× Send

Terms and Conditions

Information Notice on the Processing of Personal Data in the Contact Form

This information notice has been prepared by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi, acting as the data controller, in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Obligation to Inform. Its purpose is to inform you about the purposes of processing your personal data, the legal grounds, the method of collection, the parties to whom your data may be transferred, and your rights under KVKK.

The personal data you share (such as your name, surname, phone number, e-mail, etc.) through the contact form on our website are processed by our company in order to carry out the necessary work by relevant business units so that related persons can benefit from the products and services offered by our company, to execute relevant business processes, and to contact you regarding your request. Please note that we do not have absolute control over the information you share through this form. Therefore, we recommend that you do not share with us any personal data or special categories of personal data that you do not wish us to know.

Such personal data are processed automatically on the basis of the legal grounds set forth in Article 5 of KVKK: “it is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” and “it is mandatory for the data controller to fulfill its legal obligation”. The data will only be shared with the relevant judicial authorities in case of legal disputes.

Within the scope of Article 11 of the Law, which regulates the rights of the data subject, you may submit your requests in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller” either in writing to the address Sinanpaşa Mahallesi Süleyman Seba Cadde No: 14/5 Beşiktaş, Istanbul or by e-mail to [email protected].

For your convenience, an application form has been published on our website to inform and assist you. 

Download the Clarification Text Regarding Personal Data Processed in the Contact Form

Corporate Personal Data Protection Policy

Document Information

Document Name:
Personal Data Protection Policy

Document Purpose:
The purpose of the Personal Data Protection Policy is to define the processes and principles that Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi will follow to ensure the protection of personal data.

Publication Date:
18.08.2025

Version No:
1        www.akkasgroup.com

Reference / Legal Basis:
Law No. 6698 on the Protection of Personal Data and other applicable legislation

Approval Authority:
Board of Directors of Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi

GÖKSU BEAUTY CENTER TOURISM TRADE LIMITED COMPANY CORPORATE PERSONAL DATA PROTECTION POLICY

PURPOSE        www.akkasgroup.com

Every individual has the fundamental right, guaranteed by the Constitution, to request the protection of their personal data. At Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi, we consider fulfilling this right as one of our most important responsibilities. Therefore, we prioritize the lawful processing and protection of personal data.

The Corporate Personal Data Protection Policy has been prepared to define the principles and procedures we follow when processing and protecting personal data, reflecting the importance we place on safeguarding personal information.

SCOPE

This policy covers all personal data managed by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi, whether obtained, recorded, stored, preserved, altered, reorganized, disclosed, transferred, acquired, made accessible, classified, or restricted in automated or non-automated ways.

The policy applies to personal data of the company’s partners, officials, clients, employees, supplier representatives and their employees, and third parties.

Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi may amend this policy to comply with legislation and the decisions of the Personal Data Protection Authority, and to ensure better protection of personal data.

DEFINITIONS

AbbreviationDefinition
Recipient GroupCategory of real or legal persons to whom personal data is transferred by the data controller.
Explicit ConsentConsent given freely, based on information, regarding a specific matter.
AnonymizationRendering personal data unidentifiable even if combined with other data.
Data SubjectReal person whose personal data is processed.
Authorized UserIndividuals who process personal data within the data controller organization or under its authority, excluding those responsible for technical storage, protection, and backup.
DestructionDeletion, elimination, or anonymization of personal data.
Law / PDPLLaw No. 6698 on the Protection of Personal Data.
Recording MediumAny environment containing personal data processed fully or partially in automated ways or as part of a data recording system.
Personal DataAny information relating to an identified or identifiable real person.
Data InventoryInventory detailing personal data processing activities, purposes, legal basis, data category, recipient groups, retention periods, cross-border transfers, and security measures.
Processing of Personal DataAny action performed on personal data including obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making accessible, classifying, or restricting use.
CommissionPersonal Data Protection Commission established by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi to manage the policy and related procedures.
BoardPersonal Data Protection Board.
AuthorityPersonal Data Protection Authority.
Special Categories of Personal DataData regarding race, ethnic origin, political opinion, philosophical belief, religion, dress, association memberships, health, sexual life, criminal convictions, security measures, and biometric or genetic data.
Periodic DestructionRegular deletion, destruction, or anonymization of personal data once processing conditions no longer exist, in accordance with the policy.
PolicyPersonal Data Protection Policy.
Data ProcessorReal or legal person processing personal data on behalf of the data controller under authorization.
Data ControllerReal or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

GENERAL PRINCIPLES        www.akkasgroup.com

Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi ensures that all new workflows involving personal data comply with the following principles. Workflows found non-compliant are not implemented.

When processing personal data, the company ensures that it:

  1. Complies with the law and ethical rules.

  2. Ensures personal data is accurate and up-to-date where necessary.

  3. Ensures the processing purpose is specific, clear, and legitimate.

  4. Ensures the data processed is relevant, limited to the purpose, and proportionate.

  5. Retains data only as long as legally required or necessary for the purpose, and destroys it when the purpose ceases.

DUTIES AND RESPONSIBILITIES

A Personal Data Protection Commission has been established to manage this policy and related procedures and ensure its enforcement. The commission consists of the General Manager and the Human Resources Officer.

The commission may also consult a PDPL advisor as needed for compliance with Law No. 6698. The commission may invite the advisor to meetings when necessary.

Responsibilities:

  • Regular meetings every six months; extraordinary meetings if required (e.g., data breach).

  • Discuss necessary amendments or improvements to the policy.

  • Identify measures for lawful processing and protection of personal data.

  • Raise awareness of PDPL internally and with partners.

  • Identify risks and implement administrative and technical measures.

  • Maintain communication with the Authority.

  • Evaluate requests from data subjects.

  • Monitor periodic destruction processes.

  • Update the data inventory.

  • Assign responsibilities regarding the above tasks.

MEASURES FOR DATA SECURITY

The company takes all necessary technical and administrative measures to:

  1. Prevent unlawful processing of personal data.

  2. Prevent unauthorized access to personal data.

  3. Ensure the preservation of personal data.

Technical Measures:

  • Network and application security measures.

  • Security during IT system development, procurement, and maintenance.

  • Regular access logs.

  • Up-to-date antivirus systems.

  • Firewalls.

  • Physical security for data-containing environments.

  • Protection against external risks (fire, flood, etc.).

  • Backups and security of backed-up data.

  • User account management and authorization controls.

  • Logging and monitoring systems.

  • Attack detection and prevention systems.

  • Encryption of data.

Administrative Measures:

  • Disciplinary regulations including data security provisions.

  • Employee training and awareness programs.

  • Corporate policies on access, usage, storage, and destruction.

  • Data masking where necessary.

  • Confidentiality agreements.

  • Role-based authorization matrix.

  • Revocation of access for employees changing roles or leaving.

  • Contracts include data security clauses.

  • Policies and procedures for personal data protection.

  • Fast reporting of personal data issues.

  • Internal periodic/random audits.

  • Risk and threat assessments.

  • Procedures for special categories of personal data.

  • Secure transfer of sensitive data via encrypted or official channels.

  • Awareness for data-processing service providers.

DATA SUBJECT RIGHTS

Data subjects can request from Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi to:

  • Learn whether their personal data is processed.

  • Request information if data is processed.

  • Learn the purpose of processing and if data is used accordingly.

  • Know the third parties to whom data is transferred domestically or internationally.

  • Request correction of incomplete or inaccurate data and notification to third parties.

  • Request deletion, destruction, or anonymization when reasons for processing cease, and notification to third parties.

  • Object to automated processing that produces unfavorable results.

  • Claim compensation for damages caused by unlawful processing.

BREACH NOTIFICATIONS

Employees report any suspected violation of PDPL or the Policy to the Commission. The Commission may convene and prepare an action plan.

If a breach involves unlawful acquisition of personal data by third parties, the Commission notifies the data subject and Authority within 72 hours in accordance with the Board’s decision dated 24.01.2019, No. 2019/10.

AMENDMENTS

Changes to the Policy are prepared by the Commission and submitted to the Board of Directors for approval. Updated policies may be sent via email or published on the company website.

EFFECTIVE DATE

This version of the Policy was approved by the Board of Directors and became effective on 18.08.2025.

Download the Corporate Personal Data Protection Policy Document

Corporate General Disclosure Text Regarding the Processing of Personal Data

As Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi (“TheSanitas”), we have prepared this disclosure text to inform our Visitors, Online Visitors, Customers, Potential Customers, Supplier Employees, and Supplier Representatives about the processing, storage, and transfer of your personal data within the scope of activities arising from the Personal Data Protection Law No. 6698 (“KVKK”) and related legislation and legal regulations.

1) What Categories of Personal Data Do We Process and For What Purposes? www.akkasgroup.com

Your personal information may be processed by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi in accordance with the principles set forth in Article 4.2 of the KVKK:

(i) Compliance with law and fairness,
(ii) Accuracy and being updated when necessary,
(iii) Processing for specific, clear, and legitimate purposes,
(iv) Relevance, limitation, and proportionality in relation to the purpose for which they are processed,
(v) Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

In line with these principles and within the scope of our ongoing business relationships with our partners (a person may fall into more than one category), personal data may be processed for the purposes outlined below.

A. Our Visitors

Identity information of our visitors (e.g., first and last name), physical site security information (e.g., camera recordings);

  • a) Creation and tracking of visitor records,

  • b) Ensuring physical site security.

B. Our Online Visitors

For online visitors using our website, transaction security information (e.g., IP address), marketing information (e.g., shopping history, survey and cookie records), and identity and contact information (e.g., email address) if provided by you;

  • a) Conducting activities in compliance with legislation,

  • b) Executing information security processes,

  • c) Tracking requests/complaints,

  • d) Carrying out communication activities,

  • e) Sharing information with authorized persons, institutions, and organizations,

  • f) Enabling access to our website via the Internet.

C. Our Customers

Identity information, contact information, customer transaction information (e.g., order details), physical site security information, financial information (e.g., balance sheet), legal transaction information, marketing information (e.g., shopping history) of our individual or corporate customers and/or their authorized persons or employees;

  • a) Conducting activities in compliance with legislation,

  • b) Managing finance and accounting operations,

  • c) Conducting and auditing business activities,

  • d) Executing logistics operations,

  • e) Providing post-sale support services,

  • f) Managing product/service sales processes,

  • g) Conducting marketing analysis studies,

  • h) Managing contract processes,

  • i) Sharing information with authorized persons, institutions, and organizations,

  • j) Ensuring physical site security,

  • k) Resolving legal disputes,

  • l) Executing storage and archiving activities,

  • m) Conducting risk management processes,

  • n) Managing loyalty processes related to company/product/services,

  • o) Conducting communication activities.

D. Our Potential Customers www.akkasgroup.com

Identity information, contact information, customer transaction information, physical site security information, and marketing information of potential individual or corporate customers and/or their authorized persons or employees;

  • a) Managing product/service sales processes,

  • b) Managing contract processes,

  • c) Ensuring physical site security,

  • d) Conducting marketing analysis studies.

E. Our Supplier Employees

Identity information, contact information, physical site security information, and professional experience information (e.g., on-the-job training) of our supplier employees;

  • a) Conducting communication activities,

  • b) Conducting and auditing business activities,

  • c) Ensuring physical site security,

  • d) Managing supply chain processes,

  • e) Executing logistics operations,

  • f) Conducting activities in compliance with legislation,

  • g) Managing occupational health and safety activities.

F. Our Supplier Representatives www.akkasgroup.com

Identity information, contact information, physical site security information, customer transaction information, financial information, marketing information, legal transaction information of individual or corporate supplier representatives;

  • a) Conducting and auditing business activities,

  • b) Managing procurement processes,

  • c) Managing finance and accounting operations,

  • d) Managing contract processes,

  • e) Managing investment processes,

  • f) Ensuring physical site security,

  • g) Tracking and executing legal affairs.

G. Relatives of Our Employees

Identity and contact information (e.g., address) of our employees’ relatives;

  • a) For reporting to Social Security Institution (SGK) in case of workplace accidents.

2) How Are Your Personal Data Collected?

Your personal data in the categories above are collected physically (e.g., order forms, contracts, visitor forms), electronically through information systems and devices (e.g., telecommunications infrastructure, computers, and phones), from third parties (e.g., KKB and Findeks), via our website, or through other documents declared by you, either automatically or manually.

3) What Is the Legal Basis for the Collection of Your Personal Data?

Your personal data are processed by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi based on the legal grounds outlined in Article 5 of the KVKK for the purposes stated above:

(i) Explicitly required by law,
(ii) Necessary for the establishment or performance of a contract,
(iii) Required for the data controller to fulfill a legal obligation,
(iv) Necessary for the establishment, exercise, or protection of a right,
(v) Necessary for the legitimate interests of the data controller without harming the fundamental rights and freedoms of the data subject.

4) Do We Share Your Personal Data with Third Parties? www.akkasgroup.com

  • a) Visitor personal data may be shared with law enforcement or judicial authorities if required by law or for the resolution of legal disputes.

  • b) Online visitor personal data may be shared with judicial authorities or relevant public institutions if required by law or for the resolution of legal disputes.

  • c) Customer personal data may be shared with relevant public institutions, group companies, IT providers, suppliers, cargo companies, insurance companies, banks, and accountants to the extent necessary for lawful execution of activities, auditing, risk management, and proper fulfillment of services. Personal data may also be shared with our legal counsel and judicial authorities as evidence in potential legal disputes.

  • d) Potential customer personal data may be shared with our legal counsel and judicial authorities as evidence in potential legal disputes.

  • e) Supplier employee personal data may be shared with relevant public institutions, group companies, IT providers, suppliers, cargo companies, banks, and accountants to the extent necessary for lawful execution of activities, auditing, and proper fulfillment of services. Data may also be shared with legal counsel and judicial authorities as evidence in potential disputes.

  • f) Supplier representative personal data may be shared similarly with relevant public institutions, group companies, IT providers, suppliers, cargo companies, banks, and accountants, as well as legal counsel and judicial authorities if needed.

  • g) Personal data of employees’ relatives may be shared with public institutions for compliance with legal obligations and with legal counsel and judicial authorities for potential legal disputes.

5) Do We Transfer Your Personal Data Abroad? www.akkasgroup.com

Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi does not transfer your personal data abroad.

6) How Can You Exercise Your Rights Regarding Your Personal Data?

You can submit your requests under Article 11 of the KVKK via the “Data Controller Application Form” prepared to facilitate your application in accordance with the “Communiqué on Procedures and Principles for Application to the Data Controller” on the website of Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi at https://thesanitas.com/en/.

Data Controller: GÖKSU GÜZELLİK MERKEZİ TURİZM TİCARET LİMİTED ŞİRKETİ
Address: SİNANPAŞA MAHALLESİ SÜLEYMAN SEBA CADDE NO: 14/5 BEŞİKTAŞ İSTANBUL
E-Mail: [email protected]

Download the Corporate General Disclosure Text on the Processing of Personal Data

Data Controller Application Form Disclosure Text

This Disclosure Text has been prepared by Göksu Güzellik Merkezi Turizm Ticaret Limited Şirketi, acting as the data controller, to inform you about the purposes of processing your personal data, the legal grounds, methods of collection, possible recipients, and your rights under the Law on the Protection of Personal Data No. 6698 (“KVKK”), in accordance with Article 10 of KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

The personal data you provide through the “Data Controller Application Form,” including identity, contact, and other personal data (related to your relationship with the company and your requests from the company), are processed for the purposes of evaluating and handling the matter you are applying for, conducting relevant business processes, and communicating with you regarding the matter. Please note that we do not have absolute control over the information you share through this form. We recommend that you do not share personal data or sensitive personal data that you do not want us to know.

These personal data are processed, either automatically or manually, based on the legal grounds stated in Article 5 of KVKK—“the processing of data is necessary for the data controller to fulfill its legal obligation and the processing is necessary for the establishment, exercise, or protection of a right”—and any sensitive personal data you provide through the form are processed based on the legal ground in Article 6 of KVKK—“the processing is necessary for the establishment, exercise, or protection of a right”—and will only be shared with the relevant judicial authorities in case of legal disputes.

Requests under Article 11 of the Law, which governs the rights of the relevant person, can be submitted via the form below and through the contact channels provided in accordance with the “Communiqué on the Procedures and Principles for Applications to the Data Controller.”

Download the Data Controller Application Form