Privacy Notice (Personal Data Protection)

This notice is published by Furkan Yalçınkaya, trading as Neffa Hair & Makeup Studio ("Neffa", "the Studio" or "we"), as the data controller under Türkiye’s Personal Data Protection Law (Law No. 6698, "KVKK") and related legislation.

Data controller: Furkan Yalçınkaya — Neffa Hair & Makeup Studio (sole proprietorship)
Address: Sapanbağları Mh., Yeni Mithatpaşa Cd. 15/A, 34400 Pendik / İstanbul
Phone: 0551 461 57 52
Email: iletisim@neffahair.com

Depending on your use of our website and your communication with us, the following categories of personal data may be processed:

• Contact form data: first and last name, phone number, service of interest and any text you write in the message field.
• Security / technical data: IP address and browser/technical log data processed for site security and error diagnosis (personal data is scrubbed in the error-tracking tool).
• Cookie, visit and ad-measurement data: your cookie consent preference; subject to your consent, Google Analytics visit data, Google Ads advertising cookies and Meta (Facebook/Instagram) Pixel data — the pages you visit, the links and buttons you click, your IP address and browser information. Without consent, ad clicks are counted without cookies or identifiers and the Meta Pixel is not loaded at all (see Cookie Policy).
• Image/audio data (only with explicit consent): photos and videos taken at the studio and published on our gallery/social media (see Explicit Consent).

Our site does not aim to collect special categories (sensitive) of personal data; please do not include such information in your message.

Your personal data is processed in line with the principles of KVKK Art. 4 (lawfulness, proportionality, purpose limitation) for the following purposes:

• Responding to booking and service requests and to your questions
• Measuring and improving the quality of our service
• Ensuring the security of our website and diagnosing and fixing errors
• Measuring the effectiveness of our Google and Meta (Facebook/Instagram) ad campaigns (without consent, only a basic cookie-less and identifier-less count of Google ad clicks; cookie-based measurement, the Meta Pixel and personalisation only with your consent)
• Fulfilling legal obligations and lawful requests from authorities

Advertising cookies, ad personalisation and remarketing are enabled only with your explicit consent; without it, ad clicks are counted anonymously and are not used to show you personalised ads.

To provide the service, your personal data may be shared with the following providers, limited to the relevant purpose and as data processors. Some of these providers host their servers abroad, so the relevant operations may constitute an international transfer under KVKK Art. 9; such transfers are carried out under appropriate safeguards (standard contract/undertaking, etc.):

• Cloudflare — our entire website is served through the Cloudflare network (content delivery and security layer; your IP address and connection data are processed in the process); our image and video content is also hosted on Cloudflare (abroad).
• Sentry — error tracking; runs only in production and with personal data scrubbed (abroad).
• Anthropic — used only for content translation in the admin panel; visitor personal data is not included in this flow (abroad).
• Google — a Google Ads tag measuring the effectiveness of our ad campaigns: without marketing consent, clicks on the phone, WhatsApp and booking links are reported without cookies or identifiers; with your consent, advertising cookies, ad personalisation and remarketing signals are enabled. With your analytics consent, Google Analytics 4 visit measurement runs via Google Tag Manager. Our map is shown as a static image from our own server; Google Maps opens on Google's own site only when you click the link (abroad).
• Meta — the Meta Pixel, which measures the effectiveness of our Facebook and Instagram ad campaigns, is loaded only with your marketing consent: the pages you visit, your clicks on the phone/WhatsApp/booking links and on page buttons are sent to Meta Platforms Ireland Ltd. together with your IP address and browser information; Meta uses this data for ad measurement, targeting and remarketing (abroad).
• Our advertising agency — our ad campaigns are managed on our behalf by an advertising agency. The agency's ad-measurement tags are loaded through its own Google Tag Manager container and only with your marketing consent; the agency accesses measurement results through Google's and Meta's advertising dashboards.
• Meta / WhatsApp — your contact-form message may, at your choice, be delivered to a Studio representative via WhatsApp.

Otherwise, your personal data is not transferred to third parties, save for the conditions in KVKK Art. 8 and 9 (legal obligations, lawful authority requests, etc.).

Your personal data is collected via the contact form on our website, by phone, WhatsApp and social media, through automated (security/analytics) and semi-automated means.

Legal bases:

• Conclusion or performance of a contract (booking/service request) — KVKK Art. 5/2-(c)
• Legitimate interest of the controller (site security and delivery, service improvement, basic cookie-less and identifier-less measurement of ad campaigns) — KVKK Art. 5/2-(f)
• Compliance with a legal obligation — KVKK Art. 5/2-(ç)
• Your explicit consent (gallery images, analytics and marketing cookies) — KVKK Art. 5/1

Your personal data is retained for as long as necessary for the purposes set out in this notice and as required by applicable law. Once the purpose ends, or upon your request, it is deleted, destroyed or anonymised under KVKK Art. 7.

By applying to the data controller, you have the right to:

• Learn whether your personal data is processed
• Request information if processing has taken place
• Learn the purpose of processing and whether the data is used accordingly
• Know the third parties to which data has been transferred in Türkiye or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction under the conditions of KVKK Art. 7
• Request that corrections, deletions or destructions be notified to recipients
• Object to outcomes resulting solely from automated analysis
• Claim compensation for loss caused by unlawful processing

To exercise these rights, please submit your request via our Data Subject Request page, which sets out the required information and channels.

Your application is concluded free of charge within 30 days at the latest (a fee from the Board’s tariff may apply if the operation entails additional cost).

This notice may be revised in line with changes to legislation or our services. The current version is always published on this page.

Related documents: Cookie Policy · Explicit Consent · Terms of Use.