Privacy, considered.

Who is responsible for your data?

For the personal-data processing described in this Policy, the data controller is Merve Akkaya, operating the website merveakkaya.com.

Privacy and data-protection enquiries may be sent to hello@merveakkaya.com .

What information may be collected?

Information you provide directly

If you contact Merve Akkaya by email or through another communication channel made available on the website, information may include:

• Your name and email address.
• Other contact information you choose to provide.
• The content of your enquiry or correspondence.
• Information about the skincare question, consultation, education enquiry or professional request you choose to describe.

Technical information

When you visit the website, limited technical information may be processed automatically by the website, hosting infrastructure and security systems. This may include:

• IP address.
• Browser and device information.
• Date and time of access.
• Pages or resources requested.
• Technical, security and diagnostic information associated with the request.

Analytics and similar technologies

Where analytics or other non-essential technologies are enabled, information such as page views, traffic source, approximate location, device type and interaction data may be processed to understand how the website is used.

Where consent is required by applicable law, these technologies will not be activated until the relevant consent has been provided. Current cookie categories and available choices are described in the Cookie Policy and cookie preference controls.

Why is personal data processed?

Personal data may be processed only where there is a defined purpose. Depending on your interaction with the website, those purposes may include:

• Responding to questions and enquiries.
• Taking steps requested by you in relation to a consultation or professional service.
• Managing communication about skincare consultations, education or other professional enquiries.
• Operating, maintaining and securing the website.
• Diagnosing technical problems and preventing misuse, fraud or security incidents.
• Understanding website performance and usage where analytics has been lawfully enabled.
• Complying with applicable legal, regulatory, accounting or administrative obligations.
• Establishing, exercising or defending legal rights where necessary.

What is the legal basis?

Depending on the circumstances and the law that applies to you, processing may rely on one or more of the following:

• Your request for information or steps taken before entering into a service relationship.
• Performance of an agreement where one exists.
• Compliance with a legal obligation.
• Legitimate interests in responding to enquiries, maintaining records, protecting the website and operating the professional activity, provided those interests do not override your applicable rights and freedoms.
• Your consent, where consent is required, including for certain cookies, analytics or communications.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

A note about health and sensitive information.

MerveAkkaya.com provides professional skincare information and access to non-medical skincare consultations. It is not intended as a channel for submitting medical records, diagnoses or unnecessary sensitive personal information.

If information requiring additional legal protection is genuinely necessary for a particular interaction, it will be handled only where there is an appropriate legal basis and any additional safeguards or consent required by law have been addressed.

Who may receive personal data?

Personal data is not sold. It may be disclosed only where reasonably necessary to operate the website or respond to your request.

Depending on the service involved, recipients may include:

• Website hosting, infrastructure, security and technical service providers.
• Email and communication service providers.
• Analytics or consent-management providers where those services are enabled lawfully.
• Professional advisers where reasonably necessary.
• Courts, regulators, public authorities or other parties where disclosure is required or permitted by law.

Service providers processing personal data on behalf of the controller are expected to process that information only for the relevant service and subject to appropriate confidentiality and data-protection requirements.

International data transfers.

Some technology, hosting, communication or analytics providers may operate infrastructure in countries other than Türkiye or the country from which you access the website.

Where personal data is transferred internationally, applicable requirements under Turkish data-protection law, the GDPR where relevant, and other applicable legislation are taken into account. Transfers are made only where an appropriate legal condition, mechanism or safeguard is available.

How long is information kept?

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected.

Retention is determined by factors such as:

• Whether an enquiry or professional relationship remains active.
• Whether reasonable follow-up may still be required.
• Applicable legal, accounting or regulatory retention obligations.
• The need to establish, exercise or defend legal claims.
• Security and fraud-prevention requirements.

When personal data is no longer required and there is no lawful reason to retain it, it will be deleted, destroyed or anonymised as appropriate.

Cookies and your choices.

The website may use technologies required for basic operation, security and preference management. Additional technologies such as analytics will be subject to the consent requirements that apply to them.

You can find more information about cookie categories, purposes and available controls in the Cookie Policy.

Where a cookie preference panel is available, you may revisit your choices through the Cookie Preferences control on the website.

Your data-protection rights.

Depending on the legislation applicable to you, you may have rights concerning your personal data.

Rights under Turkish data-protection law

Where Law No. 6698 on the Protection of Personal Data (KVKK) applies, your rights may include the right to:

• Learn whether your personal data is being processed.
• Request information about processing.
• Learn the purposes of processing and whether data is used consistently with those purposes.
• Learn the third parties to whom your data has been transferred in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction where the applicable legal conditions are satisfied.
• Request notification of certain correction or deletion operations to relevant recipients.
• Object to a result arising against you from analysis performed exclusively through automated systems.
• Claim compensation where unlawful processing causes damage, subject to applicable law.

Additional rights where the GDPR applies

Depending on the circumstances, these may include rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent where consent is the legal basis for processing.

You may also have the right to lodge a complaint with the competent data-protection supervisory authority.

Automated decision-making.

MerveAkkaya.com does not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

External websites and platforms.

The website contains links to external services and platforms, including Efem Academy and social-media platforms.

Once you leave merveakkaya.com, the external website or platform processes information according to its own terms and privacy practices. Merve Akkaya is not responsible for the privacy practices of independently operated third-party websites.

Children and minors.

This website is not designed to intentionally collect personal data from children without the involvement of a parent, guardian or another lawful basis where required.

If you believe information relating to a minor has been submitted inappropriately, please contact us so that the situation can be reviewed.

Security.

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration or disclosure.

No internet transmission or storage system can guarantee absolute security. For this reason, visitors should avoid sending unnecessary sensitive information through ordinary email or other unsecured channels.

Changes to this Policy.

This Privacy Policy may be updated when website features, service providers, data-processing activities or legal requirements change.

The latest version will always be published on this page with an updated revision date.