Privacy Policy

Last updated: 2026-02-03

1. Purpose and Scope

This Privacy Policy describes how personal data is collected, processed, stored, transferred and protected through our e-commerce platform in connection with the sale and delivery of (i) Online Courses and (ii) Application-Based Practical (Face-to-Face) Trainings. It applies to all interactions conducted through https://www.healthtraininginturkey.com including registration, payment, refund procedures, institutional acceptance processes, issuance of Acceptance Letters, digital content access, participation in training programs, and customer support services.

The Data Controller processes personal data in accordance with applicable data protection laws, including GDPR (where applicable), KVKK, e-Privacy regulations, consumer protection legislation and financial compliance obligations.

2. Categories of Personal Data We Collect

The following categories of personal data may be collected depending on the Buyer’s actions and the type of service purchased:

• Identity Data: full name, nationality, date of birth (if required for certificates or institutional acceptance)
• Contact Data: phone number, email address, billing address
• Payment & Financial Data: transaction details, payment confirmations, refund instructions, card verification tokens (processed indirectly via payment providers)
• Operational & Application Data: training preferences, program selection, deposit payment status, Acceptance Letter results, participation records, institutional documentation
• Digital Access Data (Online Courses): platform login credentials, usage logs, attendance records, digital content access timestamps
• Technical Data: IP address, browser/device information, session IDs, cookies, security logs, fraud-prevention signatures
• Communications: email correspondence, support inquiries, transactional notifications
• Legal & Compliance Data: financial reporting records, tax compliance details, audit logs

3. Payment Processing & Financial Compliance

Payments for Online Courses and deposit payments for Practical Trainings are processed through secure third-party payment providers such as İyzico. For Practical Trainings, the platform may also process remaining balance payments following the issuance of Acceptance Letters.

During payment operations, transaction data may be processed for the purposes of:

• fraud prevention and risk scoring,
• chargeback and dispute handling,
• financial reporting, accounting and auditing,
• regulatory compliance (including PCI-DSS and 3D Secure),
• payment verification and security authentication.

Sensitive financial data (credit/debit card numbers) is not stored on our servers and is processed directly by the payment provider under applicable security standards.

4. Processing for Practical (Face-to-Face) Training Applications

Practical Training programs require institutional review and may involve acceptance assessments. In this context, the following data may be processed:

• application details and review documentation,
• identity and eligibility information,
• deposit payment status and linked financial records,
• Acceptance Letter issuance, approval or rejection status.

If the Buyer is not accepted into the program within approximately 30–40 days, deposit refunds may be issued as described in the Cancellation & Refund Policy. If acceptance is granted, the remaining training fee becomes payable within the specified period.

If the Buyer fails to complete payment within the required period following acceptance, the Buyer acknowledges that the deposit may be retained to cover administrative and processing costs.

5. Purposes of Processing

Personal data may be processed for the following purposes:

• providing and administering training services, both online and face-to-face,
• managing applications, deposit processes, and institutional acceptance mechanisms,
• issuing digital access credentials for online courses,
• communicating training schedules, notifications, updates, and operational information,
• issuing certificates, attendance documentation and related records (where applicable),
• managing refunds and cancellation procedures,
• executing statutory and financial obligations including accounting and tax compliance,
• ensuring security, fraud prevention and customer account integrity,
• performing analytics and improving platform performance (where consent is required, only with consent),
• maintaining legal defenses, dispute resolution and archiving.

6. Legal Basis for Processing

Personal data may be processed on the basis of:

• Performance of a Contract: for training delivery, payment execution, digital platform access, deposits and acceptance processes.
• Legitimate Interests: security, fraud prevention, operational analytics, user experience improvements, and dispute defense.
• Legal Obligations: accounting, taxation, financial audits, statutory archiving.
• Explicit Consent: for non-essential cookies, marketing communications, and optional analytics modules.

7. Data Sharing & Transfer

Personal data may be shared with:

• payment providers (e.g. İyzico) for secure transaction processing,
• training institutions or facilities for Practical Training acceptance procedures,
• IT and cloud service providers supporting platform operations,
• authorized public authorities when required by law,
• auditors, accountants or legal counsels for compliance purposes.

Where data transfers outside Türkiye or the EEA occur, appropriate legal safeguards shall be applied (SCCs, BCRs, adequacy or consent, where applicable).

8. Retention

Data is retained for the period required to fulfill contractual obligations, legal compliance requirements, financial reporting standards, dispute resolution, refund audits, and institutional accreditation requirements. After such periods, data is deleted, destroyed, or anonymized.

9. Cookies & Tracking Technologies

Cookies are used for platform functionality, security, payments, fraud prevention, and analytics (with consent). Detailed information is available in the Cookie Policy & Cookie Management section.

10. Rights of Data Subjects

Users may request access, correction, deletion, restriction, objection, and data portability (where applicable) under GDPR and KVKK requirements. Withdrawal of consent for non-essential processing may be exercised at any time.

Requests may be submitted to: info@healthtraininginturkey.com.

11. Updates to This Policy

We may update this Privacy Policy due to operational, legal, or technological changes. Updated versions shall be published on this page and enter into force upon publication.