GDPR Compliance & Data Protection

1. Our Commitment to Data Protection

hairtravel.ca ("we," "our," or "us") takes the protection of personal data seriously. This page explains how we handle information in accordance with the General Data Protection Regulation (GDPR) for visitors from the European Economic Area (EEA) and the United Kingdom, as well as the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Our goal is to be transparent about every aspect of how your data is managed.

2. Who Controls Your Data

hairtravel.ca is based in Toronto, Canada and acts as the controller of any personal data gathered through this website. If you have a data-related question or concern, you can write to us at info@hairtravel.ca and we will respond promptly.

3. Categories of Data We Process

We handle the following categories of personal data, depending on how you engage with our site:

• Submitted Details: Your name, email address, and telephone number if you choose to complete a quote request or enquiry form on our website.
• Behavioural Data: Anonymized records of how you navigate our pages — including which articles you read, how long you stay, and which links you follow — gathered through privacy-focused analytics software.
• Technical Identifiers: Your browser version, operating system, display resolution, and IP address (truncated where technically possible to limit identifiability).
• Correspondence Records: The content of any messages you send to us through email or website contact forms.

4. Lawful Grounds for Processing

Under the GDPR, every act of data processing must rest on a valid legal basis. Ours are:

• Your Consent: When you voluntarily fill in a form or opt in to receive communications from us, you are giving consent for us to process the data you provide.
• Legitimate Interest: We have a legitimate interest in understanding visitor behaviour so we can improve our content and deliver a better experience. This processing is always balanced against your right to privacy.
• Compliance with Law: In certain situations, we may be required to process or retain data to satisfy a legal or regulatory obligation.

5. Purposes of Processing

Your data is processed strictly for the following reasons:

• To answer your questions and supply relevant information about hair transplant options in Turkey
• To facilitate an introduction between you and a clinic — exclusively when you have expressly asked us to do so
• To enhance the quality, accuracy, and usability of our website content
• To monitor aggregate traffic patterns so we can identify areas for improvement
• To fulfil any applicable legal requirements

6. Third-Party Data Sharing

Your personal data is never sold or traded. Disclosure to outside parties happens only under these specific conditions:

• Clinic Referrals: When you expressly request a consultation or quote from a specific clinic, we forward the necessary contact details to that clinic so they can get in touch with you. No referral is made without your clear, affirmative consent.
• Infrastructure Providers: A limited number of vetted service providers assist us with hosting, email transmission, and analytics. Each is bound by data processing agreements that restrict them to using your data solely for the services they deliver to us.
• Regulatory Demands: If a lawful authority compels disclosure through a court order or equivalent legal instrument, we will comply to the extent required.

7. Cookies and Tracking Technologies

We keep our use of cookies to a minimum. No advertising networks or cross-site tracking scripts are loaded on our pages. Our analytics platform is configured to truncate IP addresses and honour "Do Not Track" signals sent by your browser.

The cookies we deploy fall into two groups:

• Functional Cookies: Necessary for core site operations such as maintaining your session while you navigate between pages.
• Measurement Cookies: Used to collect anonymized usage statistics that help us understand which content resonates with visitors. These cookies do not follow you to other websites.

8. Your GDPR Rights

If you reside in the EEA or the United Kingdom, the GDPR grants you the following rights over your personal data:

• Access: You may ask us to confirm whether we process your data and, if so, to provide you with a copy.
• Correction: You may ask us to update or fix any data that is inaccurate or outdated.
• Deletion: You may ask us to erase your personal data from our systems (commonly known as the "right to be forgotten").
• Restriction: You may ask us to temporarily halt certain types of processing while a dispute or concern is resolved.
• Portability: You may request that we export your data in a structured, machine-readable format so you can transfer it to another service.
• Objection: You may object to processing that is based on our legitimate interests, and we will cease unless we can demonstrate compelling grounds.
• Withdrawal of Consent: Where our processing relies on your consent, you are free to withdraw that consent at any point without affecting the lawfulness of prior processing.

To exercise any of these rights, send a message to info@hairtravel.ca. We aim to acknowledge every request within seventy-two hours and to resolve it within thirty calendar days.

9. Canadian Visitors and PIPEDA

Because hairtravel.ca operates from Canada, and is a Turkish hair transplant guide for Canadians, we also observe the requirements of PIPEDA. Canadian visitors are entitled to:

• Request a summary of the personal data we hold and the purposes for which it is used
• Dispute the accuracy of any stored information and have corrections made
• Ask that their data be deleted when it is no longer needed
• Withdraw consent for future collection or use of their information

10. Retention Schedule

Information you submit through our forms is held for no longer than two years from the date of submission. If you would like your data removed before that period expires, simply let us know and we will action the request promptly. Anonymized statistical data — which cannot be linked to any identifiable person — may be retained on an ongoing basis to support long-term analysis.

11. Security Measures

We apply a combination of technical and organizational controls to guard your data. All traffic between your browser and our servers travels over an encrypted HTTPS/TLS connection. Our hosting environment undergoes periodic security assessments, and access to personal data is restricted to authorized personnel only. While no system is impervious to every threat, we continually evaluate and strengthen our defences.

12. Cross-Border Data Transfers

Our servers are located in North America, which means data from EEA or UK visitors may be transferred outside those regions. When such transfers occur, we rely on recognized safeguards — including Standard Contractual Clauses approved by the European Commission — to ensure your data continues to receive an adequate level of protection.

13. Visitors Under Eighteen

This website is intended for an adult audience. We do not knowingly process data belonging to anyone under the age of eighteen. If we become aware that a minor has provided personal details, we will take immediate steps to remove that data from our records.

14. Revisions to This Document

This page may be amended from time to time as regulations evolve or our practices change. Each revision will carry an updated date at the top of the page. We recommend returning periodically to stay aware of any modifications.

15. How to Reach Us

For any questions regarding this document, your personal data, or to exercise any of the rights outlined above, please contact: