KVKK and Privacy Policy
What you need to know about your personal data when using our website and contacting us.1. Data Controller and Contact Details
Bodrum BRC Sağlık Hizmetleri San. ve Dış Ticaret LTD.ŞTİ. Business name: MandarinDent Bodrum Website: mandarindent.com Address: Yokuşbaşı Mh. Hasan Reşat Öncü Cd. No:16, Bodrum / Muğla, Türkiye Email: info@mandarindent.com Telephone: +90 532 482 87 48 / +90 252 440 02 05 Opening hours: Monday – Friday: 09:00 – 18:00 Saturday: 09:00 – 15:002. Scope of This Policy
This policy provides a general overview of data use in connection with website visits and contact or consultation enquiries submitted through the website. It is not a patient privacy notice covering all processing relating to clinical examinations, treatment and patient records. A contact form privacy notice and a cookie privacy notice must also be provided separately. This general policy does not replace information specific to the relevant processing activity or separate explicit consent where required. Visiting the website or reading this policy does not mean that you consent to all data processing activities or marketing communications.3. What Information May Be Processed?
| Source | Data category | Information |
|---|---|---|
| Contact form | Identity and contact details | First name, last name, email address, telephone or WhatsApp number and, if provided, country of residence. |
| Contact form | Enquiries and correspondence | Treatment of interest, message content and a record of acknowledgement of the privacy notice. |
| Message and treatment selection | Data that may contain health information | Information about dental health or treatment needs, depending on the enquiry. |
| Website and external services | Technical and usage data | Connection, device, browser, visit and cookie information that may arise depending on the service used and browser settings. |
The form configuration enables storage of submissions in the website database. Notifications are also sent to designated email recipients. Form records and email copies may therefore be held in different environments.
4. Processing Purposes and Legal Grounds
Information shared through the contact form is used to receive and review your enquiry, communicate with you, conduct correspondence about an appointment you request and follow up on your enquiry. Google Analytics is used to measure website visits and usage. Google Maps is used to provide location information. The processing performed by these services must be identified according to the actual installation and preferences.5. Health Information and Data Minimisation
Selecting a treatment of interest or describing your concerns in a message may reveal health data. Health data constitutes a special category of personal data; an appropriate condition under Article 6 of the Law and the necessary additional security measures must be identified separately. At the initial enquiry stage, do not include identity documents, detailed medical reports, X-rays or sensitive information unrelated to your request in the form. If further information is needed, discuss an appropriate sharing method with the clinic.6. Form Notifications and Data Recipients
In the configured notification workflow, form content is sent to the clinic’s email address and designated Gmail recipients. Hosting, email delivery and form infrastructure must also be considered as part of the data processing workflow. If data is disclosed to competent public authorities, the relevant legal obligation, data category and purpose must be explained separately.7. Google Services and International Transfers
The website operator has reported using Google Analytics and Google Maps. The supplied form configuration also includes Google reCAPTCHA. Sending form notifications to Gmail addresses results in data being processed within different service infrastructures. Whether these workflows involve international transfers must be verified based on service agreements, providers, server locations and access arrangements. Where international transfers take place, the appropriate conditions under Article 9 of the Law must be met. Publishing a privacy policy or adding a general consent checkbox does not automatically satisfy those conditions.8. Cookies and Preferences
No cookie preference panel is currently in place. This policy does not collect cookie consent. Publishing this text does not replace implementing a preference mechanism for services requiring consent. Cookie names, providers, purposes and durations must be explained in a separate Cookie Privacy Notice based on the actual inventory. A cookie’s lifetime differs from the period for which a provider retains data. Providing Google Maps only as an external link creates different data flows from loading an embedded map within a page. The actual method of use must be verified.9. Retention, Deletion and Security
A fixed retention period for form records and email copies has not yet been established. This does not provide a legal basis for indefinite retention. You may request information about your records or deletion where the legal conditions are met using the application methods below. Retention periods must be limited according to the relevant processing purpose and legal obligations. Once the conditions for processing no longer apply, deletion, destruction or anonymisation must be carried out. Appropriate technical and organisational measures must be implemented to protect personal data. Access permissions, account security, updates, backups and data sharing methods should be assessed in this context.10. Your Rights
Under Article 11 of the Law, you may:- Learn whether your personal data is being processed.
- Request information if it has been processed.
- Learn the purpose of processing and whether your data is used accordingly.
- Learn the third parties to whom your data is transferred within Türkiye or abroad.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction where the legal conditions are met.
- Request that correction, deletion or destruction be notified to third parties to whom the data has been transferred.
- Object to a result against you arising exclusively from automated analysis.
- Seek compensation for damage caused by unlawful processing.