KVKK Information Notice

This Information Notice has been prepared by Charqe Bilişim Teknolojileri Sanayi Ticaret Limited Şirketi (the "Company"), in its capacity as data controller, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (the "KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform users of the GymA mobile application (the "App") about the processing of their personal data.

1. Data Controller

Trade name: Charqe Bilişim Teknolojileri Sanayi Ticaret Limited Şirketi
Address: Kavaklı Mah. Gaffar Okkan Sk. Mesken No: 3 İç Kapı No: 5, Beylikdüzü / İstanbul, Türkiye
Trade Registry No: Istanbul Trade Registry — 398157-5
Tax Office / Tax ID: Beylikdüzü — 2091653469
Email: info@charqe.io

2. Categories of Personal Data Processed

Data category	Data processed
Identity	First name, last name, username (@handle), age, gender
Contact	Email address
Visual and audio recordings	Profile photo, the photos and videos you share (including audio, if any)
Customer transaction	Workout plans and records (sets, reps, weight, RPE, rest, duration), cardio activities, estimated calorie values, goals, reminders, in-app preferences (language, theme, units)
Health-related data (special category)	Body measurements (weight, body fat percentage, fat mass, muscle mass, circumference measurements), nutrition and water intake records, supplement information and, if you connect one, heart rate data from a smartwatch
Location	Approximate device location (latitude/longitude) and the time it was updated, story location tags, event locations, the gym you select
Social network data	Posts, stories, comments and likes; follow relationships; blocked/restricted and close friends lists; story view records; event creation and participation records; bio
Communications	Direct message contents, sent and read times, conversation participant information
Financial	Subscription status and validity period, store transaction ID (card and payment instrument details are not processed by the Company)
Transaction security	Authentication records, session information, device and operating system information, app version, notification token, last seen time, device pairing records
Legal transactions and requests/complaints	Support correspondence, content reports, moderation and appeal records

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Creating the membership account and ensuring authentication and session management;
• Providing workout and cardio tracking, statistics, personal record detection and calorie estimation features;
• Providing nutrition, water and supplement tracking and body measurement tracking features;
• Operating the social features: showing content to the audience you choose, establishing follow relationships, delivering messages, publishing events and managing participation;
• Showing nearby athletes and events if you request it;
• Sending weekly and program-based summary reports by email and sending in-app notifications, depending on your preferences;
• Verifying subscription status and managing access to paid features;
• Reviewing content reports, enforcing the Community Guidelines and detecting abuse and fake accounts;
• Ensuring the security of the service, diagnosing and fixing errors and improving the App;
• Fulfilling legal obligations, responding to requests from competent authorities and establishing and protecting rights in potential disputes.

4. Legal Grounds

Depending on the data category and purpose, your personal data is processed on the following legal grounds:

Data / processing	Legal ground
Account, profile, workout, social and communications data; subscription management	KVKK Art. 5(2)(c) — Necessary for the establishment and performance of a contract
Tax and commercial records, responding to requests from competent authorities, obligations under Law No. 5651	KVKK Art. 5(2)(ç) — Compliance with a legal obligation
Security measures, detection of abuse and fake accounts, error diagnosis, service improvement, content moderation	KVKK Art. 5(2)(f) — Legitimate interest (provided that it does not harm your fundamental rights and freedoms)
Retaining evidence and establishing rights in the event of a dispute	KVKK Art. 5(2)(e) — Establishment, exercise or protection of a right
Body measurements, nutrition and supplement records, heart rate data	KVKK Art. 6(2) — Your explicit consent
Processing location data and showing it to nearby users	Your explicit consent (given when you turn the feature on and withdrawn when you turn it off)
Posts, stories and profile information that you knowingly make public	KVKK Art. 5(2)(d) — Made public by the data subject and performance of the contract

5. Special Categories of Personal Data and Explicit Consent

Body measurements, nutrition and supplement records and heart rate data transferred from a smartwatch may be considered special categories of personal data because they relate to health. This data is processed only on the basis of your explicit consent and only to provide the service to you; it is not used for marketing, profiling or sharing with third parties.

You can withdraw your explicit consent at any time. If you do, features that depend on consent (e.g. body measurement tracking, nutrition tracking, location-based discovery) become unavailable, and the related data is deleted or anonymized. Withdrawal does not affect processing lawfully carried out before the withdrawal. You can send your request to info@charqe.io or turn off the relevant feature in Settings.

6. Method of Collection

Your personal data is collected electronically through the App and the website, by automated or partially automated means, via registration forms, data you enter in the App, uploads you make through the camera and photo library, your device's location services (if you grant permission), smartwatch integrations (if you connect them), subscription notifications from the app stores and emails you send us.

7. Transfer of Data

7.1 Transfer to Other Users

When you use the social features, the content and profile information you share are shown to other users in line with the visibility preferences you set. You can manage your visibility settings under Settings > Privacy; a detailed table of which data can be seen by whom is included in the Privacy Policy.

7.2 Transfer to Service Providers

Your personal data is transferred to the relevant providers, to the extent required by the service, within the scope of hosting and database (Supabase), push notification and app update (Expo), email delivery (Resend), location and place search suggestion (Google Places), content moderation of shared photos (Sightengine), and app distribution and subscription management (Apple, Google) services. These providers process the data only on the Company's instructions.

7.3 Cross-Border Transfer

Your data is hosted on servers in the European Union (Frankfurt, Germany) region, and some of the service providers used are established abroad. This constitutes a cross-border transfer under Article 9 of the KVKK. The transfer is carried out on the basis of:

• an adequacy decision, where one has been announced by the Personal Data Protection Board;
• in the absence of an adequacy decision, the appropriate safeguards under Article 9(2) of the KVKK (standard contract, letter of undertaking or binding corporate rules);
• in the absence of these, the incidental cases provided for in Article 9(6) of the KVKK, or your explicit consent.

Data may also be transferred to competent public institutions and organizations upon their lawful requests, within the framework of the legislation.

8. Retention and Destruction

Your personal data is retained for the period required by the purpose of processing and for the statutory limitation and retention periods set out in the relevant legislation. When the purpose no longer exists, or upon your request, the data is deleted, destroyed or anonymized. Retention periods by data category are set out in a table in the relevant section of the Privacy Policy.

If you freeze your account, your data is not deleted; it is kept as it is for 30 days from the date of freezing. If you sign in within this period, your account is restored; if you do not, the account and all data are deleted automatically. With the permanent deletion option, no waiting period applies.

When you delete your account, your personal data is deleted or anonymized within a reasonable time. However, the communication records of other users you have messaged, data that must be retained due to a legal obligation or an ongoing legal claim, and copies that remain in technical backups for a reasonable period may fall outside this scope.

9. Your Rights Under Article 11 of the KVKK

Under Article 11 of the KVKK, by applying to the data controller, you have the right to:

• learn whether your personal data is being processed;
• request information about the processing if your data has been processed;
• learn the purpose of the processing and whether your data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data has been transferred;
• request correction if your data has been processed incompletely or inaccurately;
• request the deletion or destruction of your data under the conditions set out in Article 7 of the KVKK;
• request that correction and deletion operations be notified to the third parties to whom your data has been transferred;
• object to a result to your detriment that arises from analysis carried out exclusively by automated systems;
• claim compensation if you suffer damage because of unlawful processing.

You can exercise these rights through the application methods described below.

10. Application Method

You can submit requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by sending an email to info@charqe.io from the email address registered in our system, or by sending a written petition bearing your wet signature to Kavaklı Mah. Gaffar Okkan Sk. Mesken No: 3 İç Kapı No: 5, Beylikdüzü / İstanbul, Türkiye.

Your application must clearly state your full name, your signature (for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), your address for service, your email address and phone number for notifications (if any) and the subject of your request. We may ask for additional information to verify your identity.

Depending on its nature, your application will be concluded free of charge within 30 (thirty) days at the latest; if the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient or no response is given in time, you have the right to file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and, in any case, within 60 days from the date of your application.

11. Changes

This Information Notice may be updated in line with changes in the legislation and in the App. Material changes will be announced within the App or by email before they take effect. The current version of the notice is always published on this page.