This privacy notice explains how we process personal data when you visit our website, contact us, request an appointment or apply for a job.
1. Controller
Gülay Tanrikulu
KJP Tanrikulu
Albatrosweg 41
22119 Hamburg
Telephone: 040 226 019 64
Email:
2. Website operation and hosting
Our website is hosted under the Webhosting Plus plan with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you visit the site, technical connection and access data are processed. These include the page or file requested, the page visited previously, browser type and version, operating system, device type, time of access and IP address. This allows us to deliver the website, analyse errors and keep it running securely.
According to IONOS's product-related information, the stored visitor data is anonymised upon collection and retained for eight weeks. The IP address is used in anonymised form to determine the location of access. This information relates to hosting and not to the contact, application or security data described separately below.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing a secure, stable and reliable website. IONOS receives the data as a technical service provider. Further information: Data protection information regarding IONOS web hosting.
3. Statistical evaluation
The hosting service includes IONOS WebAnalytics. According to the provider, analysis takes place without cookies, using log data or tracking pixels. The transmitted IP address is immediately anonymised. The analysis is used for statistical review and technical improvement of the website, rather than to create individual visitor profiles. Processing before anonymisation is based on Article 6(1)(f) GDPR and our interest in a functioning website that meets users’ needs. Further information: IONOS WebAnalytics.
In addition, we use Statify for a local overview of page views. The date, origin and destination of the visit as well as a technical record number are saved. Statify does not save any IP addresses, does not set any cookies and does not transmit this statistics data to an external analysis service. The visit data is automatically deleted after the set period of 365 days. Google Analytics and the previous Google conversion tracking are not used on this website.
4. Cookies and technical functions
We use Complianz for the local management of cookie notices and associated settings. Functional cookies store, for example, the notice status, the version of the cookie policy, and the settings to be taken into account. The set storage period is 365 days. Synchronisation of this information with the Complianz cloud is not enabled. There are currently no optional cookie services configured.
Section 25(2)(2) TDDDG applies to strictly necessary storage of information on, or access to information on, your device. Where this involves processing personal data, the legal basis is Article 6(1)(f) GDPR and our legitimate interest in reliable technical operation and respecting your settings. You can delete or block cookies in your browser. This may cause settings to be lost or some features to be restricted.
For the secure administration access, technically necessary login and security cookies are also used. These serve to authenticate and secure the login process, not for the statistical evaluation of your visit.
5. Protection against unauthorised access
We use Solid Security to protect the website and the administrative access. In the event of security-relevant incidents, the IP address, user ID or login name, time and type of incident may be logged. This particularly concerns failed login attempts, suspicious access, and changes in the administrative area. The logs are stored in our website database for 60 days.
Repeated attacks can lead to temporary or permanent access blocks. Blocking rules are to be distinguished from event logs. The network function for forwarding failed login IP addresses to the Solid Security Network and optional usage data sharing are disabled. Technical security checks may transmit our website address to SolidWP; a website scan checks publicly accessible content, which may also contain publicly stated personal data.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in protection against attacks, misuse and unauthorised changes.
6. Contact by telephone, fax and email
When you contact us, we process your contact details and information about your enquiry in order to deal with it and respond to you. Article 6(1)(b) GDPR applies to enquiries about arranging or providing treatment. We process other administrative enquiries on the basis of Article 6(1)(f) GDPR and our legitimate interest in appropriate communication. Where health data are necessary, Article 9(2)(h) GDPR also applies.
We retain the information to deal with your enquiry and any necessary follow-up questions. Once the matter is resolved, we delete it unless we are legally required to retain it or need it for specific evidential purposes. If the information becomes part of your treatment, the relevant documentation and retention requirements apply. Please do not send detailed clinical reports or particularly sensitive health information by ordinary email unless we have asked you to do so.
7. Appointment requests
Our booking page is technically provided by Epikur Software GmbH & Co. KG, Franklinstraße 26 a, 10587 Berlin, Germany. It can be accessed via an external link and is not embedded in this website. Our practice remains responsible for the treatment- and appointment-related processing. Epikur processes this information on our behalf in accordance with Art. 28 GDPR.
We use the contact details, appointment details and other required information provided during the booking process to process your enquiry and organise your appointment. The legal bases are Art. 6(1)(b) GDPR and, where health data is required, additionally Art. 9(2)(h) GDPR. Without the required information, an appointment request cannot be processed.
Retention depends on the processing of the enquiry, appointment administration and any treatment documentation that may be required. Appointment details that are no longer needed are distinct from treatment records subject to retention requirements. The portal’s own information also applies to technical logs and, where applicable, your own user account. In particular, that information explains technical retention periods and the infrastructure provider Exoscale/Akenes SA: Booking page privacy policy.
8. Job applications
We process application documents and information provided during the selection process to assess your application, communicate with you and decide whether to enter into an employment relationship. The legal basis is Article 6(1)(b) GDPR. Access is granted to the people responsible for these tasks and the technical service providers used for communication and storage. Without sufficient information, we may be unable to assess your application.
If you are employed, the necessary information is transferred to personnel administration. Otherwise, further retention depends on the conclusion of the selection process and the time limits within which claims arising from the application process may be brought or defended. In the event of a specific legal dispute, the necessary documents are retained until it has been finally resolved. The legal basis for these evidential purposes is Article 6(1)(f) GDPR. The data are then deleted. Keeping your details in an applicant pool beyond this requires your separate consent.
9. External Links
Route planning via Google Maps and other external services is simply linked. A Google map is not embedded. You only access the external service by opening the respective link. Once there, the respective provider processes data in accordance with its own privacy policy. This is distinct from the appointment processing described above, which is carried out on behalf of our practice.
10. Your rights
Subject to the applicable statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before withdrawal.
Objection: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will then assess whether the statutory conditions for continuing the processing are met. Please contact the controller named above to do so.
You can also lodge a complaint with a data protection supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, , datenschutz-hamburg.de.
As of September 2026