Privacy Policy and Personal Data Notice

1. Data controller

Under KVKK, the data controller is HASAN ULVİ ERGÜN, the owner of the Su Sağlık business. In this notice, “we” and “us” refer to the data controller.

Data controller: HASAN ULVİ ERGÜN
Address: Caddebostan Mah. Bağdat Cad. No:288/B, Kadıköy/İstanbul 34728, Türkiye
Email: info@susaglik.com

2. What data we process

The data we process depends on how you interact with us. For each group below, we set out what data is involved, how it is collected, why we use it and our legal basis. The legal bases come from Article 5 of KVKK.

Website visitors

This website has no sign-up, no forms and no cookies. We do not use analytics or tracking tools. Everything on the site, including the fonts, is loaded from the site’s own server.

Data: IP address, date and time of the visit, the page requested and browser information (server access logs)
How it is collected: The hosting server may record this automatically when you open the site.
Purpose: Keeping the website secure and running
Legal basis: Our legitimate interest (Art. 5(2)(f)); where the law requires it, our legal obligations (Art. 5(2)(ç))

People who message us on WhatsApp

When you message our business on WhatsApp, your messages arrive in Su Sağlık Panel and our team replies from there. Messages are received and sent through Meta’s official WhatsApp Business Platform (Cloud API).

Data: Your phone number and WhatsApp profile name

The content of your messages and any files you send (for example, a photo or a document)

The date and time of each message and its delivery status

Labels, topic tags and internal notes that our team adds to the conversation (notes are visible only to the team)

If you are already our customer, your customer record, which may be shown next to the conversation
How it is collected: Electronically and automatically through the WhatsApp Business Platform when you write to us. Labels and notes are added by our team in the panel. Your customer record comes from our own customer records and may be shown next to the conversation in the panel.
Purpose: Replying to your messages, providing customer service, keeping a record of our communication, and monitoring and improving the quality of our service
Legal basis: Entering into or performing a contract related to your request (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)); our legitimate interest in keeping a record of communication and in service quality (Art. 5(2)(f))

If you choose to share special categories of personal data in a message, such as information about your health, we use it only to reply to that message and for no other purpose. It is kept as part of the conversation record, together with your other messages, and you can ask for it to be deleted as described in section 8. Special categories of personal data are subject to the rules in Article 6 of KVKK.

Panel users (our team)

This part applies to members of our team who use Su Sağlık Panel.

Data: Your name, username and role; sign-in records and access logs (for example, which customer record you opened and when, and whether you downloaded a list)
How it is collected: Electronically and automatically, when your account is set up and as you use the panel
Purpose: Keeping the panel secure, managing who can access which information, and keeping a record of that access
Legal basis: Performance of a contract (Art. 5(2)(c)); our legal obligation to keep data secure (Art. 5(2)(ç) and Article 12 of KVKK); our legitimate interest (Art. 5(2)(f))

People who email us

Data: Your email address, your name if you give it, and the content of your message
How it is collected: When you send us an email
Purpose: Answering your question; handling data protection requests and data deletion requests
Legal basis: Our legal obligation to respond to requests (Art. 5(2)(ç) and Article 13 of KVKK); our legitimate interest (Art. 5(2)(f))

Promotional messages rely only on your explicit consent (Art. 5(1)). See section 6 for details.

3. Who we share data with

We do not sell your personal data and we do not share it with anyone for advertising. To run our service, we share it with the service providers below, and only as far as necessary.

Meta: WhatsApp Business Platform (Cloud API): receiving and sending WhatsApp messages
Hostinger: Hosting: the website and the panel are hosted on Hostinger servers in Germany (Frankfurt)
Natro: Email: when you email us, the correspondence runs through Natro, the email provider for our domain

Apart from this, data may be disclosed to authorised public authorities only when, and to the extent that, the law requires it.

Transfers outside Türkiye

Our servers are in Germany, and WhatsApp messages are processed in Meta’s data centres outside Türkiye. This means the data described in this notice is transferred abroad. These transfers are governed by Article 9 of KVKK.

Germany (Hostinger): Website access logs and panel data: conversations, notes, labels, customer records, user records and access logs
Outside Türkiye (Meta): WhatsApp messages and related information: phone number, profile name, message content and files, date and time, delivery status

4. How long we keep data

We keep personal data for as long as it is needed for the purpose it was collected for, and for any period required by law. After that, it is deleted, destroyed or anonymised.

Copies that Meta keeps on its own infrastructure in order to deliver messages are subject to Meta’s own terms.

5. How we protect data

The main measures we take in the panel are:

Two-layer sign-in: Reaching the panel takes two separate sign-in steps.
Role-based access: Each user has an administrator, manager or staff role and sees only the sections that role allows.
Access log: The log records who signed in and when, which customer record they opened and when they downloaded a list.
Encrypted connection: Connections to this website and to the panel are encrypted with HTTPS.

6. Promotional messages

We do not send you promotional messages without your explicit, prior consent. Where the law requires it, that consent is registered in Türkiye’s Message Management System (İleti Yönetim Sistemi, İYS) before any message is sent.

This notice does not ask for your consent; consent for promotional messages is requested separately. If you have given consent, you can withdraw it at any time by writing to info@susaglik.com.

7. Your rights and how to apply

Under Article 11 of KVKK, you have the right to:

find out whether your personal data is processed;
request information about the processing if it is;
find out the purpose of the processing and whether your data is used in line with that purpose;
know the third parties in Türkiye or abroad to whom your data is transferred;
ask for incomplete or inaccurate data to be corrected;
ask for your data to be deleted or destroyed under the conditions set out in Article 7 of KVKK;
ask for any correction, deletion or destruction to be notified to the third parties to whom your data was transferred;
object to a result that is against you and arises solely from the automated analysis of your data;
claim compensation if you suffer damage because your data was processed unlawfully.

How to apply

Send your request by email to info@susaglik.com. Please include your name and what you are asking for. If your request concerns WhatsApp conversations, also include the phone number you used to message us.

We handle requests free of charge, as quickly as the nature of the request allows and within 30 days at the latest (Article 13 of KVKK). To make sure we do not disclose or delete someone else’s data, we may need to confirm that the request is really yours.

If your request is refused, if you find our answer insufficient or if we do not answer in time, you can file a complaint with Türkiye’s Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 14 of KVKK.

8. Deleting your data

You can ask us to delete your data at any time. There is no charge for this.

How to ask

Send an email to info@susaglik.com with the subject “Data deletion request”.
If you messaged us on WhatsApp, include the phone number you used.
Once we have confirmed that the request is yours, we delete the data listed below and let you know by email.

Send a deletion request

What we delete

We delete the conversation records linked to that phone number, together with the notes, labels and topic tags our team added about you in the panel.

How long it takes

We complete your request within 30 days at the latest and confirm the deletion by email.

What we may keep

If the law requires us to keep a particular record, we keep only that record, only for that purpose and only for as long as the law requires, and then delete it. If this applies to you, we will say so in our reply.

Copies on your phone and on WhatsApp

Messages on your own phone and copies held in WhatsApp’s systems are not under our control. They are governed by WhatsApp’s own terms and privacy policy. You can delete the chat on your phone yourself in the WhatsApp app.

9. Changes

We update this notice when the way we handle personal data changes. The current version is always published on this page, and the “Last updated” date at the top changes. This version is dated 26.09.2026.

This notice is also available in Turkish: Gizlilik ve KVKK Aydınlatma Metni.

10. Contact

If you have questions about privacy, your personal data or data deletion, please email us.

info@susaglik.com

In short