Privacy & Cookie Policy
Under Turkish Personal Data Protection Law No. 6698 (KVKK), this page explains which of your data we process and why, who we share it with, and how you can exercise your rights.
Who is the data controller?
For this website and the services provided, the data controller is:
- Legal name: RL CLİNİC SAĞLIK TURİZM SANAYİ VE TİCARET ANONİM ŞİRKETİ
- Tax ID: 7351945675 (Doğanbey Vergi Dairesi)
- Address: Alacaatlı Mah. 3306/1 Sk. No: 3/1 İç Kapı No: 4, Çankaya / Ankara
- E-mail: info@rlclinic.com
- Phone: 0505 797 15 15
- Contact for data protection requests: Berk Dirican
References to “we” or “RL Beauty Lounge” mean the company above.
What the website collects
Very little. This site has no contact form; you reach us by phone, WhatsApp or e-mail. The site sets no cookies of its own, stores nothing in your browser, and runs no analytics or tracking tools.
The only data processed when you visit is the server log our hosting provider keeps automatically for security and error tracking: IP address, browser and device information, request time and the page requested. We do not use these logs for marketing and do not match them to your identity.
When you contact us or receive a service
The following data only comes into existence when you get in touch or book a session:
- Identity and contact: name, phone number, e-mail address
- Message content: the requests and questions you send via WhatsApp, phone or e-mail
- Appointment and service records: appointment dates, sessions performed, session notes
- Measurements: body analysis and measurement values taken at the first consultation
- Financial data: payment and invoice records
- Photographs: only where you have separately and explicitly consented
We do not store your payment card details.
Purposes and legal grounds
- Creating your appointment and delivering the service — necessary for the conclusion and performance of a contract (KVKK art. 5/2-c)
- Answering your questions — your request towards entering into a contract (art. 5/2-c) and legitimate interest (art. 5/2-f)
- Issuing invoices and keeping financial and commercial records — legal obligation (art. 5/2-ç)
- Tracking your service history and continuing a session plan — performance of a contract (art. 5/2-c)
- Keeping the site and premises secure — legitimate interest (art. 5/2-f)
- Establishing and defending legal claims — establishment and protection of a right (art. 5/2-e)
- Photographs and promotional use — only with your explicit consent (art. 5/1)
Where processing relies on consent, you may withdraw it at any time; withdrawal takes effect going forward.
Special categories of data
Our registered activity is beauty and personal care services (NACE 960403). We are not a healthcare provider and we do not set out to process special categories of personal data in the ordinary course of business.
Where information you share at the first consultation, or photographs, could amount to a special category of data, it is processed only with your explicit consent and with the additional safeguards required by KVKK art. 6. You are not obliged to give us such information.
Who we share it with
We do not sell your personal data and we do not pass it to third parties for marketing. Sharing is limited to the following:
- Hosting and e-mail infrastructure: Google (Firebase Hosting and Google Workspace) — server logs and e-mail correspondence
- Map embed: the Google Maps panel in the contact section
- Accountant: invoices and commercial records
- Competent public authorities: only where legislation requires it (KVKK art. 8/2-a)
Transfers abroad: because Google's servers are located outside Türkiye, server logs and e-mail content may be transferred abroad. Such transfers are made under KVKK art. 9 with appropriate safeguards in place.
How long we keep it
- Commercial books, records and documents: 10 years (Turkish Commercial Code art. 82)
- Tax records: 5 years (Tax Procedure Law art. 253)
- Records arising from the contractual relationship: 10 years from the end of the relationship (general limitation period, Turkish Code of Obligations art. 146)
- Contact and enquiry records: once the purpose of processing no longer applies
- Consent-based records (including photographs): until you withdraw consent
When the period expires or the ground for processing falls away, your data is erased, destroyed or anonymised.
Your rights
Under KVKK art. 11 you may apply to us to:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom it is transferred, in Türkiye or abroad
- Request correction if it is incomplete or inaccurate
- Request erasure or destruction under the conditions in KVKK art. 7
- Request that correction, erasure and destruction be notified to third parties to whom the data was transferred
- Object to a result against you arising from analysis solely by automated systems
- Claim compensation for damage suffered due to unlawful processing
How to apply
You may submit your requests in line with the Communiqué on Application Procedures to the Data Controller:
- In writing: a signed letter, with documents evidencing your identity, to Alacaatlı Mah. 3306/1 Sk. No: 3/1 İç Kapı No: 4, Çankaya / Ankara
- By e-mail: from the e-mail address registered in our records, to info@rlclinic.com
Your application should state your name, signature (for written applications), Turkish ID number, address for service, phone and e-mail if any, and the subject of your request.
Applications are concluded within 30 days at the latest and are free of charge; if the process incurs a cost, the fee set by the Board may be charged.
If your application is refused, you find the response insufficient, or you receive no response within 30 days, you may complain to the Personal Data Protection Board within 30 days of learning of it and in any case within 60 days of your application (KVKK art. 14).
Cookie policy
To be plain about it: this site sets no cookies of its own. We do not use your browser's local storage (localStorage / sessionStorage), we do not track sessions, and we run no analytics or advertising trackers, Google Analytics included. That is why there is no cookie consent banner on the site.
The one exception is the Google Maps embed in the contact section. When you scroll to that section and the map loads, your browser connects directly to Google; your IP address is sent to Google and Google may set its own cookies. Google's own policies apply to that processing: Google Privacy Policy. If you would rather not load the map, simply do not scroll to that section — the address is also given as text.
If an analytics tool is added to the site in future, this section will be updated and a consent mechanism added where required.
Changes to this notice
We may update this notice following changes in legislation or in our services. The current version is always published on this page.
Last updated: 24 August 2026