Privacy & Data Protection Policy

Data Controller / Service Provider: METAZEN BİLİŞİM VE DANIŞMANLIK LİMİTED ŞİRKETİ
MERSIS No: 0619134019200001
Tax Office / No: Meram V.D. / 6191340192
Address: Malazgirt Mah. Eyüp Sultan Cad. B Blok 1.-2. Girişler B1. Giriş No: 57 İç Kapı No: 406 Selçuklu/Konya
Phone: +90 543 449 42 99
E-mail: info@dytseydaertas.com
KEP (Registered E-Mail): metazenbilisim@hs06.kep.tr

Our Company places the highest importance on the security of our clients' personal data. We process your information in strict accordance with Law No. 6698 on the Protection of Personal Data ("KVKK") and other relevant regulations.

1. Data We Process and Why

As part of providing our services, we process your Identity, Contact, Special Category (Health) data, and Transaction Security data (like IP logs). This information is used to create your personalized nutrition plan, manage appointments, handle legal invoicing, and fulfill our evidentiary obligations to authorized authorities.

Data Reliability Disclaimer: The calculation tools and nutrition database on our website are provided for general informational purposes only. The Company shall not be liable for misuse of this data or inaccuracies in source data, except in cases of gross negligence or wilful misconduct (Turkish Code of Obligations Art. 115 is reserved).

2. Legal Basis and Collection Method

We collect your data electronically through our website. Our data processing activities are based on the legal grounds of "Performance of a Contract," "Legal Obligation," and your "Explicit Consent" for processing sensitive health data. Where processing is based on explicit consent, you have the right to withdraw your consent at any time; withdrawal stops further processing prospectively, while processing carried out prior to withdrawal remains lawful (KVKK Art. 5 and GDPR Art. 7(3)).

3. Security and IP Logging

To ensure transaction security and to fulfill our burden of proof in the event of a legal dispute, we record your IP address, the date/time of your form submission, and device information. This data is stored securely on our servers.

4. Your Rights

You can exercise your rights regarding your personal data under Article 11 of the KVKK by contacting us at the email address listed above.

---

Processing Purposes

• Provision of online dietitian counselling and appointment services
• Client health follow-up and preparation of nutrition programs
• Website content delivery and personalised experience improvement
• Response to contact form, email, and phone inquiries
• Compliance with legal obligations (tax, social security, etc.)
• Website usage analytics (subject to your consent)

Data Categories Processed

• Identity: name, surname, date of birth
• Contact: email, phone, address
• Health (special category, KVKK Art. 6 / GDPR Art. 9): height, weight, allergies, chronic conditions, dietary history — only with explicit consent, within the scope of the client relationship
• Transaction: appointment records, payment information (via bank)
• Browser/Cookie: IP, cookie preferences, browser type, visit times

Data Retention Periods

Data Type	Retention	Legal Basis
Client health records	10 years	Health data, professional obligation
Contact and appointment records	5 years	Turkish Code of Obligations Art. 147 (special 5-year limitation — service contracts)
Financial records	10 years	Tax Procedure Law Art. 253
Web inquiry form records	2 years	KVKK Art. 7 — necessary period
Cookie consent log	1 year	Burden of proof

Your Rights (KVKK Article 11 / GDPR)

Under KVKK Art. 11 and GDPR, you have the right to:

1. Learn whether your personal data is being processed
2. Request information if it has been processed
3. Learn the purpose of processing and whether it is used accordingly
4. Know the third parties to whom data is transferred domestically or abroad
5. Request correction of incomplete or incorrectly processed data
6. Request deletion/destruction under the conditions of KVKK Art. 7
7. Request that actions taken under (5) and (6) be notified to third parties
8. Object to results derived from automated processing
9. Demand compensation for damages arising from unlawful processing
10. (GDPR Art. 18) Request restriction of processing under conditions specified in GDPR
11. (GDPR Art. 20) Receive your personal data in a structured, commonly used, machine-readable format and have the right to transmit it to another controller (data portability)
12. (GDPR Art. 7(3)) Withdraw your explicit consent at any time, without affecting the lawfulness of prior processing

How to Apply — Mandatory Requirements

To exercise your rights, you may email info@dytseydaertas.com, send a registered electronic mail (KEP) to metazenbilisim@hs06.kep.tr, or submit a written application to the company address. Applications are answered free of charge within 30 days.

Mandatory content of the application (Communiqué on the Procedures and Principles of Application to the Data Controller, Art. 5):

1. Name, surname and signature (if the application is in writing)
2. Turkish Republic ID number for Turkish citizens; nationality, passport number or ID number (if any) for foreigners
3. Residence or business address for notifications
4. If any, e-mail address, phone and fax number for notifications
5. Subject of the request (which right(s) you wish to exercise)

The absence of any of these elements may be cause for rejection of the application; please prepare your application accordingly.

Minor (Under 18) Client Data — Parental/Guardian Consent

Since our consultancy may be provided in the field of child and adolescent nutrition, personal data of clients under 18 — particularly special-category health data (height, weight, allergies, chronic conditions, growth curves) — is processed only with the written explicit consent of the legal parent or guardian. This consent is obtained in compliance with KVKK Art. 6, GDPR Art. 8 and the Turkish Civil Code.

The parent/guardian may at any time exercise the rights of access, rectification, erasure, and withdrawal of consent regarding the child's data. Personal data of children under 13 is processed solely through the parent, not via digital services directly offered to the child.

Cookies and Online Tracking

For detailed information about the cookies used on our website, please see our Cookie Policy page. Your cookie consent is stored with a UUID stamp for 1 year.

Data Security

Your data is protected by SSL/TLS encryption, server access restrictions, regular backups, password hashing (bcrypt), and the administrative/technical measures required under KVKK Art. 12.

International Data Transfers

Under KVKK Article 9, your data may be transferred to the following third parties:

Recipient	Data Type	Legal Basis	Country
Google LLC (Analytics & Tag Manager)	Anonymous traffic data, cookie ID, IP (truncated)	Explicit consent (analytics cookie consent)	USA — Standard Contractual Clauses
Cloudflare Inc. (CDN & Security)	IP address, request logs	Legitimate interest (KVKK Art. 5/2-f) — security	USA/global — Standard Contractual Clauses
Hosting provider	All site data (server storage)	Performance of contract	Turkey

Cross-border transfers are governed by Standard Contractual Clauses approved by the Personal Data Protection Authority or by the list of countries providing adequate protection.

VERBIS Registration Status

Our Company assesses its VERBIS (Data Controllers Registry Information System) registration obligation in line with the Personal Data Protection Board's decisions. The VERBIS registration exemption applies to natural/legal-person data controllers with fewer than 50 employees and an annual financial balance below TRY 100 million (KVK Board decision). Our Company is currently within the scope of this exemption. This notice will be updated if the situation changes.

Complaint to the Personal Data Protection Authority

Under KVKK Art. 14, if your application to the data controller is rejected, our response is found insufficient, or no response is given within 30 days, you may file a complaint with the Personal Data Protection Board within 30 days of the rejection and in any event within 60 days of the original application:

• Authority: Personal Data Protection Authority (KVKK)
• Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4, 06520 Balgat / ANKARA, Turkey
• Web: kvkk.gov.tr/en