Privacy Policy

01Who We Are

Mandara Spa Massage & Hamam Turkish Bath ("Mandara Spa", "we", "us") is a massage and Turkish hamam spa located at Mimar Kemalettin Mah., Darphane Sk. No:1, Beyazıt, 34130 Fatih/İstanbul, Türkiye.

The data controller responsible for your personal data is [Legal company name]. We process personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to our guests, the EU General Data Protection Regulation (GDPR).

02Personal Data We Collect

We only collect the information we need to welcome you, arrange your treatment and run our website.

Information you give us

• Contact details: your name, phone number and, if you share it, your email address.
• Booking details: the treatment you choose, your preferred date and time, the number of guests and any special requests.
• Messages: the content of your WhatsApp messages, phone calls or emails with our team.
• Preferences and health information: details you choose to share so we can tailor your treatment safely, such as preferred pressure, allergies, pregnancy or medical conditions.

Information collected automatically

• Usage data: pages you visit, buttons you click (for example "Book via WhatsApp"), time spent on the site and the website that referred you.
• Device data: browser type, device type, operating system, approximate location (city or country level) and IP address.

03How We Use Your Data

We use your personal data for the following purposes and on the following legal bases:

• To manage your booking: confirming appointments, answering your questions and contacting you about changes. Legal basis: taking steps to provide the service you requested (performance of a contract).
• To provide your treatment safely: adapting the massage or hamam ritual to your needs. Legal basis: your explicit consent for any health information.
• To improve our website and services: understanding how visitors use our site so we can make it clearer and easier to use. Legal basis: our legitimate interests or, where required, your consent to analytics cookies.
• To meet legal obligations: keeping records required by Turkish tax, accounting and consumer law. Legal basis: compliance with legal obligations.

04Health Information

Before some treatments, we may ask whether you are pregnant or have any medical conditions, injuries or allergies. This information is considered special category (sensitive) personal data under KVKK and GDPR.

We only collect it with your explicit consent and only to keep you safe and comfortable during your treatment. It is shared only with the team members caring for you, and you are always free not to share it. In that case, we may recommend a different treatment or ask you to check with your doctor first.

05Cookies and Analytics

Cookies are small text files stored on your device. Our website uses them as follows:

• Essential cookies: needed for the website to work properly and securely. These cannot be switched off.
• Analytics cookies: we use Google Analytics, managed through Google Tag Manager, to understand how visitors use our site, such as which pages are viewed and which buttons are clicked. These cookies are only set with your consent where the law requires it.
• Preference storage: some features may remember simple choices in your browser, such as a selected gallery filter.

Third-party services on our website

• Google Fonts: our typefaces are loaded from Google's servers, which means your IP address is shared with Google when a page loads.
• Google Maps: the "Get Directions" link opens Google Maps, where Google's own privacy policy applies.
• WhatsApp: "Book via WhatsApp" buttons open WhatsApp, operated by WhatsApp LLC / Meta. Messages you send there are also subject to WhatsApp's privacy policy.

You can manage or delete cookies at any time through your browser settings or our cookie preferences banner. Blocking some cookies may affect how the website works.

06Sharing Your Data

We only share personal data when it's necessary, and only with:

• Service providers who help us run our business, such as our website hosting provider, Google (analytics, fonts and maps) and WhatsApp (messaging). They may only use your data to provide their services to us.
• Professional advisers such as accountants or lawyers, where needed.
• Public authorities when we are legally required to do so.

07International Transfers

Some of our service providers, such as Google and WhatsApp, store data on servers outside Türkiye and outside the European Economic Area. When your data is transferred abroad, we rely on the safeguards permitted by Article 9 of KVKK and, where GDPR applies, appropriate safeguards such as standard contractual clauses, or your explicit consent.

08How Long We Keep Your Data

We keep personal data only for as long as we need it for the purposes described in this policy:

• Booking and communication records: for as long as needed to manage your visit and any follow-up questions, and then for the periods required by Turkish law.
• Health information: only for as long as needed to provide your treatment safely, after which it is deleted.
• Accounting records: for the periods required by Turkish tax and commercial law.
• Analytics data: according to the retention settings in Google Analytics.

When data is no longer needed, we delete, destroy or anonymise it.

09How We Protect Your Data

We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include a secure (HTTPS) website, limiting access to personal data to team members who need it, and keeping devices and accounts protected.

No method of transmission over the internet is completely secure, but we work hard to keep your information safe.

10Your Rights

Under Article 11 of KVKK and, where applicable, GDPR, you have the right to:

• Find out whether we process your personal data and request information about it.
• Learn the purpose of the processing and whether it is used for that purpose.
• Know the third parties, in Türkiye or abroad, to whom your data is transferred.
• Ask us to correct incomplete or inaccurate data.
• Ask us to delete or destroy your data.
• Withdraw your consent at any time, without affecting processing carried out before the withdrawal.
• Object to processing based on our legitimate interests, and to results that arise solely from automated analysis.
• Request a copy of your data in a portable format (GDPR).
• Claim compensation for damages caused by unlawful processing.

To use any of these rights, contact us using the details below. We will respond as soon as possible and within 30 days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, if you live in the EU, your local data protection authority.

11Children's Privacy

Our website and booking services are intended for adults. We do not knowingly collect personal data from children under 18 without the consent of a parent or legal guardian. If you believe a child has shared personal data with us, please contact us and we will delete it.

12Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our services or the law. The latest version will always be published on this page, with the date of the last update shown at the top.

13Contact Us

If you have any questions about this policy or how we handle your personal data, please get in touch.