Personal Data Protection Notice

This English version is provided for information purposes only. This document is governed by and construed in accordance with Turkish law, and the Turkish version is the sole authentic text. In the event of any discrepancy, inconsistency or conflict between the Turkish version and this English version, the Turkish version shall prevail.

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu) (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to explain how the personal data of visitors, members and customers of the Sporara platform is processed.

1. Identity of the data controller

Your personal data is processed in the capacity of data controller by the companies listed below. For the operation of the platform, Sporara Teknoloji Ticaret A.Ş. and Esteprime Özel Sağlık Turizm ve Danışmanlık A.Ş. act as joint data controllers.

Services are divided as follows: camp and tour products are sold by Esteprime Özel Sağlık Turizm ve Danışmanlık A.Ş., while all other services on the platform (activity, course, tournament, membership, rental and package products, together with membership and account services) are provided by Sporara Teknoloji Ticaret A.Ş. At the moment of purchase, the selling company and the applicable distance sales agreement are shown separately; the current text is available at https://sporara.com/mesafeli-satis.

2. Categories of personal data processed

• Identity data: name, surname, date of birth, gender; and, where required for invoicing or by law, Turkish identity number.
• Contact data: e-mail address, mobile telephone number, billing and delivery address.
• Customer transaction data: reservation and order records, order number, participant details, e-ticket records, cancellation and refund requests, coupon and campaign use, gift deliveries, favourites and search history.
• Financial data: payment amount, payment method, transaction reference number, refund records and invoice details. We do not see or store your full card number; payments are taken through the infrastructure of a licensed payment institution.
• Transaction security data: IP address, session and login records, cookie identifiers, device and browser information, log records.
• Location data: province-level location only, derived from your IP address or, with your permission, from your device. It is used to show listings near you.
• Marketing data: commercial electronic message consents, communication preferences, campaign interactions.
• Visual and content data: profile photograph, your reviews and ratings, messages exchanged with operators through the platform, support requests.
• Special categories of personal data: as a rule not processed. Certain sports services may require a declaration regarding the participant’s health (for example a health declaration for diving or rafting); such data is processed only with your explicit consent or where one of the conditions in Article 6 of the Law applies, and only to the extent required by the service.

3. Purposes of processing

• Creating your membership, managing your account and carrying out authentication processes.
• Performing reservation, purchase, e-ticket and participation processes; concluding and performing the contract.
• Carrying out payment, invoicing, cancellation and refund processes and managing finance and accounting operations.
• Transmitting the information required for the service relationship between you and the sports centre or operator offering the listing.
• Resolving customer support requests, complaints and disputes.
• Improving the platform and its services, performing usage analyses and improving search and recommendation results.
• Displaying listings and language preferences appropriate to your province.
• Where you have given explicit consent, sending commercial electronic messages about campaigns, discounts and promotions and personalising content.
• Operating information security processes, preventing fraud and misuse and keeping log records.
• Making statutory notifications to competent public authorities, fulfilling legal obligations and pursuing legal claims.

4. Legal grounds for processing

Your personal data is processed in accordance with the general principles in Article 4 of the Law and on the following legal grounds:

• Expressly provided for by law (Art. 5/2-a): keeping tax and invoice records and retaining traffic/log records under Law No. 5651.
• Necessary for the conclusion or performance of a contract (Art. 5/2-c): membership, reservation, payment, e-ticket and participation processes.
• Necessary for compliance with a legal obligation of the data controller (Art. 5/2-ç): obligations arising from tax, consumer protection and travel agency legislation.
• Necessary for the establishment, exercise or protection of a right (Art. 5/2-e): retention of evidence in dispute and complaint processes.
• Necessary for the legitimate interests of the data controller (Art. 5/2-f): platform security, prevention of misuse and measurement and improvement of service quality.
• Explicit consent (Art. 5/1): non-essential cookies, commercial electronic messages, personalised marketing and use of device location.
• For special categories of data, explicit consent or the conditions in Art. 6/3: for activities requiring a health declaration.

5. Methods of collection

Your personal data is collected by automated and partly automated means through membership, reservation, contact and support forms completed on the website and mobile interfaces, transactions made with your account, in-platform messaging, cookies and similar tracking technologies, requests you send by e-mail or telephone, and transaction results returned by the payment institution.

6. Recipients of personal data and purposes of transfer

Your personal data may be transferred, in accordance with Article 8 of the Law and only to the extent necessary, to the following parties:

• Sports centres, facilities, instructors and tour/camp operators: name, contact details, number of participants, date and time and service-specific details, so that your reservation can be fulfilled.
• Payment and electronic money institutions and banks: for payment, refund and chargeback processes.
• E-mail, SMS and notification infrastructure providers: for transactional notifications and, where you have consented, commercial messages.
• Courier and logistics companies: for delivery where a physical shipment is required.
• Cloud, hosting, security and analytics service providers: for hosting, backup and platform security.
• Accounting, legal and independent audit advisers: for fulfilling financial and legal obligations.
• Competent public authorities and judicial bodies: for statutory requests for information and documents.

Your personal data is not sold or rented to third parties for marketing purposes.

7. Transfers abroad

Service providers established abroad may be used for hosting, e-mail delivery, error monitoring and analytics. In such cases your personal data is transferred under Article 9 of the Law only to countries declared by the Personal Data Protection Board to provide adequate protection, or, where adequate protection is absent, on the basis of appropriate safeguards such as standard contractual clauses, binding corporate rules or an undertaking, or where one of the exceptions listed in that article applies. You may request up-to-date information about the destination country and the safeguard relied upon through the application channels below.

8. Retention periods

• Membership and account data: for the duration of membership and, after closure of the account, for the applicable statutes of limitation.
• Reservation, order and invoice data: 10 years from the date of the relevant transaction, under tax and commercial legislation.
• Payment and refund records: 10 years.
• Traffic and log records: for the period required by Law No. 5651 and its secondary legislation (at least 2 years).
• Cookie data: for the cookie-specific periods set out in our cookie policy.
• Commercial electronic message consent records: 3 years from withdrawal of consent.
• Support and complaint records: 10 years from closure of the request.

At the end of these periods your personal data is deleted, destroyed or irreversibly anonymised.

9. Rights of the data subject (Article 11 of the Law)

1. To learn whether your personal data is processed.
2. To request information if your personal data has been processed.
3. To learn the purpose of processing and whether the data is used in accordance with that purpose.
4. To know the third parties in Türkiye or abroad to whom your personal data is transferred.
5. To request rectification where your personal data is processed incompletely or inaccurately.
6. To request erasure or destruction of your personal data under the conditions set out in Article 7 of the Law.
7. To request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred.
8. To object to a result to your detriment arising from analysis of the processed data exclusively by automated systems.
9. To claim compensation for damage suffered as a result of unlawful processing of your personal data.

10. How to make an application

To exercise your rights, you may submit your request through the channels below, including the information required by the Communiqué on the Procedures and Principles of Application to the Data Controller (name and surname, signature, Turkish identity number or, for foreigners, nationality and passport number, address for service, e-mail and telephone if any, and the subject of the request):

• Sporara Teknoloji Ticaret A.Ş.
  • By post: Halaskargazi Mah. Halaskargazi Cad. Garanti Apt. No: 4 İç Kapı No: 5 Şişli / İstanbul
  • By e-mail: [email protected]
• Esteprime Özel Sağlık Turizm ve Danışmanlık A.Ş.
  • By post: Şirinevler Mah. Adnan Kahveci Blv. Cemal Akın Plaza No: 194 İç Kapı No: 51 Bahçelievler / İstanbul
  • By e-mail: [email protected]

Your application will be concluded as soon as possible and in any event within 30 days, depending on the nature of the request. Where the process entails an additional cost, the fee set out in the tariff determined by the Board may be charged. If your application is rejected, the response is found insufficient or no response is given in time, you have the right to lodge a complaint with the Personal Data Protection Board within 30 days from becoming aware of the response and in any event within 60 days from the date of application.

11. Updates

This notice may be amended following legislative changes or updates to the operation of the platform. The current text is always published at https://sporara.com/kvkk; material changes are additionally announced through the platform.