Privacy Policy.

1 · Introduction

This Privacy Policy outlines how BTL WORKS ("we", "our", "us") collects, uses and protects user data obtained through our customised CRM application via Meta APIs, including Facebook Lead Ads, the Messenger API and the Instagram Graph API.

Our role: BTL WORKS acts solely as a technology provider (B2B). We do not collect patient data for our own purposes. Our software collects enquiries sent to our clients' own accounts into that clinic's own panel. In this arrangement the clinic is the data controller and BTL WORKS is the data processor. If you contacted a clinic, that clinic's own privacy notice also applies.

2 · Data we collect

When you interact with our clients' Facebook Pages or Instagram accounts by submitting a lead form or sending a direct message, we receive the following data through Meta webhooks:

• Contact information: name, phone number, email address
• Meta scoped user IDs: PSID / IG SID — these are app-scoped identifiers, not your real account ID
• Message contents and appointment requests
• Technical data: submission time, referring page URL, campaign tags (UTM)

Only the messages you send us are processed. Your public profile content, posts, follower list and conversations with other people are never accessed or stored.

Your IP address is held in server memory for 60 seconds only, solely to rate-limit excessive submissions. It is never written to the database.

3 · Purpose of use

The collected data is used strictly for Customer Relationship Management (CRM) purposes on behalf of the specific clinic you contacted. It enables our clients to:

• Respond to your enquiries regarding dental treatments and health tourism
• Schedule appointments and follow up on your treatment process
• Manage patient communication efficiently

Your data is never used for advertising targeting or for any purpose unrelated to your enquiry.

4 · Legal basis

Data is obtained directly from you by automated means. The legal bases under GDPR Art. 6(1) are:

• (b) Performance of a contract, or steps taken at your request prior to entering one
• (c) Compliance with a legal obligation
• (f) Legitimate interests — service quality and prevention of abuse

If your message contains health information, this constitutes a special category of personal data and is processed only on the basis of the explicit consent obtained by the relevant clinic (GDPR Art. 9(2)(a); Turkish KVKK Art. 6/2).

5 · Data sharing and third parties

User data is never sold, rented or shared with third-party advertisers or external marketers. Data is accessible only to the authorised personnel of the specific clinic you originally contacted. Each clinic is held in a physically separate database; no clinic can access another clinic's data.

Infrastructure providers required for the service to operate:

Disclosure to public authorities may occur where required by law and to the extent required.

6 · International transfers

When you send a message via Instagram or Messenger, it passes through Meta's servers (USA / Ireland) before reaching us. That transfer takes place at the moment you send the message, under your own user agreement with Meta, and is outside our control; Meta's own data policy governs that stage.

Once the message reaches us, it is processed and stored exclusively within the European Union (Frankfurt). No intermediary marketing-automation service is used. We do not transfer your data outside the EU.

7 · Data retention and security

User data is securely processed and stored on encrypted servers. Measures in place to prevent unauthorised access:

• All communication takes place over encrypted connections (TLS/HTTPS)
• Panel access is role-based; each user sees only the data their role requires
• Each client is held in a separate database
• Incoming webhook requests are verified by cryptographic signature; unsigned requests are rejected
• Forms are protected by domain allow-listing, a honeypot field and rate limiting

Retention: Data is retained only as long as necessary to fulfil the services you requested — as a rule, no more than 2 years after your enquiry is closed — or for the period required by applicable law. It is then deleted, destroyed or anonymised.

In the event of a data breach, the competent supervisory authority is notified within 72 hours and affected individuals are informed without undue delay.

8 · Automated processing

For transparency: the text of your message is automatically scanned to detect whether it contains a phone number. If one is found it is added to your record so that the clinic can call you back. No other automated analysis is performed on message content.

You are not subject to automated decision-making or profiling (GDPR Art. 22). Every assessment relating to treatment or pricing is made by clinic personnel.

9 · Data deletion and your rights

You have the right to request the deletion, correction or export of your personal data.

Under GDPR you also have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You may revoke the app's access at any time from the Apps and Websites section of your Instagram or Facebook account settings. Revoking access does not by itself delete data already stored — use the deletion process above.

10 · Right to complain

If your request is refused or not answered within the applicable period, you may lodge a complaint with your national supervisory authority (GDPR Art. 77). In Türkiye, the competent authority is the Personal Data Protection Board (KVKK Art. 14).

11 · Cookies

Our website uses Google Analytics and Ahrefs Analytics for visitor statistics. These tools measure aggregate figures such as page views; they are not used to identify you personally. You can block cookies in your browser settings without affecting the site's core functionality.

12 · Changes to this policy

This policy may be revised in line with legislative changes or updates to our services. The current version is always published on this page and the "Last updated" date is amended. Material changes are notified separately.

BTL WORKS (Yunus Badeci)
Esentepe, Keskin Kalem Sok. No: 17 · 34394 Şişli / İstanbul · Türkiye
info@btlworx.com

Last updated: 3 September 2026 · Türkçe sürüm