KVKK Disclosure Notice

1. Data controller

Under Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, your personal data is processed by the following company as data controller.

Trade name: [Ticari Unvan]
Address: [Adres]
Tax office / Tax number: [Vergi Dairesi] / [Vergi No]
MERSİS number: [MERSİS No]
Telephone: [Telefon]
Email: [E-posta]
Registered electronic mail (KEP) address: [KEP adresi]

2. Categories of personal data processed

Depending on how you use the website and our services, the following categories of your personal data may be processed:

Identity and contact: name, telephone number, email address, country, preferred contact channel and language.
Health data (special category): your treatment enquiry, health information you share in a form or message, photos, X-rays or similar documents you upload, and examination and treatment records.
Payment and transaction security: payment reference and order number, amount, currency, date and result of the transaction, transaction codes returned by the bank and masked card information (only the last 4 digits of the card number). The card number, expiry date and security code are not seen, processed or stored by the data controller.
Legal and confirmation records: the version number of the contracts and texts you confirmed, the time of confirmation and an irreversibly hashed value of your IP address.
Campaign and wheel: your participation in the wheel, the prize you won, and a hashed value generated from your telephone number to enforce the one-use rule.
Security and marketing: IP address, device and browser information, pages visited, campaign source (UTM and click identifiers), referring site and cookie information.

3. Purposes of processing

Your personal data is processed for the following purposes:

To receive your enquiries and appointment requests, contact you and answer your questions.
To plan the examination and treatment process and deliver the health service.
To accept online payments, verify the payment result, send receipts and handle cancellations and refunds.
To fulfil contractual and legal obligations (distance contract, invoicing, accounting, tax, health legislation).
To prevent fraud and misuse, ensure information security and protect our rights against legal claims.
To run campaigns (such as the wheel) and apply the one-use rule.
To measure which advertising and marketing channels led to an enquiry, and to send commercial electronic messages with your explicit consent or as otherwise permitted by law.

4. Legal bases

Your personal data is processed on the following grounds in article 5(2) of KVKK: (c) it is directly related to the conclusion or performance of a contract (appointment, service and payment contract); (ç) it is necessary for the data controller to comply with a legal obligation (invoicing, accounting, health and consumer legislation); (e) it is necessary for the establishment, exercise or protection of a right; (f) it is necessary for the legitimate interests of the data controller, provided your fundamental rights and freedoms are not harmed (information security, fraud prevention).

Health data is special-category personal data under article 6 of KVKK and is processed only (i) on the basis of your explicit consent or (ii) in accordance with the conditions in article 6 of KVKK and the Regulation on Personal Health Data (for example, medical diagnosis, treatment and care services carried out by persons under a duty of confidentiality).

Your explicit consent is obtained separately for marketing commercial electronic messages, for non-essential cookies, and, where applicable, for transfers abroad that rely on explicit consent; declining does not prevent you from receiving our services.

5. How personal data is collected

Your personal data is collected electronically, by automatic or partly automatic means, through the contact and enquiry forms on the website, the payment page and payment links, the wheel, your correspondence by WhatsApp, telephone and email, when you attend the clinic, and through cookies and similar technologies.

6. Recipients to whom personal data is transferred

Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in line with articles 8 and 9 of KVKK:

Payment: the contracted bank that processes card payments (İş Bankası virtual POS) and related card payment institutions.
Service providers: providers of hosting, email, messaging, customer relationship management and information security.
Advisers such as accountants, lawyers and auditors.
Authorised public bodies and institutions, courts and regulators (Ministry of Health, tax authority, the Personal Data Protection Board and others).
Abroad: if the servers of hosting, email or similar providers are outside Turkiye, or if you apply as a patient from abroad, the transfer is made on one of the grounds in article 9 of KVKK (an adequacy decision, appropriate safeguards and standard contract, or explicit consent for occasional transfers).

7. Retention periods

Your personal data is kept for as long as the purpose of processing requires or the relevant legislation provides, and is then deleted, destroyed or anonymised. Enquiry and contact records are kept for [24] months, payment and invoice records for the period in the relevant tax and commercial legislation, health records for the period set by health legislation, and wheel participation records for [12] months.

8. Your rights under article 11 of KVKK

By applying to the data controller you may exercise the following rights concerning your personal data:

To learn whether your personal data is processed.
To request information if it has been processed.
To learn the purpose of processing and whether it is used in line with that purpose.
To know the third parties to whom it is transferred, in Turkiye or abroad.
To request correction if it is incomplete or inaccurate.
To request deletion or destruction under the conditions in article 7 of KVKK.
To request that corrections, deletions and destruction be notified to third parties to whom the data was transferred.
To object to a result against you arising from analysis of the data exclusively by automated systems.
To claim compensation for damage you suffer because of unlawful processing.

9. How to apply

You can send requests about the rights above, in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller and together with information and documents that identify you, in writing by hand or through a notary to [Adres]; to the KEP address [KEP adresi] using registered electronic mail or a secure electronic signature; or from your email address already notified to and registered in our systems to [E-posta]. Your application should state your name and surname, your signature (for a written application), your Turkish ID number (for foreigners, your nationality and passport/ID number), your address for notices, your email/telephone and the subject of your request.

Applications are concluded free of charge as soon as possible and at the latest within 30 days, depending on the nature of the request; if the action requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days from learning of the answer and in any case within 60 days from the date of your application.

Contact

Trade name: ÖZEL BMTURKEY AĞIZ VE DİŞ POLİKLİNİĞİ TİCARET LİMİTED ŞİRKETİ
Address: Yenibosna Merkez, Zübeyde Hanım Caddesi No: 1AD A Blok, No: 114, 34197 Bahçelievler/İstanbul
Tax office / number: YENİBOSNA / 6131499944
MERSIS no: [MERSIS no]
Email: info@bmturkiye.com
Post: BM Turkiye Dental Clinic, Yenibosna Merkez, Zübeyde Hanım Caddesi No: 1AD A Blok, No: 114, 34197 Bahçelievler/İstanbul
Phone / WhatsApp: +90 552 800 60 00

See also · Privacy policy · Cookie policy