Privacy Policy

Last updated 30 April 2026

At Aqua Plus Spa & Wellness we take the privacy of our guests and website visitors seriously. This Privacy Policy explains what personal data we collect through our website, reservation system and contact channels, why we collect it, how long we retain it, and the rights you have over your information.

Information We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Identity information: first and last name, date of birth (where required to confirm ritual eligibility).
Contact information: phone number and email address.
Booking information: chosen ritual, date, time and branch preference.
Transaction information: amount, date and invoice details (full payment data is processed by our authorised payment provider and is not stored by Aqua Plus).
Health and preference information: only when you voluntarily disclose allergies, pregnancy or medical conditions relevant to your treatment.
Technical data: browser type, IP address, cookie identifiers and pages visited.

Why We Process Your Data

We process the data above only for the following legitimate purposes:

To create, confirm and safely deliver your reservation.
To respond to enquiries, requests and complaints.
To send you information about new rituals and seasonal programmes, only if you have opted in.
To improve service quality through anonymised analytics.
To meet our legal and regulatory obligations.

Sharing of Data

We do not sell your personal data and we do not share it with third parties except where strictly necessary. Limited and purpose-specific sharing may occur with:

Authorised payment institutions and banks (for payment processing).
Email, SMS and WhatsApp infrastructure providers.
With your cookie consent, analytics and ad measurement providers (Google, Meta, Yandex); see our Cookie Policy for details.
Independent legal and accounting advisers.
Public authorities, where disclosure is required by law.

Cookie-Free Visitor Count

To measure how many people visit our website each day and how they find us (search engines, ads, social media and so on), we use our own counter, which sets no cookies. Your IP address and browser details are turned into a one-way code with a secret key that changes every day; nothing is written to your device. The code is kept only to recognise repeat visits on the same day and is deleted the next day; only the totals are kept. Your IP address is not recorded for this count; it is held briefly to prevent abuse and then deleted automatically. This measurement is based on our legitimate interest and is not shared with third parties.

Retention

We keep your personal data only for as long as the underlying purpose requires it, plus any minimum retention period imposed by applicable law. Once those periods elapse, data is securely deleted, destroyed or anonymised.

Security

We apply industry-standard technical and organisational measures to protect personal data, including penetration tests, role-based access controls, encrypted database backups and ongoing staff training.

Your Rights

Under the Turkish Personal Data Protection Law (KVKK No. 6698) you have the right to access, rectify, erase, restrict processing of, and request portability of your personal data. To exercise these rights, please reach us through our contact page; we respond within 30 days.

Updates

We may update this Privacy Policy from time to time as our services and regulations evolve. Significant changes are communicated via the website; the most current version is always published on this page.