Privacy notice

Last updated: October 2026 · This is an English translation of our Turkish notice under Law No. 6698 (KVKK); in case of any difference, the Turkish version prevails.

This notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform people who visit the Navitas Spa & Sports Topkapı website and who contact us through online booking, the “Request a call” form, phone or WhatsApp.

1. Data controller

Your personal data is processed by Navitas Spa & Wellness (“Navitas”) as the data controller. Contact: [email protected].

2. Personal data processed

• Identity and contact: full name, phone number.
• Request details: the service, day and time you choose, the subject you are interested in and any note you write.
• Transaction security: IP address, browser information, and counts of clicks on phone/WhatsApp/directions links.

3. Purposes of processing

• To receive your booking and information requests, confirm your booking and call you back,
• to answer your questions and measure service quality,
• to keep the website secure and prevent misuse.

4. Legal grounds

Your data is processed under KVKK Art. 5/2-c (directly related to establishing or performing a contract), Art. 5/2-f (legitimate interest: service security and quality measurement) and Art. 5/2-ç (legal obligation). The consent box on the form only covers being called about your request; it is not consent to commercial messages (campaign SMS, WhatsApp announcements).

5. Transfers

To fulfil your request, your data may be transferred to suppliers providing us with hosting, communication and software services, under contractual confidentiality obligations.

6. Method of collection

Data is collected electronically through the forms on the website and the “Request a call” form of the Navitas Assistant on the site. Your chat with the assistant is not stored; only if you submit the form are the questions you typed added to your request as a note. No advertising or marketing cookies are used on this site; the analytics cookie used for visit statistics is explained in section 9.

7. Retention period

Request and booking records are kept for the periods set out in the relevant legislation from the conclusion of the request; at the end of that period they are deleted, destroyed or anonymised.

8. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties it is transferred to, to request correction if it is incomplete or inaccurate, to request its deletion or destruction, to object to a result against you arising from analysis by automated systems, and to claim compensation for damage caused by unlawful processing. You can send your requests to [email protected]; they are answered free of charge within 30 days at the latest.

9. Cookies and visit statistics

The only cookie not strictly necessary for the site to work is the Google Analytics 4 visit statistics cookie. This cookie works only if you click “Accept” in the cookie notice on the page; if you click “Reject” or make no choice, no analytics cookie is set. If you accept, the pages viewed, visit duration, device and browser type, approximate location and your interactions on the site (such as phone, WhatsApp or directions clicks and form submissions) are measured anonymously; the IP address is anonymised. Ad personalisation signals are turned off. The data is processed by Google LLC and may be transferred abroad. You can reset your choice at any time here, or withdraw it by deleting your browser cookies.

In addition, the site runs an anonymous visit counter that uses no cookies: it records the page viewed, the source of the visit (for example a search engine or an ad), the device type (mobile, tablet, desktop) and a short, irreversible summary that changes every day, used to tell repeat visits apart within the same day. The approximate location of the visit (at country and province/city level; not district, street or exact location) is recorded as reported by our infrastructure provider Cloudflare. Your IP address and browser information are not stored; summaries are deleted after 90 days. Likewise, anonymous interaction counts are kept to improve how the forms work: a form being viewed, started, submitted, which field produced an error or was abandoned, how far the page was scrolled and the time spent on the page. Information you type into a form, such as your name or phone number, is never included in this measurement; only daily totals are stored. If the “Do Not Track” setting is on in your browser, this counter and measurement do not run at all.