Privacy Notice | Wells 360°

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "KVKK") and the provisions of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Official Gazette dated 10.03.2018 and numbered 30356), this Privacy Notice has been prepared by Wells 360° – Well-Living Tasarım, Dönüşüm ve İşletme Danışmanlığı ("Wells 360°", the "Company"), in its capacity as data controller, in order to inform you about the processing of your personal data.

1. Identity of the Data Controller

The contact details of our Company, acting in its capacity as data controller within the scope of Article 3 of the KVKK, are set out below:

Trade Name: Wells 360° – Well-Living Tasarım, Dönüşüm ve İşletme Danışmanlığı
Address: Barbaros Mh. Mor Sümbül Sk. Nidakule Güney No: 7/3F Kat:16, 34746 Ataşehir/İstanbul
Phone: +90 543 635 02 24
E-mail: info@360wells.com
Website: www.360wells.com

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person.
Special Categories of Personal Data: Data relating to individuals' race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, as well as biometric and genetic data.
Data Subject: The natural person whose personal data is processed.
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for establishing and managing the data filing system.
Data Processor: The natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.
Explicit Consent: Consent relating to a specific matter, based on information and expressed of one's own free will.

3. Categories of Personal Data Processed

The following categories of personal data are processed by Wells 360° within the scope of the purposes specified. Our Company does not process special categories of personal data unless explicit consent has been obtained from the data subject.

Identity Information: First name, last name.
Contact Information: E-mail address, telephone number, address.
Customer Transaction Information: Contents of requests and complaints, contents of service requests, contract information.
Transaction Security Information: IP address, cookie records, log records, session information, browser and device information, date and time of visit.
Marketing Information: Consent records for newsletters/promotional communications, habits and preferences (only if you give your explicit consent).
Visual and Audio Records: Files, images and audio recordings shared by you during communication (if any).

4. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

Responding to your requests and questions, and carrying out communication activities.
Planning, carrying out and completing service and consultancy processes.
Carrying out the processes of concluding, performing and terminating contracts.
Managing customer relations and carrying out customer satisfaction processes.
Carrying out finance and accounting operations (invoicing, collection, etc.).
Carrying out information security processes and cybersecurity measures.
Measuring website performance and improving the user experience (essential/functional cookies).
Fulfilling the requests of relevant public institutions and organizations.
Conducting activities in compliance with the legislation, carrying out audits and following up on legal matters.
Fulfilling retention and archiving obligations.
(If you have given your explicit consent) Sending promotional, campaign and commercial electronic messages, and carrying out targeted marketing activities.

5. Legal Grounds for Processing Personal Data

Your personal data is processed on the basis of one or more of the following legal grounds set out in Article 5 of the KVKK:

Article 5/1 – Existence of explicit consent: For marketing-related processing and for the processing of special categories of data.
Article 5/2-(a) – Being expressly provided for by law: Tax legislation, the Turkish Code of Obligations, etc.
Article 5/2-(c) – Being necessary for the conclusion or performance of a contract: Service contracts.
Article 5/2-(ç) – Fulfillment of a legal obligation: Financial, legal and administrative obligations.
Article 5/2-(e) – Processing being necessary for the establishment, exercise or protection of a right: Legal disputes.
Article 5/2-(f) – Being necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject: Site security, service quality.

6. Transfer of Personal Data

Your personal data may be transferred to the following groups of recipients within the framework of the personal data processing conditions set out in Article 8 of the KVKK, limited to the purposes specified in Section 4 of this Privacy Notice:

Authorized public institutions and organizations: Within the scope of legal obligations.
Suppliers: Website hosting, e-mail service, IT infrastructure, measurement and analytics providers.
Legal counsel and financial advisors: Following up on legal matters and carrying out tax and financial processes.
Business partners: In processes requiring contractual and service-related cooperation, within the framework of confidentiality agreements.
Independent auditors: Within the scope of audit activities.

7. Transfer of Personal Data Abroad

As the servers of some infrastructure and service providers used on our website (for example, embedded services such as Google Fonts and Google Maps) are located abroad, your personal data may be transferred abroad due to technical necessities. Within the scope of Article 9 of the KVKK, such transfers are carried out on the basis of your explicit consent, or to countries declared by the Personal Data Protection Board (KVK Board) to provide adequate protection, or to data controllers/processors that undertake in writing to provide adequate protection.

8. Methods of Collecting Personal Data

Your personal data is collected by automated and non-automated means through the following channels:

Contact forms, newsletter subscription forms and other online forms on the website.
Correspondence conducted via e-mail, telephone, text message and social media channels.
Face-to-face or online (video) meetings.
Cookies and similar automated tracking technologies (for details, see our Cookie Policy).
Documents completed within the scope of contractual processes entered into with our Company.

9. Retention and Destruction of Personal Data

Your personal data is retained for the period stipulated in the relevant legislation or for the period required for the purpose for which it is processed. Following the expiry of the retention periods or the elimination of the purpose of processing, personal data is erased, destroyed or anonymized in accordance with Article 7 of the KVKK and the provisions of the Regulation on the Erasure, Destruction or Anonymization of Personal Data.

Sample retention periods determined by our Company:

Data arising from contracts: 10 years following the termination of the contract (Turkish Code of Obligations, Art. 146).
Financial and accounting records: 10 years (Tax Procedure Law, Turkish Commercial Code).
Website log records: 2 years.
Contact form records: 2 years.
Marketing permissions: Upon revocation of the permission or after 3 years of inactivity.

10. Data Security Measures

Pursuant to Article 12 of the KVKK, Wells 360° takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of, and unlawful access to, personal data and to ensure its safekeeping:

Server, application and database security (SSL/TLS encryption, firewall, penetration testing).
Access authorization and role-based access control.
Personal data and privacy training for employees.
Data processing agreements signed with business partners and suppliers.
Regular backups and disaster recovery plans.
A procedure for notifying the KVK Board and the relevant data subjects in the event of a possible breach.

11. Rights of the Data Subject (Data Owner)

Pursuant to Article 11 of the KVKK, as a data subject you have the right to:

Learn whether your personal data is being processed.
Request information on the processing if your personal data has been processed.
Learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose.
Know the third parties, in Turkey or abroad, to whom your personal data is transferred.
Request the rectification of your personal data if it has been processed incompletely or inaccurately.
Request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK.
Request that the rectification, erasure and destruction operations be notified to the third parties to whom your personal data has been transferred.
Object to the emergence of a result to your detriment as a consequence of the analysis of your processed data exclusively by means of automated systems.
Claim compensation for damages if you suffer damage due to the unlawful processing of your personal data.

12. Application Procedure

To exercise your rights set out above, you may submit your application to our Company by one of the following methods, in accordance with the provisions of the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette dated 10.03.2018 and numbered 30342):

In writing, in person: To our Company address, subject to identity verification.
Through a notary public: To our Company address.
By e-mail signed with a secure electronic signature: To info@360wells.com.
From your e-mail address previously notified to our Company and registered in our system: To info@360wells.com.

Your application must include your first name, last name and, if the application is made in writing, your signature; your Turkish identity number (for foreign nationals, nationality, passport number or identity number); your address for notification; your e-mail address for notification, telephone and fax number, if any; and the subject of your request. Information and documents relating to the matter should be attached to the application.

Your application will be concluded as soon as possible, depending on the nature of the request, and in any event within 30 (thirty) days at the latest. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the KVK Board. If your request is rejected, if you find the response insufficient, or if no response is given in due time, you have the right to file a complaint with the KVK Board within 30 days from the date on which you learn of the response and, in any event, within 60 days from the date of application.

13. Amendments to the Privacy Notice

Wells 360° reserves the right to amend this Privacy Notice in line with changes in legislation and company policies. The current version enters into force as of the date on which it is published on our website.

Last updated: April 2026