Personal Data Protection and Privacy Notice

At Esthappy, we care about the privacy and security of your personal data. This notice explains which personal data we collect through the Esthappy website and remote assessment services, how we use this data, how long we retain it, and what rights you have regarding your information.

1. Personal Data Collected

Within the scope of our services, only the following personal data may be processed to the extent necessary:

• Name and surname
• Email address
• Phone number
• Information you provide during communication
• Photos and images you voluntarily submit for remote assessment
• Messages and content from your written correspondence with us
• Other information required for the offer and assessment process

You are not required to send photos or images. Such content is processed only if you choose to share it voluntarily, and solely for the purpose of remote assessment and providing services tailored to your request.

2. Purposes of Processing Personal Data

The personal data collected may be used for the following purposes:

• To receive and evaluate your requests
• To communicate with you
• To carry out the remote assessment process
• To prepare services and offers tailored to your needs
• To respond to your questions and requests
• To manage communication history and service processes
• To ensure information security and the safe delivery of services
• To fulfill our legal obligations

Your personal data will not be used for purposes other than those specified.

3. Sharing of Personal Data

Your personal data will not be sold, rented, or transferred to third parties for advertising purposes.

Your data may be shared only with relevant service providers, and only to the extent necessary for service delivery, technical infrastructure, or to fulfill legal obligations.

If such sharing is required, appropriate technical and administrative measures will be taken to protect the confidentiality and security of your data.

4. Retention Period of Personal Data

Your personal data is retained for as long as required by the purposes of processing and in accordance with applicable legal obligations.

In general, your data is stored for three years from the date of last contact. At the end of this period, unless there is another legal retention requirement, your data will be securely deleted, destroyed, or anonymized.

5. Data Security

Appropriate technical and administrative security measures are implemented to protect your personal data against unauthorized access, loss, misuse, alteration, or disclosure.

However, it cannot be guaranteed that any data transmission over the internet is entirely risk-free. For this reason, it is recommended that you share your personal and sensitive information only to the extent necessary.

6. Cookies

We may use essential cookies on our website that are necessary for the operation of the service.

Additionally, with your explicit consent, we may use measurement/analytics cookies to understand how the website is used and to improve our services.

Non-essential cookies will not be activated without your consent.

You can change your cookie preferences at any time via your browser settings or through the cookie preferences offered on the site.

7. Your Rights Under KVKK

Under the Law on the Protection of Personal Data No. 6698 (“KVKK”), regarding your personal data, you may:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in accordance with that purpose,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of your personal data if legal conditions are met,
• Request restriction of processing,
• Request transfer of your data to another data controller within the framework of legal requirements,
• Exercise other rights related to the processing of your personal data as provided by relevant legislation

You may have these rights.

8. Your Rights Under GDPR

To the extent applicable under the European Union General Data Protection Regulation (“GDPR”):

• Access your personal data,
• Request correction of inaccurate or incomplete data,
• Request deletion of your personal data,
• Request restriction of processing,
• Data portability,
• Object to processing,
• Withdraw your consent for data processing activities based on consent

You have these rights.

Withdrawal of consent does not affect the lawfulness of data processing carried out before the withdrawal.

9. How Can You Exercise Your Rights?

You can send your requests or applications regarding your personal data and rights to us via the contact address below:

Email: [email protected]

To ensure the secure completion of your application, we may request additional information to verify your identity.

Your applications will be evaluated and finalized within the legal timeframes set out in the applicable provisions of KVKK and GDPR.

10. Changes to This Notice

Esthappy may update this Privacy and Personal Data Protection Notice in line with changes in applicable legislation, our services, or our data processing procedures.

The current version will always be published on our website. In case of significant changes, additional notifications may be provided as required by law.