Privacy Notice
Updated: October 25, 2026
Version 2026-11. This text may be updated after legal review; every change is published as a new version and announced in the app.
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to everyone who uses the GamGym app and web portal.
1. Who holds your data?
There are two separate parties in GamGym and each is responsible for its own data.
| Data | Data controller |
|---|---|
| Your account: identity and contact details, sign-in records, your consents, your own programs, tracking records, social posts, AI requests | GamGym ([Company name], [address]) |
| Your membership at a gym: member record, memberships, payments and balance, check-ins, bookings, measurements and notes entered by the gym, documents you signed | The gym you are a member of (or the trainer) |
For gym records, GamGym acts as a data processor on behalf of the gym under a data processing agreement: it stores, shows and processes the data on the gym's instructions and does not use it for its own purposes. The gym also has its own privacy notice, which it gives you when you join.
2. Data GamGym processes as controller
| Data | Purpose | Legal basis |
|---|---|---|
| Name, surname, phone, email, date of birth, gender; national ID number if you enter it | Opening your account, identifying you, letting gyms find you | Establishing and performing the contract (Art. 5/2-c) |
| SMS verification records, session and device details, IP address, activity logs | Sign-in, account security, preventing abuse | Legal obligation (Art. 5/2-ç), legitimate interest (Art. 5/2-f) |
| Consent and preference records | Proving which text you accepted and when | Legal obligation (Art. 5/2-ç) |
| Your own programs, workout log, goals, posts, profile photo | The services the app provides to you | Performing the contract (Art. 5/2-c) |
| Answers in an AI program request (goal, level, health screening questions) | Preparing a program for you | Your explicit consent for health-related answers (Art. 6/3) |
| Marketing consent | Sending campaigns and announcements | Your explicit consent (Law No. 6563, Art. 5/1) |
| Sharing your history with other gyms | Letting a new gym see your measurement and program history | Your explicit consent (Art. 5/1); off by default |
3. Data GamGym processes on behalf of gyms
Member record, membership and sales records, payments and instalments, door and turnstile check-ins, class and appointment records, measurements and notes entered by the gym, the photo used at the door, signed agreements and the health declaration (PAR-Q). The gym decides the purpose, retention and deletion of this data. For your rights over this data, contact the gym first; if you contact us, we forward your request to the gym and help it reply.
4. Who may receive your data?
- Gyms you are a member of: the identity and contact details your membership needs. Your history at other gyms is shared only with your explicit consent.
- Our infrastructure providers: server hosting ([provider, country]); Cloudflare (domain, content delivery, public images and daily database backups; storage region Eastern Europe); SMS and email delivery services; Google Firebase for push notifications.
- AI provider: when you ask for an AI program, your request answers may be sent to our AI provider (Anthropic, USA). Your name and phone number are not sent.
- Payment institutions: when you pay online, to the licensed payment institution.
- The Message Management System (İYS) and, where the law requires, competent public authorities.
Transfers to providers abroad follow the conditions of Article 9 of KVKK.
5. How is your data collected?
From what you enter in the app and the web portal, from the record a gym opens for you, from door and kiosk devices, and from records created automatically while you use the service.
6. How long is it kept?
- When you close your account: your phone, email and username are deleted immediately, and so are session and device records. Your programs, tracking records, posts and profile photo are deleted. Your name, date of birth and national ID number are anonymised within 6 months at the latest.
- Consent records: 3 years after the consent is withdrawn, as proof.
- Deletion and anonymisation records: at least 3 years.
- Gym records: the gym decides. Payment, invoice and accounting records are kept for 10 years under tax and commercial law; closing your account does not delete them.
7. Your rights (KVKK Art. 11)
You have the right to learn whether your data is processed, request information, learn the purpose and whether the data is used for that purpose, know who it was transferred to, ask for correction if it is incomplete or wrong, ask for deletion or anonymisation where the conditions are met, ask that these actions are notified to the recipients, object to a result against you produced only by automated analysis, and claim compensation for damage.
How to use them:
- In the app: under Account › Privacy you can turn history sharing and marketing consent on or off at any time. The Account › Your data and rights page explains who holds which data and how to make a request.
- Requests: in writing to [contact address], or from the email address registered in our system. Requests are answered free of charge within 30 days at the latest.
- If you are not satisfied with our reply, you can complain to the Personal Data Protection Board.
8. Changes
When this notice changes, the new version is published on this page and you are notified in the app.