At Boutiq Spa we take the privacy and security of your personal data seriously. This Privacy Policy explains what personal data we collect through our website www.boutiqspa.com and through our Instagram, Facebook Messenger and WhatsApp channels, why and how we use it, who we share it with, how long we keep it, and how you can exercise your rights.
Last updated: 3 August 2026
1. Data Controller
- Boutiq Spa
- Alibey Mh. Fatih Cami Sokak No: 7, Silivri / Istanbul, Türkiye
- E-mail: info@boutiqspa.com
- Phone / WhatsApp: +90 540 063 40 00
2. Personal Data We Collect
2.1. Information You Provide Directly
When you fill in a contact or booking form, or reach us by phone, e-mail or message, we collect:
- Your name and surname
- Your phone number
- Your e-mail address
- Your booking preferences (service, date, time) and the content of your message
2.2. Social Media and Messaging Channels
When you message us on Instagram Direct, Facebook Messenger or WhatsApp Business, we process the following data to the extent the platform provides it:
- Your display name and profile picture on the platform
- The user identifier the platform shares with us (Instagram-Scoped ID / Page-Scoped ID, or WhatsApp phone number)
- The content and timestamps of the messages you send us
- Images, audio or file attachments you send
We use this data solely to answer your message, arrange your appointment and follow up on your request. We do not access your friend list, posts or other profile information on your Meta (Facebook, Instagram, WhatsApp) account.
2.3. Data Collected Automatically
- IP address and approximate (city-level) location
- Browser, device and operating system information
- Pages visited, time spent on page, referral source
- Session and preference data stored via cookies
3. Why We Process Your Data
- To receive, schedule and confirm your appointment and booking requests
- To respond to your questions, requests, suggestions and complaints
- To send appointment reminders and service notifications by SMS or e-mail
- To measure and improve the quality of our services
- To improve the performance and usability of our website
- To comply with our legal obligations and respond to legal requests
We never sell or rent your personal data, and we do not share it with third parties for marketing purposes.
4. Legal Basis
We process your data under Turkish Personal Data Protection Law No. 6698 (KVKK) art. 5 on the grounds of performance of a contract, compliance with a legal obligation, our legitimate interests and, where required, your explicit consent. Commercial electronic messages (campaigns or marketing) are sent only with your explicit consent, which you may withdraw at any time.
5. AI-Assisted Message Replies
To respond faster on our social media and messaging channels, we may use an AI-assisted reply assistant. In that case the text of your message is sent to our service provider (OpenAI) in order to draft a reply. Drafts are reviewed by our team, and sensitive topics (health, complaints, payments or refunds) are always handled by a member of staff. This data is not used to train models.
6. Sharing and Transfer of Data
Your personal data may be shared, only as far as necessary to deliver our services, with the following providers who are bound by confidentiality obligations:
- Our hosting and e-mail provider — data storage and notification e-mails
- SMS service provider — appointment notification messages
- Meta Platforms (Facebook, Instagram, WhatsApp) — operation of our messaging channels
- Google Analytics — anonymised visit statistics
- OpenAI — AI-assisted reply drafting
- Competent public authorities — only where legally required
As some of these providers are located abroad, your data may be transferred internationally under KVKK art. 9.
7. Cookies
Our website uses cookies to maintain your session, remember your language preference and measure visit statistics. Essential cookies are required for the site to function. You can block or delete analytics cookies at any time through your browser settings; some features may then work in a limited way.
8. Retention Periods
- Contact and booking records: up to 2 years
- Conversations on messaging channels: up to 12 months
- Website visit statistics: up to 14 months
- Records subject to a statutory retention obligation: for the period required by law
Once the period expires, the data is deleted, destroyed or anonymised.
9. Data Security
Our website is served over an encrypted SSL/TLS connection. Access to the administration panel is restricted by authorisation, data is backed up regularly, and only staff who need it for their duties can access personal data.
10. Deleting Your Data
You may ask us to delete all personal data we hold about you at any time. To do so:
- Send an e-mail to info@boutiqspa.com with the subject “Data Deletion Request”, or message our WhatsApp line at +90 540 063 40 00.
- State the identifier we used to contact you (phone number, e-mail address or social media username).
- After identity verification, your request is completed within 30 days at the latest and your data is deleted from our systems. We will confirm once it is done.
Records we are legally required to keep (e.g. invoicing data) are retained only for the period prescribed by law and are not used for any other purpose.
11. Your Rights
Under KVKK art. 11 you have the right to learn whether your personal data is being processed; to request information if it is; to learn the purpose of processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom the data is transferred; to request the correction of incomplete or inaccurate data; to request its erasure or destruction; to request that such actions be notified to third parties to whom the data was transferred; to object to a result against you arising from analysis carried out solely by automated systems; and to claim compensation for damages arising from unlawful processing.
You can submit your requests to info@boutiqspa.com; they are handled free of charge within 30 days at the latest.
12. Children’s Privacy
Our services are not directed at persons under the age of 18 and we do not knowingly collect personal data from them. If we become aware that we have received such data, we delete it without delay.
13. Third-Party Links
Our site may contain links to third-party sites (e.g. our social media accounts, map services). We are not responsible for their privacy practices and recommend that you review their own policies before visiting.
14. Changes to This Policy
We may update this policy from time to time. The current version is always published on this page and the “Last updated” date above is revised. We will notify you separately of significant changes.
15. Contact
For any question, request or complaint about our privacy practices, please contact us:
- E-mail: info@boutiqspa.com
- Phone / WhatsApp: +90 540 063 40 00
- Address: Alibey Mh. Fatih Cami Sokak No: 7, Silivri / Istanbul