WEBSITE PRIVACY NOTICE
For visitors to smilab.com.tr and people who message our Instagram account
- Last updated: 10 October 2026
- Version: 2.1
This English text is provided for convenience. If there is any inconsistency, the Turkish KVKK notice applies.
This notice explains how your personal data is processed when you visit the website at smilab.com.tr (the “Site”) or contact us through the Site, or when you send a message to our Instagram account.
1. Data controller
Data controller:
SMILAB Sağlık Teknolojileri A.Ş. (“Smilab”)
- Address: İstiklal Mah. Kavaklıdere Cad. Mengiroğlu İş Hanı No: 2 İç Kapı No: 6 Ümraniye / İstanbul, Türkiye
- MERSİS: 0772155690500001
- Phone: +90 501 366 91 70
- Email: [email protected]
2. Scope
This notice covers
- your visits to the Site,
- contact or callback requests you send,
- messages you send to Smilab’s Instagram account (see Section 12),
- operations carried out through cookies and similar technologies.
Data processing in the doctor/clinic portal, the mobile application, treatment processes, or production and invoicing operations is outside the scope of this notice and is subject to the separate privacy notices of the relevant service.
Please do not enter or upload a patient’s name, photograph, radiograph, intraoral image, treatment information or any other health data in the contact fields on the Site. The Site’s forms are not designed to collect health data.
3. Data processed and collection methods
Depending on how you use the Site, the following data may be processed:
| Data category | Data | Collection method |
|---|---|---|
| Identity | First name, last name | Entered by you in the contact form |
| Contact | Phone number, email address, city/country | Entered by you in the contact form |
| Professional/organisational | Name of the clinic or organisation, professional title, the service you are interested in | Entered by you in the contact form |
| Request information | The contact topic you choose and the message you write | Entered by you in the contact form |
| Transaction security | IP address, date and time, browser and device information, security and access records | Automatically, when you access the Site |
| Site use | Pages visited, session and interaction information, referring page, campaign parameters, approximate location and analytics identifiers | Only if you give explicit consent to analytics cookies |
| Choice record | Cookie choices, date of the choice and notice version | When you use the cookie preference panel |
Data is collected electronically, by fully or partly automated means, when you fill in the form, connect to the Site and state your cookie choices.
4. Purposes of processing and legal bases
The legal bases refer to Turkish Personal Data Protection Law No. 6698 (“KVKK”).
| Purpose | Legal basis |
|---|---|
| Receiving and evaluating your request about a specific service or a possible commercial relationship and getting back to you | KVKK Article 5/2-c: directly related to the establishment or performance of a contract |
| Answering general information and contact requests | KVKK Article 5/2-f: Smilab’s legitimate interest, provided that your fundamental rights and freedoms are not harmed |
| Operating the Site, preventing attacks, bots and misuse, and ensuring information security | KVKK Article 5/2-f. Where an applicable obligation exists in the specific case: Article 5/2-ç |
| Establishing, exercising or defending a legal claim | KVKK Article 5/2-e |
| Measuring Site use and improving content and user experience | KVKK Article 5/1: the explicit consent you give in the cookie preference panel |
| Applying and evidencing your cookie choice | KVKK Article 5/2-f and, where necessary, Article 5/2-e |
Not consenting to analytics cookies does not prevent you from using the Site or contacting us. You are not obliged to give your consent, and you may withdraw the consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Recipients of the data
Your data may be transferred to the following recipients to the extent necessary for the relevant operation:
| Recipient or recipient group | Purpose of transfer |
|---|---|
| Cloudflare | Site hosting, content delivery, attack and bot protection |
| Form delivery and corporate email service providers | Delivering your contact request to Smilab and answering it |
| Google Analytics | Measuring Site use, only after your analytics consent |
| SMILAB Dijital Diş Laboratuvarı A.Ş. | Forwarding your request to the relevant unit where it directly concerns analysis or production services |
| Lawyers, financial advisers, auditors and technical service providers | Cases where legal, financial or technical support is required |
| Authorised public institutions and organisations and judicial authorities | Fulfilling a legal obligation or responding to a duly made request |
Smilab limits the data transferred, the recipient and the access rights to what the purpose requires.
6. International data transfers
Cloudflare, the corporate email/form delivery infrastructure and, if you give consent, Google Analytics are service providers located outside Türkiye or using global infrastructure. For this reason, your IP address, device and security information, your contact request or your analytics data may be processed abroad.
Ongoing or regular international transfers rely on an adequacy decision or an appropriate safeguard under KVKK Article 9. Standard contracts used as an appropriate safeguard are notified to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within the required period. If no applicable transfer mechanism has been established, the relevant service is not activated.
The explicit consent you give for analytics cookies concerns the processing of analytics data and the use of analytics technologies on your device. This consent is not used on its own in place of the appropriate safeguard required for regular international transfers.
7. Retention periods
Data is retained only for as long as the purpose of processing requires:
| Data | Maximum retention period or criterion |
|---|---|
| Completed contact and information requests | Up to 2 years from the last communication |
| Requests that become a commercial relationship | Only the relevant contract, invoice and commercial records, for the applicable statutory periods. General form content is not automatically retained for 10 years |
| Site security and access records | As long as the security purpose requires, normally up to 90 days. If there is a security incident or a legal claim, records limited to that incident may be retained longer |
| Google Analytics user-level event data | Up to 14 months. Google’s aggregated reports may be separate |
| Cookie choice in the browser | 6 months |
| Data-subject application records | 10 years from the conclusion of the application |
When the period expires or the reason for processing no longer exists, the data is deleted, destroyed or irreversibly anonymised.
8. Cookies
The purposes, parties and durations of the cookies used are explained in the Cookie and Similar Technologies Notice.
You can change your analytics choices at any time through the “Cookie settings” link in the Site footer.
9. Special-category data and children’s data
The Site is not designed to collect health data or any other special-category personal data. The Site is not directed at children. If we notice that such data has been entered in the contact fields by mistake, we take the necessary steps to delete it without using it or to restrict access to it.
10. Your rights under KVKK Article 11
By applying to Smilab, you have the right to
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction where the conditions set out in KVKK are met,
- request that correction, deletion or destruction be notified to the third parties to whom the data was transferred,
- object to an outcome against you that arises solely from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
11. How to apply
You can send your application
- in writing to the company address above,
- using a secure electronic signature or mobile signature,
- or from the email address you previously notified to Smilab and that is registered in our system, to [email protected].
Necessary and proportionate additional information may be requested to verify your identity and answer your request.
Applications are concluded free of charge according to the nature of the request and within 30 days at the latest. If the operation requires an additional cost, the fee in the tariff set by the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may apply. Your right to complain to the Board is reserved.
12. Instagram messages
When you send a message to Smilab’s Instagram account (@smilab.turkiye), including the ready-made questions in our ads, the following data is processed:
| Data | Description |
|---|---|
| Instagram identity | Your Instagram username, your display name and the account ID that Instagram provides for this conversation |
| Message content | The text and date of your message |
| Ad information | The ID of the ad, if you wrote to us from an ad |
Purpose and legal basis. This data is processed to reply to you, to follow up on your request about our services and to manage a possible business relationship with you. Where your request relates to a service or a business relationship, the legal basis is KVKK Article 5/2-c. For general information requests, it is KVKK Article 5/2-f.
Where it is kept. Your messages are transferred to the customer relationship management system (CRM) that runs on Smilab’s own server, and only authorised Smilab staff can see them. These records are not sold and are not shared with other companies for advertising. Your messages are also processed on Instagram’s infrastructure by Meta Platforms Ireland Limited, under Instagram’s own privacy policy.
Photos and files. Photos, videos and files in messages are not transferred to the CRM. Please do not send patient photos or any other health data via Instagram. Case photos are uploaded only to the Smilab portal.
Automated first reply. The first reply to some questions may be sent automatically. It does not make any decision about you. Our team handles the rest of the conversation.
Retention. Instagram conversation records are kept for no longer than 2 years from the last message and are then deleted. Records that turn into a business relationship follow the periods in Section 7.
How to request deletion. To have your records deleted, email [email protected] and include your Instagram username. Your records are deleted within 30 days at the latest and we confirm this to you. Your other rights in Section 10 also apply.
13. Changes
This notice is updated if the legislation or the technologies actually used on the Site change. If a new purpose, recipient or consent-based technology is added, the necessary information is provided and, where needed, your choice is requested again.
The current version is always published on this page.