# Privacy Notice

> How Royce Hair Lab processes personal data collected through the website, the online hair analysis and our contact channels.

URL: https://www.roycehairlab.com/de/datenschutz
Language of this text: en

This notice is given under Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK") and, for visitors from the European Union, Article 13 of the General Data Protection Regulation ("GDPR"). It applies to everyone who visits this website, fills in the online hair analysis or contacts us by phone, WhatsApp or email.

## 1. Data controller

- **Data controller:** Royce Hair Lab
- **Address:** Atatürk, Gazi Mustafa Kemal Blv. No:676, 33200 Mezitli/Mersin (Özel VM Medical Park Mersin Hastanesi)
- **Email:** info@roycehairlab.com
- **Phone:** 0 (535) 866 80 15

Hair transplant procedures take place within Özel VM Medical Park Mersin Hastanesi. For health data passed to the hospital during consultation and treatment, the hospital may also act as a data controller and will give you its own notice.

## 2. Data we process

| Category | Data |
| --- | --- |
| Identity | First and last name |
| Contact | Phone / WhatsApp number, email address |
| Health data (special category) | Area and stage of hair loss, gender, age, photos and notes you choose to share |
| Source of visit | The ad or link that brought you to the site (e.g. gclid, utm parameters), landing page |
| Security | IP address, browser and device details, time of form submission, data collected through cookies and similar technologies |
| Requests | Questions, requests and complaints sent through our channels |

## 3. Purposes

- Reviewing your online hair analysis and getting back to you,
- Planning a consultation and informing you about the treatment process,
- Answering your questions, requests and complaints,
- Meeting obligations under health and other legislation,
- Keeping the website secure and preventing misuse,
- With your consent, measuring use of the site and the performance of advertising campaigns abroad.

## 4. Collection and legal bases

Data is collected electronically through the analysis form, phone, WhatsApp, email and cookies.

- Identity and contact data: steps taken at your request before entering into a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)), legal obligations (KVKK art. 5/2-ç; GDPR art. 6(1)(c)) and our legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
- Health data at the online pre-assessment stage: your **explicit consent** (KVKK art. 6/3; GDPR art. 9(2)(a)). During consultation and treatment, health data is processed by persons bound by medical confidentiality for the purposes of medical diagnosis and treatment (KVKK art. 6/3; GDPR art. 9(2)(h)).
- Non-essential cookies and advertising source data: your **consent** only. See the [Cookie Policy](https://www.roycehairlab.com/en/cookie-policy).

## 5. Recipients

Within the purposes above, data may be shared with Özel VM Medical Park Mersin Hastanesi for treatment, with competent public authorities when required by law, and with the hosting, email, form and messaging providers we use, acting as data processors.

**Transfers abroad:** some of these providers run servers outside Turkey (for example Meta Platforms for WhatsApp, Google for measurement). Such transfers are made under KVKK art. 9 with the standard contracts announced by the Personal Data Protection Board and notified to the Authority, or under another safeguard the law provides. When you contact us on WhatsApp yourself, that conversation is also subject to Meta's own privacy terms.

## 6. Retention

Data sent through the online analysis is kept for at most 2 years for follow-up and booking. If treatment starts, health records are kept for the periods set by health legislation. Afterwards data is deleted, destroyed or anonymised.

## 7. Your rights

Under KVKK art. 11 (and GDPR arts. 15–22 where applicable) you may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Turkey or abroad, ask for correction, deletion or destruction, ask that third parties be notified, object to results produced solely by automated systems, and claim compensation for unlawful processing. You may withdraw consent at any time; withdrawal does not affect processing carried out before it.

Send requests as described on the [Data Subject Request Form](https://www.roycehairlab.com/en/data-subject-request) page. We answer free of charge within 30 days. You may complain to Turkey's Personal Data Protection Board (KVKK) or, if you live in the EU, to your local supervisory authority.