Personal Data Privacy Notice under KVKK

Service provider and data controller: Esma Toker. Tax office: Ürgüp. Address: Evka Mah. 427 Sk. Seyir Evler Kon. Yapı Koop. B Blok No 8 İç Kapı No 1 Ürgüp / Nevşehir, Türkiye. Website: https://www.esmatoker.com. Email: esmaatoker@gmail.com. Telephone: +90 539 239 38 90.

This notice is provided for website visitors, people submitting enquiries and clients receiving services under Turkish Personal Data Protection Law No. 6698 (KVKK). Reading this notice does not, by itself, constitute explicit consent.

Data categories and collection methods

Identity and contact data; order, invoice, collection and transaction records; client requests and correspondence; appointment, goal and programme records; and IP addresses and security records are collected electronically through website forms, payment processes, email and the chosen communication channels, or during in-person services.

Purposes and legal bases

Data necessary to create orders, schedule appointments, deliver e-books and provide coaching is processed under Article 5(2)(c) of KVKK, provided that it is directly related to the establishment or performance of a contract. Invoicing and statutory records are processed under Article 5(2)(a) and (ç); dispute records are retained under Article 5(2)(e) for the establishment, exercise or protection of a right. Proportionate transaction records for security and the prevention of misuse may be processed under Article 5(2)(f), subject to a necessity assessment and provided that fundamental rights are not harmed. For optional advertising and marketing activities, separate explicit consent is obtained under Article 5(1) where required.

Health data

Information about injuries, surgery, illnesses and health reports may constitute special categories of personal data. Such information is not requested in the general enquiry form. If health information is needed to plan safe training, a separate notice explains which data will be collected and why. Where no other applicable processing condition exists, separate, freely given explicit consent is obtained under Article 6 of KVKK. Unnecessary health reports are not collected. Health data is not used for advertising targeting.

Recipient groups and transfer purposes

Only necessary data may be shared with iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. for payment processing; relevant technical service providers for website, email and communication services; accounting and financial advisory professionals for financial obligations; and authorised bodies and, where necessary, legal advisers for statutory requests and disputes. Transfers are assessed under Article 8 of KVKK and the relevant data processing conditions.

Transfers abroad

Using systems located abroad for email, online meetings or technical infrastructure may require the transfer of personal data abroad. Such transfers are subject to Article 9 of KVKK. General approval or reading this notice does not, by itself, provide a legal basis for ongoing international transfers. The required transfer information and legal mechanism specific to the service used must also be provided.

Retention

Invoices and financial records are retained for the periods required by applicable legislation; order and contract records are retained for statutory retention and legal claim periods. Enquiry, appointment, coaching and technical records are kept only for a necessary and proportionate period for their processing purpose. When the purpose ends and no other legal basis for retention remains, data is deleted, destroyed or anonymised. Necessity and data minimisation are also applied to the retention of health data.

Your rights

Under Article 11 of KVKK, you may learn whether your data is processed; request information if it has been processed; learn the purpose of processing and whether data is used accordingly; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction when the relevant conditions are met; request that recipients be notified of corrections and disposal; object to an adverse result arising from analysis exclusively through automated systems; and seek compensation for damage caused by unlawful processing.

How to submit a request

You may submit requests in writing to the address above, or send an email to esmaatoker@gmail.com from an email address previously provided to us and registered in our system. Requests must include your name and surname, identity information required by applicable legislation, an address for service and the subject of the request. Requests are resolved as soon as possible according to their nature and within 30 days at the latest. If the process requires an additional cost, the tariff determined by the Turkish Personal Data Protection Board may apply. Explicit consent may be withdrawn; withdrawal does not retrospectively invalidate earlier lawful processing.