1. Data controller and contact
The controller is Fatma Süha Beauty, the official business name confirmed by the business. Tax office: Beşiktaş; tax number: 7910380969. Registered address: Bebek Mahallesi Yeni Yol Çıkmazı Sokak No:1 A, Beşiktaş, İstanbul, Türkiye. Send personal data requests to bilgi@fatmasuha.com or the registered address. The business has no registered electronic mail (KEP) address. This notice covers visits, accounts, profiles and appointments on fatmasuha.com and app.fatmasuha.com.
2. Data and purposes
Account administration uses your name, email, authentication and session records. Booking uses contact details, branch, service, dates and times, package/session plans, payment status and change/cancellation history. Optional profile details support the corresponding profile functions. IP addresses, browser/device information and technical error records may be processed for security. Purposes are creating and protecting accounts, arranging and delivering appointments, sending confirmations, reminders, changes and cancellations, handling enquiries and complaints, and meeting legal obligations.
3. Collection and legal grounds
Data comes from website/app forms, profile fields, verification, Google sign-in if chosen, communications with the branch and technical system records. Necessary account and booking data relies on entering into or performing a contract; mandatory records on legal obligations; dispute records on establishing, exercising or protecting a right; proportionate security records on legitimate interests without prejudicing your fundamental rights. Purposes requiring explicit consent are presented separately and remain optional. Reading this notice is not consent to marketing or processing sensitive data.
4. Recipients
Data is shared to the necessary extent with authorised branch staff and providers of hosting, software operations, authentication and email. Competent public bodies or dispute authorities may receive information when legally required. Branch calendar entries contain the customer name, service and appointment date/time; email, telephone numbers and private notes are not added to the event. Card details are not requested unless online payment is actively offered. If card payments become available, the payment provider and related data information are displayed at payment.
5. Optional health information and marketing
Health-related profile fields may contain sensitive personal data. Enter only information actually needed for the relevant service; do not put health reports or unnecessary sensitive information in general enquiry or appointment notes. Explicit health-data consent is separate from registration, appointments and marketing permission. Marketing permission is optional, is not required for service and can be withdrawn in your profile. Withdrawal does not affect the lawfulness of earlier processing.
6. Overseas services and cookies
Overseas hosting and email infrastructure, Google sign-in or Google Calendar may involve transfers to providers outside Türkiye. These transfers are subject to Article 9 of Turkish Law No. 6698; this notice itself is neither transfer permission nor explicit consent. Request information on recipients and applicable safeguards at bilgi@fatmasuha.com. Necessary session/security records and optional analytics preferences are managed separately. Optional analytics remains disabled when you do not accept it. Opening WhatsApp, social-media or map links takes you to platforms governed by their own privacy terms.
7. Retention and deletion
The processing purpose and the statutory retention obligations applicable to each data category are considered together. Closing an account or withdrawing consent does not require immediate deletion of records that must be retained for a legal obligation or protection of a right. You may request deletion, destruction or anonymisation when the processing conditions cease to apply, and information on category-specific retention criteria. No single unverified retention period is assumed to apply to every record.
8. Your rights and requests
Under Article 11 of Law No. 6698 you may learn whether data is processed, request information, learn its purposes and whether use matches those purposes, learn domestic/overseas recipients, request correction of incomplete or inaccurate data, request deletion/destruction where statutory conditions apply and notification of those actions to recipients, object to an adverse result arising solely from automated analysis, and seek compensation for unlawful processing. Apply in writing to the registered address or email bilgi@fatmasuha.com from the email registered in our system. Provide sufficient information to identify you and your request, without unnecessary identity copies or health documents. Requests are resolved within 30 days. Where additional cost arises, only the tariff set by the Turkish Personal Data Protection Board may apply.
