Last updated: 20 October 2026
Draft prepared for the website demo. Highlighted items need confirmation, and the final text should be reviewed by a lawyer before going live.
1. Who is responsible
The data controller for this website and for the sessions offered through it is Ceren Cuci, sole trader, Gökçebel, Kule Caddesi No:29 B2, Yalıkavak, Bodrum / Muğla 48400, Türkiye. Email: cerencuci@gmail.com. Phone: +90 533 231 71 97. Tax number / registered trade name to be added
Because the services are offered to visitors from the European Union and the United Kingdom, this policy follows the EU General Data Protection Regulation (GDPR) and the UK GDPR as well as Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK).
2. What data is collected
Only the information you choose to send, plus a minimum of technical data:
- Contact details: name, phone or WhatsApp number, email address.
- Booking details: requested service, date and time, where you are staying (villa, hotel, yacht, area), number of guests.
- Health-related information you share: for example injuries, pregnancy or medical conditions you mention so a session can be adapted safely. This is a special category of data and is used only with your explicit consent.
- Partner details: for concierge requests, the name and role of the person booking, the property and the guest details they provide.
- Technical data: your browser stores your cookie choice. No analytics or advertising trackers are used.
3. Why it is used, and the legal basis
| Purpose | Legal basis (GDPR / KVKK) |
|---|---|
| Answering your enquiry and booking request | Steps at your request before a contract, Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c) |
| Adapting a session to your health and body | Explicit consent, Art. 9(2)(a) GDPR; KVKK Art. 6 |
| Invoicing and legal record keeping | Legal obligation, Art. 6(1)(c) GDPR; KVKK Art. 5(2)(ç) |
| Working with hotels, villas and yachts | Legitimate interest in running the business, Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f) |
| Loading Google Maps | Consent, Art. 6(1)(a) GDPR |
Your data is never sold, used for advertising or used to build profiles.
4. Who receives your data
Data is shared only where needed to answer you or run the service:
- WhatsApp (Meta Platforms Ireland), when you choose to message through WhatsApp.
- Email provider (Google), when you write by email.
- Website hosting provider name to be added, which stores the site and server logs.
- Booking panel provider to be added once the availability panel is live.
- Google Maps, only if you choose to load the map.
- The hotel, villa or yacht partner that booked a session on your behalf, limited to what is needed to arrange it.
Some of these providers process data outside Türkiye and the EEA. Where that happens, transfers rely on adequacy decisions, standard contractual clauses or, under KVKK Art. 9, the safeguards and notifications required by Turkish law.
5. How long it is kept
Enquiries that do not lead to a booking are deleted within 12 months. Booking records are kept for 24 months after your last session so returning guests do not have to repeat themselves. Invoices and accounting records are kept for the period required by Turkish tax law (generally 5 years). Health notes are deleted when they are no longer needed for your sessions, or sooner if you withdraw consent.
6. Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. Under KVKK Art. 11 you also have the right to learn whether your data is processed, for what purpose, and to whom it was transferred.
Write to cerencuci@gmail.com. Requests are answered within 30 days. If you are not satisfied, you can complain to the data protection authority in your EU country, the UK ICO, or the Turkish Personal Data Protection Authority (KVKK).
7. Security
Access to booking information is limited to Ceren Cuci. Devices and accounts used for bookings are password-protected with two-factor authentication where available, and the website is served over an encrypted connection (HTTPS).
8. Children
Sessions for anyone under 18 are booked by a parent or guardian, who provides the information needed. The website is not directed at children.
9. Changes
This policy may be updated when the website or services change. The date at the top shows the latest version.