Privacy Policy
Last Updated: April 2026 — pursuant to EU Regulation 2016/679 (GDPR)
1. Data Controller
Company: BAC SAĞLIK TURİZMİ VE TİCARET LİMİTED ŞİRKETİ
Trading name: Vellorian Hair
Registered address: [INSERT FULL ADDRESS]
Email: info@vellorianhair.com
Website: vellorianhair.com
Data Protection Officer (DPO): Not appointed — not required for our structure under Art. 37 GDPR
2. Data We Collect
a) Personal and contact data
Name, surname, email address, phone number, city of residence.
b) Health data — Special Category (Art. 9 GDPR)
Hair loss level, requested treatment area, pre-existing medical conditions, photographs of the scalp submitted for preliminary assessment. Processing requires your explicit consent.
c) Data from Meta Lead Ads (Facebook & Instagram)
When you complete a form via our Facebook or Instagram ads, Meta Platforms Ireland Limited collects and transmits to us: name, email, phone number and form responses. Processing is subject to Meta's Privacy Policy.
d) Technical and browsing data
IP address, browser type, device, pages visited, session duration, behavioural data collected via Meta Pixel, GA4 and GTM.
3. Legal Basis and Purposes
We process your data on the following legal bases under GDPR: consent (Art. 6.1.a), performance of contract (Art. 6.1.b), legal obligation (Art. 6.1.c), legitimate interest (Art. 6.1.f), and explicit consent for health data (Art. 9.2.a).
Note on health data: Processing of health-related data requires your explicit consent under Art. 9.2.a GDPR. You may withdraw this consent at any time without affecting the lawfulness of prior processing.
4. Data Transfers
Your data may be shared with: Meta Platforms Ireland Limited (Lead Ads, Pixel — intra-EU), Google LLC (Analytics — USA, via Standard Contractual Clauses under Art. 46 GDPR), partner clinics in Turkey (extra-EU, based on Art. 49.1.b or explicit consent), and CRM tools subject to Data Processing Agreements.
Your data is never sold to third parties.
5. Retention Periods
Unconverted leads: 24 months. Converted patients: 10 years (medical and fiscal obligations). Health data: 10 years or until consent withdrawal. Marketing data: until consent withdrawal. Technical/cookie data: 13 months (GA4), 90 days (Meta Pixel).
6. Your Rights (Arts. 15–22 GDPR)
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as to withdraw consent and lodge a complaint with your supervisory authority.
To exercise your rights, contact us at: info@vellorianhair.com. We will respond within 30 days.
7. Contact
Data Controller: BAC SAĞLIK TURİZMİ VE TİCARET LİMİTED ŞİRKETİ (Vellorian Hair)
Email: info@vellorianhair.com
Address: [INSERT FULL ADDRESS]