App Privacy
As Solos Gym, we attach importance to the security of your personal data. This Privacy Policy and Disclosure Notice has been prepared, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK" (Turkey's Personal Data Protection Law)), to explain, in our capacity as data controller, which categories of your personal data we process, for what purposes, on what legal basis, to whom we transfer them, for how long we retain them, and your rights under KVKK Article 11.
This is not a request for consent/explicit consent; it is a purely informational text. Processing activities subject to your explicit consent, such as marketing communications and body measurement data, are implemented through separate, independent consent steps (see Document 3 and Document 17).
| Field | Value |
|---|---|
| Data controller (business owner) | Şamil Demirdrek |
| Trademark / brand | Solos Gym |
| Tax office / tax number | ESKİŞEHİR / 2840377789 |
| Registered address | Uluönder, İsmet İnönü-2 Blv, 26190 Tepebaşı/Eskişehir |
| Support email | info@solosgym.com |
| Support phone | +90 507 570 21 71 |
While you use the App, your personal data may be processed within the categories below. The purpose for which each category is processed is set out separately in §3, and its legal basis in §4.
| Category | Data covered |
|---|---|
| Identity | Full name, date of birth (for the 18+ age check), gender (optional) |
| Contact | Email address, phone number, physical address (optional, free text) |
| Identity Verification | The Turkish national identity number is not collected |
| Preferences | Favorite gym, preferred training hours, sport-type preferences, fitness goals — preferences you enter yourself and that are stored in your profile solely on the basis of your own declaration (see §10) |
| Location (optional) | The approximate/precise location (latitude-longitude) obtained from your device when you select the "nearest gym" filter. This data is not saved to your profile; it is used only in the relevant API request to sort/filter the gym list by distance |
| Customer Transaction | Reservation history, gym entry-exit times, credit amounts and credit transaction history, promo code/gift card usage, group reservation participation, event participation |
| Financial | Payment transaction records (transaction number, amount, refund information) — card number, expiry date and CVV code never reach our systems; this information is processed solely on the payment institution PayTR's own secure payment page |
| Visual/Audio | Profile photo (optional), images sent within chat |
| Special Category — Health-Related (only under a fully optional feature) | Weight, height, body fat percentage, muscle mass, chest/waist/hip measurements that you enter yourself, on a fully optional basis, in the Profile › "My Body Measurements" section. This data constitutes special category personal data within the meaning of KVKK Article 6 and is processed only after your separate explicit consent has been obtained |
| Transaction Security | QR code and 6-digit PIN access codes, door entry attempt records (time, outcome, reason), account verification codes, IP address, device/browser information and app version, notification identifier (push token), the consent timestamp kept as proof of your consent |
| Marketing (only where you have separate explicit consent) | Communication preferences, interaction records relating to campaign notifications — see Document 3 |
| Professional Experience (only for users in the trainer role) | Biography, areas of expertise, years of experience, certificate documents and certificate type, verification status |
| Customer Transaction — Chat and Requests | Content of chat messages exchanged with a trainer (soft-deleted after 30 days, permanently deleted after 60 days), support request text, review/comment text, objection/complaint records, applied violation/suspension/ban records |
| Physical Premises Security | In-facility security cameras are used only for live monitoring; no footage is recorded (see §11) |
Your personal data is processed for the following purposes:
Your personal data is collected electronically through form fields in the App directly from your own declaration, through automatic API calls made to the App's servers (such as reservation, credit transaction, or door entry records), through our identity verification provider Clerk, and through transaction result information relayed to us by the payment institution PayTR.
This data is processed on the basis of the following legal grounds, depending on the process concerned (KVKK Art. 5, and Art. 6 for special category data):
| Process | Legal basis |
|---|---|
| Membership creation, identity verification, age (18) check | Art. 5/2-c (establishment/performance of a contract), Art. 5/2-ç (explicitly provided for by law) |
| Reservation, credit transactions, group reservation | Art. 5/2-c |
| Payment transactions, invoice/accounting records | Art. 5/2-c, Art. 5/2-ç (tax and commercial legislation) |
| Physical entry via QR/PIN, entry attempt records | Art. 5/2-c, Art. 5/2-f (legitimate interest of the data controller — gym security) |
| Trainer chat/offer flow, trainer professional information | Art. 5/2-c |
| Nearest-gym ranking by location | Art. 5/2-f (legitimate interest) and the user's explicit transactional request; the App's main functions are not restricted if location permission is refused |
| Body measurement data | Art. 6/3 — separate explicit consent required (Document 17) |
| Support requests, complaints, objections, penalty/suspension/ban records | Art. 5/2-ç, Art. 5/2-f |
| Transactional notifications (push/email) | Art. 5/2-c, Art. 5/2-f |
| Marketing communications | Art. 5/1 — separate explicit consent required (Document 3) |
| Physical premises security (camera, live monitoring) | Art. 5/2-f |
| Recipient | Data transferred | Purpose |
|---|---|---|
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (payment institution, Turkey) | Full name, email, phone, IP address, transaction amount | Executing the payment transaction |
| Hikvision door terminal (physical hardware inside the gym) | Only the currently valid, anonymous QR code (contains no name/email/phone) | Verifying physical gym entry via QR code |
| Business authorized staff | To the extent appropriate to role and duty, the relevant category | Customer support, accounting, revenue reporting |
| Authorized public institutions and organizations | To the extent required by legislation | Fulfilling legal obligations (upon request) |
and Principles Regarding the Transfer of Personal Data Abroad")
| Recipient | Location | Data transferred | Purpose |
|---|---|---|---|
| Clerk, Inc. | USA | Identity/contact data | Identity verification, session management |
| Resend | USA | Email address, notification content | Delivery of system emails |
| Google (Firebase Cloud Messaging) | USA | Device notification token, notification content | Sending push notifications |
| Railway (server, database, and application file hosting infrastructure) | USA (US West – San Francisco) | All data categories listed in §3, plus files stored within the App | Running the App, hosting the database and files |
| Google LLC (Google Drive — offsite backup archive storage) | USA | An encrypted full backup of the database (including all data categories in §3) and an encrypted backup of the private file store (trainer certificates, gym photos, profile images) | Disaster recovery: keeping a second copy of the data, independent of our hosting provider |
These transfers are carried out on the basis of an appropriate safeguard achieved through a standard contract executed with the relevant provider under KVKK Art. 9, or, provided it is incidental, on the basis of one of the situations set out under Art. 9/6.
Additional safeguard specific to backup archives. Backup archives uploaded to Google Drive are encrypted within our own system, before upload, using the age standard (X25519 key exchange + ChaCha20-Poly1305 encryption). The private key that opens the archive resides neither with Google nor with our hosting provider; it is kept only in a copy under the sole control of the data controller, to which none of these providers has access. For this reason, Google has no technical ability to access the content of the archives hosted with it and cannot read the transferred personal data; the transfer occurs solely in the form of encrypted data.
| Data category | Retention period | Justification |
|---|---|---|
| Membership/profile data | For as long as the account is active; when the account is deleted, the policy set out in §12 applies | Performance of the contract |
| Payment and invoice records | The statutory period prescribed under Article 82 of Turkish Commercial Code No. 6102 and Article 253 of Tax Procedure Law No. 213 | Legal obligation |
| Chat messages | Soft-deleted 30 days after deletion, permanently deleted after 60 days | Purpose limitation |
| Credits | 30-90 days depending on the package (from the purchase date) | The product's own validity period |
| Account verification codes | Shortly after expiry; used codes within 24 hours | Purpose limitation |
| Door entry attempt records | For a reasonable period for security and legal dispute defense purposes, even if the account is deleted | Legitimate interest, burden of proof |
| Penalty/suspension/ban records | Continue to be retained even if the account is deleted | Detecting repeat violations, legal defense |
| Camera footage | No recording is kept (live monitoring only) | — |
For data categories for which no specific period is stated above, if there is no period prescribed under applicable legislation, the period necessary for the purpose for which the data is processed applies; when that period ends, the data is deleted, destroyed, or anonymized.
Pursuant to KVKK Art. 11, by applying to us you have the right to:
To exercise the rights above, you may submit your request — accompanied by information that will identify you (full name, Turkish national identity number or foreign identity number, signature), and clearly stating the subject of your request:
Your request will be concluded, depending on its nature, within thirty days at the latest and free of charge; if the transaction requires an additional cost, a fee determined by the tariff set by the Personal Data Protection Board may be requested. If your application is rejected, found insufficient, or not answered within the time limit, you retain the right to file a complaint with the Personal Data Protection Board within thirty days of learning the response and, in any event, within sixty days of the date of application.
Rule violations such as late cancellation, failing to attend/late attendance at an event, and overstaying the reservation period are detected by the system automatically, according to predetermined, objective criteria — and the resulting credit deduction/suspension decision is applied automatically — on the basis of concrete, individual events such as "was entry made during the reservation time / was the time exceeded," and not by deriving a behavioral profile of you. You may object to these decisions through a support request; your objection is reviewed by a human authorized person, and the decision is reversed if warranted.
The App stores information you enter yourself on the basis of your own declaration in your profile, such as your favorite gym, preferred training hours, sport-type preferences, and fitness goals. This information is not used by any automated recommendation, scoring, or profiling system — it is only displayed in your profile and exported/deleted upon your request.
Our gyms have a camera system for physical security purposes. These cameras are located only in common/training areas; there are no cameras in changing rooms or shower areas whatsoever. The cameras are used only for live monitoring; no footage is recorded, and there is no archive that could be accessed for recordings. Only the gym owner/operator can access the live feed. This processing is based on legitimate interest (gym security); it does not depend on your consent.
You can delete your account through Profile › Delete My Account. In that case: your device notification token, notification preferences, body measurements, and favorite gym record are permanently deleted; your profile information (name, email, phone, date of birth, address, photo, sport preferences) is anonymized; your consent records, credit transaction history, payment records, penalty/suspension/ban records, and past reservations continue to be retained due to legal obligations (§6). For the complete details of the deletion flow and how to apply, also see Document 14 — Account and Data Deletion Policy.
You may withdraw, at any time and without giving any reason, the consent you have given for explicit-consent-based processing activities such as marketing communications (Document 3) and body measurement data (Document 17), by the method specified in the relevant document (in-app setting, "unsubscribe" link, etc.). Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal date; only processing activity after that date is halted. Once consent is withdrawn, the relevant data is deleted unless another legal basis (e.g., a statutory retention obligation) applies.
The App itself does not use cookies. At the credit card payment step, the payment page is presented by PayTR within an in-app browser component (WebView); PayTR's own cookies may be used on that page, these cookies do not belong to the App itself, and are not shared with other parts of the App. The App uses Clerk for identity verification, Firebase Cloud Messaging for push notifications, and Resend SDKs/APIs for email delivery (see §5).
The App requests the following permissions only for the stated purpose:
Your personal data is protected under KVKK Art. 12 through appropriate technical and administrative measures: irreversible storage of passwords, encrypted storage of sensitive fields in the database, generation of door access codes (QR/PIN) in a cryptographically verifiable but non-decryptable form, restriction of file access to time-limited/signed links, and carrying all data traffic over an encrypted connection (HTTPS/TLS). In the event that your personal data is unlawfully obtained, the situation is reported as soon as possible to the Personal Data Protection Board and to the affected data subjects, in accordance with KVKK Art. 12 and the relevant Board decisions.
The App is intended only for users aged 18 and over; an age check is performed at registration. We reserve the right to close an account that we determine belongs to a person under the age of eighteen, within the framework of applicable legislation.
This text may be updated in line with changes in legislation or changes in the App's data processing activities. The current version is always accessible from the Profile › My Consents screen and from the permanent address on the website; material changes will additionally be notified. The effective date of this text is stated at the beginning of the document.
I have read this text and have been informed.
