the latest; if the action requires an additional cost, the fee set by the Board may be charged.
