GDPR and Privacy Notice
Cosmeticium Notice on the Protection and Processing of Personal Data
1. Definitions
In this Privacy Notice;
Personal Data: Any information relating to an identified or identifiable natural person,
Special Categories of Personal Data: Data considered as special categories of personal data under Law No. 6698 on the Protection of Personal Data, particularly health data,
Law on the Protection of Personal Data / PDPL: Law No. 6698 on the Protection of Personal Data, which was published in the Official Gazette and entered into force on 7 April 2016,
Data Processor: The natural or legal person who processes personal data on behalf of the Data Controller, based on the authorization granted by the Data Controller,
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system,
shall have the meanings set out above.
www.cosmeticium.com (the “Website”) presents this Privacy Notice, in its capacity as Data Controller, pursuant to Law No. 6698 on the Protection of Personal Data (the “PDPL”), in order to inform you about the methods and legal grounds for collecting your personal data, the purposes for which your personal data is processed, our methods for protecting your personal data, the categories of personal data processed, the transfer of your personal data to third parties and/or abroad, and the rights you have under the PDPL.
2. Identity of the Data Controller
Under the PDPL, the relevant “Data Controller” is Cosmeticium, the operator of the website www.cosmeticium.com.
Company Name: [The company's official trade name should be entered here]
Trade Registry Number: [The trade registry number, if any, should be entered here]
MERSIS Number: [The MERSIS number, if any, should be entered here]
Address: [The company's official headquarters address should be entered here]
Website: www.cosmeticium.com
3. Personal Data Processed
The following personal data may be processed by Cosmeticium through the Website, contact forms, hair analysis forms, appointment forms, WhatsApp redirects, email communications, phone calls, social media channels and similar communication channels:
- First and last name information
- Phone number
- Email address
- Country and city information
- Requested service or treatment information
- Information regarding appointment and consultation requests
- Explanations shared via the contact form or analysis form
- Photographs, images or evaluation materials voluntarily shared by the user
- Health information shared by the user regarding hair transplantation, hair loss, medical history or treatment eligibility
- IP address, device information, browser information, visit date and site usage data
- Usage data obtained through cookies and similar technologies
Health data and information regarding treatment evaluation may qualify as special categories of personal data under the PDPL. This data is processed in accordance with the relevant legislation and, where necessary, within the scope of your explicit consent.
4. Purposes of Processing Your Personal Data
Your personal data may be processed for the following purposes within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the PDPL:
- Evaluating your requests for hair transplantation, aesthetic procedures and medical consultation
- Conducting preliminary analysis, eligibility evaluation and treatment planning processes
- Creating appointments, coordinating patients and organizing the operation process
- Responding to user requests and conducting communication activities
- Conducting quotation, information and consultation processes
- Conducting patient satisfaction, follow-up and post-operative support processes
- Improving service quality and enhancing user experience
- Ensuring the security of the Website and operating the technical infrastructure
- Planning and executing advertising, promotion, campaign and marketing activities
- Providing content and service recommendations based on users' interests, needs and usage habits
- Fulfilling legal obligations
- Sharing information when requested by authorized public institutions and organizations
- Preventing, monitoring and resolving legal disputes
Your personal data may be processed without seeking your explicit consent for the purposes of fulfilling our legal obligations, establishing or performing a contract, fulfilling our legal obligations, establishing, exercising or protecting a right, and protecting our legitimate interests provided that no harm is caused to your fundamental rights and freedoms.
In cases that require explicit consent, your personal data is processed solely based on your explicit consent. In particular, special categories of personal data such as health data, photographs and visual evaluation materials are processed in line with your explicit consent, without prejudice to the cases stipulated in the relevant legislation.
5. Methods and Legal Grounds for Collecting Your Personal Data
Your personal data may be collected electronically through the contact forms, hair analysis forms, appointment forms, WhatsApp links, phone calls, email correspondence, social media communications, cookies and similar digital technologies on the Website.
In addition, photographs, health information, treatment history, expectations and explanations voluntarily shared by the user within the scope of the service process may also be processed for the purpose of conducting evaluation and consultation processes.
The processing of your personal data is based on the following legal grounds set out in Article 5 of the PDPL:
- Being expressly stipulated in the laws,
- Being directly related to the establishment or performance of a contract,
- Being mandatory for the data controller to fulfill its legal obligation,
- Having been made public by the data subject themselves,
- Data processing being mandatory for the establishment, exercise or protection of a right,
- Data processing being mandatory for the legitimate interests of the data controller, provided that no harm is caused to the fundamental rights and freedoms of the data subject,
- The existence of explicit consent,
are the legal grounds relied upon.
Your special categories of personal data are processed within the scope of Article 6 of the PDPL, in accordance with the relevant legislation and, where necessary, by obtaining your explicit consent.
6. Transfer of Your Personal Data to Third Parties and/or Abroad
Your personal data may be shared with third parties located in Turkey or abroad in accordance with Articles 8 and 9 of the PDPL, in order to fulfill the processing purposes stated above and to carry out the service processes.
In this context, your personal data may be shared with;
- Authorized company employees and patient coordinators,
- Contracted clinics, doctors and healthcare providers,
- Call center and patient communication service providers,
- Server, hosting, software, cloud computing and technical infrastructure service providers,
- CRM, email delivery, SMS, WhatsApp, call and communication infrastructure providers,
- Advertising, marketing, digital analytics and campaign management service providers,
- Persons or organizations from whom legal, financial advisory, tax and consultancy services are received,
- Banks, payment institutions and financial service providers,
- Business partners, suppliers and third parties from whom services are received,
- Authorized public institutions and organizations.
can be shared.
Due to the nature of the service, your personal data may be transferred to technical infrastructure, cloud computing, advertising, analytics, communication or CRM service providers located abroad. In cases requiring transfer abroad, the conditions stipulated in the PDPL are complied with and, where necessary, your explicit consent is obtained.
7. Processing of Health Data and Visual Materials
Due to the nature of the consultation and preliminary evaluation services provided by Cosmeticium, users may share information regarding their hair loss condition, medical history, medications used, previously performed operations or hair transplantation eligibility.
In addition, users may submit photographs, videos or similar visual materials for the purpose of hair analysis or treatment evaluation. This data is processed solely for the purposes of preliminary evaluation, consultation, operation planning, treatment process follow-up and patient communication.
Since health data and visual materials may qualify as special categories of personal data, they are processed in accordance with the relevant legislation and, where necessary, within the scope of explicit consent.
8. Retention Period of Personal Data
Your personal data is retained for the period required by the purposes of processing and within the scope of the legal retention periods stipulated in the relevant legislation.
In the event that the reasons requiring processing cease to exist, your personal data is deleted, destroyed or anonymized in accordance with the relevant legislation.
9. Measures for the Protection of Personal Data
Cosmeticium takes care to implement the necessary technical and administrative measures in order to prevent the unlawful processing of your personal data, to prevent unlawful access to personal data, and to ensure that personal data is stored securely.
In this context, access to personal data is limited to authorized persons; technical infrastructure, security, backup, access control and data storage processes are carried out in a manner appropriate to the nature of the service.
10. Your Rights Under Article 11 of the PDPL as a Personal Data Owner
As a personal data owner, we inform you that you have the following rights pursuant to Article 11 of the PDPL:
- To learn whether your personal data is being processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
- To know the third parties to whom your personal data is transferred, whether domestically or abroad,
- To request the correction of your personal data if it has been processed incompletely or incorrectly,
- To request that the actions taken in this context be notified to the third parties to whom your personal data has been transferred,
- To request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, even though it has been processed in accordance with the PDPL and other relevant legal provisions,
- To request that the actions taken in this context be notified to the third parties to whom your personal data has been transferred,
- To object to a result arising against you as a result of the exclusive analysis of the processed data by automated systems,
- To request the compensation of damages in the event that you suffer damage due to the unlawful processing of your personal data.
11. Application Method
You can submit your applications regarding your rights under Article 11 of the PDPL to Cosmeticium via the contact form on www.cosmeticium.com or through the Company's official communication channels.
Your applications will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the process requires an additional cost, a fee may be charged to you in accordance with the tariff determined by the Personal Data Protection Board.
12. Changes to the Privacy Notice
Cosmeticium may update this GDPR and Privacy Notice when it deems necessary. The updated notice becomes effective as of the date it is published on www.cosmeticium.com.
Users are advised to regularly review this Privacy Notice in order to access up-to-date information regarding the processing of personal data.