Privacy Policy & Data Protection
How we process your personal data, which cookies we use and what rights you have.
Last updated: 6 August 2026
Data Protection Notice
Prepared by Mahmutlar Hamam & Spa as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"). If you are in the EU/UK, the same commitments apply alongside the GDPR.
Data controller
Mahmutlar Hamam & Spa
Mahmutlar Mah. Barbaros Cad. No: 00, 07460 Alanya / Antalya
Phone: +90 537 867 83 89
What data we process
- Identity and contact: the name, phone number and accommodation details you send us on WhatsApp or by phone. There is no form on this site; we only receive these details if you write them yourself.
- Booking details: the treatment, date and number of guests you state in the WhatsApp conversation.
- Health information: only if you tell us (pregnancy, blood pressure, skin conditions and so on). This is special category data; it is processed with your explicit consent, solely so the treatment can be carried out safely, and deleted after your session.
- Technical and usage data: anonymous site usage statistics and advertising campaign information collected via cookies.
- Ad click record: only if you arrive via a Google ad, we record your IP address, the click identifier (gclid), your time on the page and scroll depth. The purpose is click fraud detection — separating automated and malicious clicks that drain the advertising budget. The legal basis is legitimate interest. These records are deleted after 30 days, are never used for marketing and are not linked to your identity. Nothing is collected on non-ad visits.
Why we process it
To create and confirm your booking, to deliver the treatment appropriately, to meet our legal record-keeping obligations and — only if you allow it — to measure the performance of our advertising.
Who we share it with
When your booking message is sent over WhatsApp it passes through Meta Platforms’ infrastructure. If you give permission, measurement data is shared with Google (Analytics and Ads). Beyond this your personal data is never sold or transferred to third parties for marketing. Data may be shared with competent public authorities where legally required.
How long we keep it
Booking records are kept for 2 years after the service is provided, and accounting records for 10 years as required by law. Health information is deleted once the session is complete. Cookie data is kept for a maximum of 24 months.
Your rights
Under KVKK art. 11 (and, where applicable, the GDPR) you have the right to learn whether your data is being processed, to request information, to have it corrected or erased, to object to processing and to seek compensation for any damage. Contact us on +90 537 867 83 89 or in writing at our business address; we respond within 30 days at the latest.
Cookie Policy
When the site loads, only strictly necessary cookies run. Measurement and advertising cookies are not loaded until you explicitly consent.
| Type | What it does | Duration | Consent |
|---|---|---|---|
| Strictly necessary | Remembers your cookie choice. Without it you would be asked again on every page. | 12 months | Not required |
| Measurement Google Analytics 4 |
How many people viewed which page and where they came from — without identifying anyone. | 24 months | With your consent |
| Video YouTube (nocookie) |
Plays the film on the home page. Without consent the video is never loaded and the photograph remains. | Session | With your consent |
| Advertising Google Ads |
Measures which advert led to a booking. | 90 days | With your consent |
You can change your choice at any time:
Contact
For any question or request about privacy: +90 537 867 83 89
Before going live, the company's registered trade name, tax details and VERBİS registration (if any) must be added, and the text should be reviewed by a lawyer.