KVKK disclosure

This Privacy Notice has been prepared pursuant to the Personal Data Protection Law No. 6698 (“KVKK”) regarding the processing of your personal data in the capacity of data controller.

Data Controller: Rupu Global Psikolojik Danışmanlık ve Organizasyon A.Ş.

Address: MERKEZ MAHALLE ABİDE-İ HÜRRİYET CAD. MEYDAN AP. NO:143
INTERNAL DOOR NO:8 ŞİŞLİ ISTANBUL

Email: klinik@rupucollective.com
Website: www.rupucollective.com

If you contact Rupu Psikoloji, complete an application form, request a service, or participate in a psychological support/counselling process, the following data may be processed to the extent limited to the relevant transaction:

Identity and contact information: first and last name, telephone number, email address, and other contact information shared by you.

Application and transaction information: application date, preferred meeting format, appointment and session scheduling information, correspondence, and records relating to the service process.

Professional/educational information: information shared only where necessary for the relevant service or discount application.

Financial information: transaction and payment information required for payment and invoicing processes. Your card information is processed by the payment service provider Sipay; no such information is retained by Rupu Psikoloji.

Special categories of personal data: health and mental health information shared by you during the provision of psychological support/counselling services, clinical notes relating to the session process, and other special categories of data that may be necessary due to the nature of the service.

Receiving and evaluating your application, identifying a suitable professional for you, and communicating with you.

Planning, conducting, and, where necessary, rescheduling appointment and session processes.

Providing psychological support/counselling services in accordance with professional and ethical principles, and ensuring the continuity and safety of the service.

Carrying out pricing, collection, invoicing, and accounting processes.

Evaluating requests, suggestions, and complaints, and improving service quality.

Fulfilling obligations arising from legislation and establishing, exercising, or protecting rights in potential legal disputes.

Your personal data may be collected verbally, in writing, or electronically through forms on the website, email, telephone and messaging channels, online meeting and appointment tools, in-person meetings, payment/invoicing processes, and documents submitted by you.

Depending on the specific processing activity, your personal data of a general nature may be processed on the legal grounds set out in Article 5 of the KVKK, namely necessity for the establishment or performance of a contract, fulfilment of the data controller’s legal obligations, establishment/exercise/protection of a right, and legitimate interests to the extent applicable.

Your special categories of personal data relating to health and mental health are processed when one of the relevant processing conditions set out in Article 6 of the KVKK exists, depending on the nature of the specific activity and the legal status of the data controller. If a processing activity requires explicit consent, such consent is obtained through a separate, specific statement based on freely given will, independently of the Privacy Notice.

Your personal data may be transferred, only to the extent necessary for the relevant purpose and where the conditions stipulated under the KVKK are met, to authorized public institutions and organizations, legally authorized persons and organizations, financial consultancy/accounting and legal advisers, IT and hosting service providers, cloud storage and technical support service providers, appointment/communication/online meeting infrastructure providers, payment service providers and banks, and relevant professionals and service providers involved in the provision and organization of the service.

5.1. Transfer of Personal Data Abroad

Since the digital infrastructure used for Rupu’s website, email, and online video meeting services operates through servers and service providers located abroad, your personal data may be transferred abroad, stored in systems abroad, or processed there when these services are used.

The digital services used in this context and the service providers to which data may be transferred are listed below:

a) Website and application infrastructure

Service providers: Vercel – website hosting, servers in Frankfurt (Germany), US company;
Neon – database, servers in Frankfurt (Germany).

Data that may be transferred: Identity and contact information submitted through the website, information shared in the application form, application records, and technical access data.

b) Email service

Service provider: Google (Gmail) (USA)

Data that may be transferred: Email addresses, email correspondence content, attachments, and communication records.

c) Online video meeting service

Service provider: Zoom (USA)

Data that may be transferred: Information relating to meeting participants, meeting links and records, and audio, video, and technical connection data processed through the service provider’s infrastructure during meetings. If meetings are recorded or transcribed, these processes are assessed separately.

d) Payment services

Service provider: Sipay (Türkiye)

Data that may be transferred: Identity, contact, payment, and transaction information required to carry out and verify payment transactions.

Depending on the technical infrastructure and data processing activities of the service providers used, your personal data may be processed or stored on servers located in different countries. Accordingly, the countries in which the data is processed are determined in line with the current data processing and privacy documents of the relevant service providers and the account and service settings used.

The transfer of your personal data abroad is carried out in accordance with the conditions set out in Article 9 of the KVKK.

Rupu’s approach is to ensure that the legal mechanisms used for transfers of data abroad are appropriate for the relevant transfer activity and to provide the necessary information.

Your personal data is retained for the period necessary for the purposes for which it is processed and for the limitation/retention periods stipulated by the relevant legislation. When these periods expire or the reason for processing ceases to exist, the data is deleted, destroyed, or anonymized in accordance with the legislation. Rupu Psikoloji takes appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data and to ensure its secure retention.

Under Article 11 of the KVKK, you have the rights to learn whether your personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties to whom it is transferred domestically or abroad; to request correction if it is processed incompletely or inaccurately; to request its deletion or destruction when the legal conditions are met; to request that these actions be notified to third parties to whom the data has been transferred; to object to a result arising against you from analysis exclusively through automated systems; and to claim compensation for damage if you suffer loss due to unlawful processing.

You may submit an application concerning your rights to klinik@rupucollective.com, in writing to MERKEZ MAHALLE ABİDE-İ HÜRRİYET CAD. MEYDAN AP. NO:143
INTERNAL DOOR NO:8 ŞİŞLİ ISTANBUL, or through other methods stipulated under the KVKK and the relevant legislation. Your applications will be concluded within the procedures and periods stipulated by the legislation.

This text is intended to provide information regarding the processing of your personal data. Checking the box indicating that you have read the text does not mean that you give explicit consent to the processing of your personal data. Explicit consent is obtained separately and on an optional basis for separate processing activities for which explicit consent is required.

Text update date: 04.11.2026