KVKK Disclosure Notice | Dr. Hamza Gemici

This Disclosure Notice is prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It explains the purpose, legal basis, collection method, recipients and your rights regarding the processing of your personal data.

1. Data Controller

Data Controller: Dr. Hamza Gemici
Address: Atatürk Mah. Turgut Özal Bulvarı, Gardenya 4-2 No: 6-A D: 2, Ataşehir / İstanbul, Türkiye
Contact: contact page

2. Categories of Personal Data Processed

Depending on how you interact with the website, the following personal data categories may be processed:

Identity data: name and surname (provided in forms)
Contact data: email, phone number, WhatsApp identifier
Transaction data: form content, message text, appointment preferences
Technical data: IP address, browser and device information, visit logs, cookie identifiers
Marketing data: UTM parameters, page interactions (only after cookie consent is granted)

Special categories of personal data (health data) are NOT collected via this website. Health-related information is processed only within the clinic, under separate patient-level consent.

3. Purposes of Processing

Responding to information requests and appointment inquiries
Managing communication channels (form, WhatsApp, phone, email)
Ensuring website security, preventing abuse, maintaining technical logs
Fulfilling legal obligations (record-keeping, responding to authority requests)
Measuring website performance and improving user experience (only with your cookie consent)

4. Legal Basis for Processing (KVKK Art. 5)

Your explicit consent for analytics and marketing cookies (Art. 5/1)
Legitimate interest of the data controller for security, fraud prevention and operational continuity (Art. 5/2/f)
Necessary for the establishment or performance of a service relationship (Art. 5/2/c)
Compliance with legal obligations of the data controller (Art. 5/2/ç)

5. Method and Technical Means of Collection

Your personal data is collected electronically via the website contact form, WhatsApp link, phone calls, email, cookies and server logs.

6. Third-Party Recipients and Transfers

To operate the website and deliver services, data may be processed by the following service providers under contractual safeguards:

Cloudflare, Inc. (USA) — CDN, DDoS protection, edge caching, security logs
Vercel Inc. (USA) — hosting and serverless infrastructure
Google LLC (USA) — Google Analytics, Google Tag Manager, Google Maps (only after you grant cookie consent)
WhatsApp (Meta Platforms, Inc., USA) — only when you initiate contact via the WhatsApp button
Email/SMTP and form delivery providers used for contact form submissions

These providers are established outside Türkiye and, where cross-border transfers occur, such transfers are carried out in accordance with KVKK Articles 9 and 9/A, including explicit consent or appropriate safeguards, as applicable.

7. Cookies and Analytics

Essential cookies required for the functioning of the site are loaded without consent. Analytics and marketing tools (including Google Analytics and Google Tag Manager) and third-party services that set cookies or process your IP address (including Google Maps) are loaded only after you explicitly accept cookies via the banner. You may change your cookie preference at any time by clearing the cookie_consent cookie in your browser.

8. Retention Period

Contact form content is retained for the duration necessary to complete the inquiry and for up to 2 years for legal defense purposes, unless a longer retention is required by law. Technical logs are kept for up to 12 months.

9. Your Rights (KVKK Art. 11)

Under Article 11 of the KVKK, you have the right to:

Learn whether your personal data is processed
Request information about the processing
Learn the purpose and whether it is used for that purpose
Learn the third-party recipients, domestic or international
Request correction if incomplete or inaccurate
Request deletion or destruction under Article 7
Request that any correction/deletion be notified to third parties
Object to any adverse outcome resulting solely from automated processing
Claim compensation for damages arising from unlawful processing

10. How to Exercise Your Rights

To exercise your rights under KVKK Article 11, you may send a written request to the clinic address listed above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. The data controller will respond to valid applications within 30 (thirty) days, free of charge. If the response requires additional cost, the fee set by the Personal Data Protection Board applies.