Privacy Notice on the Processing of Personal Data

At GYMSS, we care about the security and confidentiality of your personal data.

This Privacy Notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the related legislation, to inform people who use the GYMSS website, create a membership, request information or quotes about our products and take part in order processes about the processing of their personal data.

1. Data Controller

Your personal data is processed by GYMSS as the data controller under KVKK No. 6698.

Trade Name: GYMSS

Address: Kordonboyu Mahallesi Kordonboyu Evleri İpekböceği Sokak No:17 D:17 Kartal İstanbul

E-mail: satis@gymss.com.tr

Website: gymss.com.tr

2. Personal Data Processed

Depending on the nature of the services provided by GYMSS and the transactions carried out, the following personal data may be processed:

Identity Information

• First and last name.

Contact Information

• E-mail address,
• Phone number,
• Billing and delivery addresses.

Customer and Transaction Information

• Information on the club, federation, sports organisation or company represented,
• Tax office and tax number, where relevant,
• Quote requests and order information,
• Product preferences, size, colour and design choices,
• Order, production, delivery and customer communication records.

Transaction Security Information

• User account and session information,
• Information kept securely for password verification,
• IP address, browser and connection information,
• Date, time and record information on membership and consent transactions.

Marketing and Consent Information

• Commercial electronic message preferences,
• Message consent and refusal records.

For orders concerning athletes under the age of 18, the size, measurement and personalisation information needed to prepare the product may be provided by a parent or authorised representative.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Creating, verifying and managing user accounts,
• Providing the product catalogue and membership services,
• Receiving, evaluating and responding to quote requests,
• Preparing products and designs that meet customer requests,
• Carrying out the production, packaging and delivery of confirmed orders,
• Carrying out payment, invoicing and customer account transactions,
• Evaluating customer requests, suggestions and complaints,
• Ensuring information security and preventing unauthorised access,
• Fulfilling legal obligations,
• Keeping the records required under the related legislation,
• Responding to lawful requests from authorised public institutions and organisations,
• Sharing new products, collections, campaigns and announcements by e-mail, if separate consent is given.

4. Method of Collection and Legal Grounds

Your personal data may be collected electronically, by fully or partly automated means, through the membership, contact and quote request forms on our website, electronic correspondence, customer communication processes and order transactions; and, where necessary, by non-automated means provided that it forms part of a data recording system.

Depending on the purpose of processing, your personal data is processed under the following provisions of KVKK:

KVKK Article 5/2-c — Establishment or Performance of a Contract

Providing membership services, evaluating quote requests and carrying out order processes in which the personal data of the parties to the contract is required.

KVKK Article 5/2-ç — Fulfilment of Legal Obligations

Invoicing, accounting, tax obligations and the creation of records that must be kept under the legislation.

KVKK Article 5/2-e — Establishment, Exercise or Protection of a Right

Protecting rights arising from the contract, managing legal disputes and asserting legal claims where necessary.

KVKK Article 5/2-f — Legitimate Interest

Ensuring information security, protecting systems, preventing unauthorised access and carrying out service processes securely, provided that this does not harm your fundamental rights and freedoms.

KVKK Article 5/1 — Explicit Consent

Processing your personal data for marketing activities that require explicit consent.

Consent to commercial electronic messages is entirely optional. Not giving this consent does not prevent you from creating a membership, viewing products or requesting a quote.

5. Transfer of Personal Data

Your personal data may be transferred to the following groups of recipients, where necessary for the provision of the services and provided that the conditions set out in the related legislation are met:

• Production business partners and suppliers: Product, size, measurement, design and related order information needed to prepare and produce orders.
• Shipping and logistics service providers: Recipient, contact and delivery information needed to deliver the products.
• Information technology and infrastructure service providers: Information needed for website hosting, data storage, system security and e-mail services.
• Financial advisers and legal counsel: Information needed for accounting, financial obligations and legal processes.
• Authorised public institutions and organisations: Information required under obligations arising from the legislation and lawful official requests.

If a service or infrastructure requiring the transfer of personal data abroad is used, the transfer will be carried out in accordance with the conditions set out in Article 9 of KVKK and with appropriate safeguards.

6. Retention of Personal Data

Your personal data is kept for as long as required by the purposes of processing and limited to the legal retention periods set out in the related legislation.

Data processed in connection with membership is kept for the duration of the membership and, after it ends, for as long as there are legal grounds requiring its retention.

Records relating to orders, invoices, payments and commercial transactions are kept for the periods set out in the related financial and commercial legislation.

When the retention period ends or the reasons requiring the processing of personal data no longer exist, the personal data is deleted, destroyed or anonymised in accordance with the related legislation.

7. Rights of Data Subjects

Under Article 11 of KVKK, by applying to GYMSS you have the right to:

• Learn whether your personal data is processed,
• Request information about it if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in line with that purpose,
• Know the third parties in Turkey or abroad to whom your personal data is transferred,
• Request the correction of your personal data if it is incomplete or incorrectly processed,
• Request the deletion or destruction of your personal data under the conditions set out in Article 7 of KVKK,
• Request that the correction, deletion or destruction be notified to the third parties to whom your personal data has been transferred,
• Object to a result to your detriment arising from the analysis of your data exclusively through automated systems,
• Claim compensation for damages if you suffer damage due to the unlawful processing of your personal data.

8. Applications and Contact

You can send your requests concerning your personal data to GYMSS through the following contact channels:

E-mail: satis@gymss.com.tr

Postal Address: Kordonboyu Mahallesi Kordonboyu Evleri İpekböceği Sokak No:17 D:17 Kartal İstanbul

If you make a formal application under KVKK by e-mail, the application must be sent from the e-mail address you have previously notified to us and that is registered in our system, or another valid application method set out in the legislation must be used.

Your applications are concluded as soon as possible depending on the nature of the request, and within 30 days at the latest.

Applications are free of charge as a rule. However, if the transaction requires an additional cost, the fees in the tariff set by the Personal Data Protection Board may be charged.