Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data are processed by BEF Agency ("Spa Deneyimi"), in its capacity as data controller, within the scope described below.
Address: Bağlar, Koçman Cd. A2 Blok Apt. No:25-29 Daire:8, 34145 Bağcılar/İstanbul · Email: kvkk@spadeneyimi.com
Personal Data Processed
- Identity and contact information: first name, surname, email address, telephone number (account creation, claiming and adding a business, contact and quote request forms, information and booking requests left on business profiles).
- Request details: the preferred date and time, number of people, service and note you give in an information or booking request on a business profile.
- Social login information: the name and email address shared by these services when you sign in with Google or Apple.
- Transaction security information: the one-way digest (hash) value of your IP address, browser information, session records.
- Visit statistics: pages opened, the website and campaign you came from, time spent on a page and scroll depth; device, browser, operating system, screen and language information; an approximate location derived from your IP address (country, region, city). The IP address itself is not stored for this purpose; visitors are counted with a digest that is renewed every day.
- User content: reviews, ratings, favourites, and the business information and photographs you add.
- Business verification data: documents proving ownership of the business (retained only for the duration of the review).
- Commercial message preference: your explicit consent to marketing emails and the date of that consent.
Purposes of Processing and Legal Grounds
| Purpose | Legal ground |
|---|---|
| Membership and provision of the service | Establishment and performance of a contract (KVKK Art. 5/2-c) |
| Verification of business ownership | Legitimate interest and legal obligation |
| Responding to contact and quote requests | Establishment of a contract (KVKK Art. 5/2-c) |
| Passing information and booking requests to the business concerned and confirming that the request was received | Directly related to the establishment of a contract (KVKK Art. 5/2-c) |
| Publication and moderation of reviews | Legitimate interest (KVKK Art. 5/2-f) |
| Sharing content uploaded by businesses on our social media accounts | Performance of a contract (KVKK Art. 5/2-c); for persons appearing in images, the explicit consent obtained by the business (KVKK Art. 5/1) |
| Security, prevention of misuse | Legitimate interest |
| Anonymous visit statistics | Legitimate interest (KVKK Art. 5/2-f) |
| Visit measurement with Google Analytics | Legitimate interest (KVKK Art. 5/2-f) |
| Marketing communications | Explicit consent (KVKK Art. 5/1) |
| Responding to legal requests | Legal obligation (KVKK Art. 5/2-ç) |
Transfers Within Turkey
Your personal data may be transferred to the payment institution (only in the case of business subscriptions) and to authorised public authorities, in accordance with the relevant legislation. Card details are not transmitted to Spa Deneyimi; they are processed directly by the payment institution.
When you leave an information or booking request on a business profile, your name, contact details and the content of your request are transferred to that business: by email and in the business panel if the business has an authorised user on our site, otherwise by our team over the phone. The business is a separate data controller for the information it keeps in its own records to answer your request.
Transfers Abroad
Spa Deneyimi's servers are located abroad. In addition, when the services below are used, the relevant data are transferred to the service provider's servers abroad:
| Service | Provider (country) | Data transferred | When |
|---|---|---|---|
| Hosting, database and email | Hostinger International Ltd. (servers in Germany) | All personal data processed on the site | Continuously |
| Map display | Mapbox, Inc. (USA) | IP address, browser and device information | When you open pages that contain a map |
| Address suggestions | Google LLC (USA) | IP address, the address you type | When you add a business or edit a business address |
| Sign in with Google | Google LLC (USA) | Name, email address | When you choose this sign-in method |
| Sign in with Apple | Apple Inc. (USA) | Name, email address (or Apple's private email address) | When you choose this sign-in method |
| Visit measurement | Google LLC (USA) | IP address, device and usage information | When you visit our site |
| Video player | Google LLC – YouTube (USA), Vimeo, Inc. (USA) | IP address, browser information | When you open business pages that contain videos |
| Social media sharing | Meta Platforms, Inc. (Instagram, Facebook), X Corp., Google LLC (YouTube), LinkedIn Corporation and similar platforms (mainly USA) | Photographs, videos and texts uploaded by businesses | When this content is shared on our social media accounts |
These transfers are carried out in accordance with Article 9 of the KVKK, either by concluding the standard contracts announced by the Personal Data Protection Board and notifying the Authority, or in the cases of incidental transfer listed in that article (for example, where the transfer is necessary for the performance of a contract in a social login that you initiate).
Retention Periods
- Account data: for the duration of membership and, from its termination, for the statutory limitation period.
- Contact and quote messages: deleted 30 days after they are answered, closed or marked as spam.
- Information and booking requests: deleted 30 days after being passed on, closed or marked as spam, and in any case no later than 90 days.
- Verification documents: no later than 30 days after the review is completed.
- Raw analytics records: 90 days; aggregated statistics are anonymous.
- Visit statistics (page view records): 760 days; these records contain no identity information or IP addresses.
- Consent records: 3 years from the withdrawal of consent.
Your Rights
You may exercise your rights under KVKK Art. 11 using the methods set out on the KVKK Requests page.