Privacy Policy
At Aqua Plus Spa & Wellness we take the privacy of our guests and website visitors seriously. This Privacy Policy explains what personal data we collect through our website, reservation system and contact channels, why we collect it, how long we retain it, and the rights you have over your information.
Information We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
- Identity information: first and last name, date of birth (where required to confirm ritual eligibility).
- Contact information: phone number and email address.
- Booking information: chosen ritual, date, time and branch preference.
- Transaction information: amount, date and invoice details (full payment data is processed by our authorised payment provider and is not stored by Aqua Plus).
- Health and preference information: only when you voluntarily disclose allergies, pregnancy or medical conditions relevant to your treatment.
- Technical data: browser type, IP address, cookie identifiers and pages visited.
Why We Process Your Data
We process the data above only for the following legitimate purposes:
- To create, confirm and safely deliver your reservation.
- To respond to enquiries, requests and complaints.
- To send you information about new rituals and seasonal programmes, only if you have opted in.
- To improve service quality through anonymised analytics.
- To meet our legal and regulatory obligations.
Sharing of Data
We do not sell your personal data and we do not share it with third parties except where strictly necessary. Limited and purpose-specific sharing may occur with:
- Authorised payment institutions and banks (for payment processing).
- Email, SMS and WhatsApp infrastructure providers.
- Independent legal and accounting advisers.
- Public authorities, where disclosure is required by law.
Retention
We keep your personal data only for as long as the underlying purpose requires it, plus any minimum retention period imposed by applicable law. Once those periods elapse, data is securely deleted, destroyed or anonymised.
Security
We apply industry-standard technical and organisational measures to protect personal data, including penetration tests, role-based access controls, encrypted database backups and ongoing staff training.
Your Rights
Under the Turkish Personal Data Protection Law (KVKK No. 6698) you have the right to access, rectify, erase, restrict processing of, and request portability of your personal data. To exercise these rights, please reach us through our contact page; we respond within 30 days.
Updates
We may update this Privacy Policy from time to time as our services and regulations evolve. Significant changes are communicated via the website; the most current version is always published on this page.