Legal · Privacy

Privacy Policy

How GymStack collects, uses, and protects data across our website, the admin panel, and the GymStack: My Club member app.

Last updated · July 7, 2026 · v1.0

Privacy Terms Security

// template copy, have your counsel review before publishing. Written for KVKK (TR) and GDPR (EU) alignment.

01Who we are

GymStack Yazılım A.Ş. ("GymStack", "we") provides gym management software: a web admin panel for studios and the shared GymStack: My Club member app. Our registered office is in Istanbul, Türkiye.

For data you submit on this website and for your GymStack account, GymStack is the data controller under KVKK and GDPR.

02Two roles: your data & member data

When a gym signs up, we collect and control account data: the studio's name, contact details, and billing information.

Member data (profiles, bookings, attendance, body-composition entries) belongs to the gym. The gym is the data controller; GymStack processes it only on the gym's instructions under a Data Processing Agreement (DPA), available on request.

03What we collect

→Account data: name, e-mail, phone, studio name, tax & billing details

→Member data processed for gyms: profile, lesson balance, bookings, check-ins, progress metrics

→Payment metadata: plan, invoices, transaction status (card numbers never touch our servers)

→Usage data: device type, app version, pages viewed, crash logs

→Support data: messages and attachments you send us

04Why we process it

We process personal data to operate the platform: authentication, class booking, billing, notifications, reporting, and support.

Legal bases: performance of a contract (KVKK art. 5/2-c, GDPR art. 6/1-b); legitimate interests such as product analytics and fraud prevention (art. 6/1-f); legal obligations including tax records (art. 6/1-c); and consent where required, e.g. marketing messages (art. 6/1-a).

05Sharing & subprocessors

We never sell personal data, and we never use member data for advertising.

We share data only with subprocessors needed to run the service (cloud hosting, payment providers, SMS/e-mail delivery, error monitoring), each bound by a data processing contract. The current subprocessor list is available on request.

06Where data lives

Production data is hosted in data centers located in Türkiye and the EU.

Where a transfer abroad is required, we rely on the safeguards of KVKK art. 9 and GDPR Chapter V, including standard contractual clauses and, where applicable, explicit consent.

07Retention

Account data is kept for the life of the contract plus statutory periods; commercial and tax records are retained for up to 10 years under Turkish law.

When a gym leaves, member data is exported to the gym and then deleted or irreversibly anonymized within 30 days of contract end, unless a law requires longer.

08Your rights

Under KVKK art. 11 and GDPR art. 15–22 you can:

→Learn whether your data is processed, and request a copy

→Ask for inaccurate data to be corrected

→Request deletion or destruction where the legal grounds no longer apply

→Object to processing, or to automated results that affect you

→Ask for data portability (a machine-readable export)

→Claim damages if unlawful processing harms you

Gym members should direct requests to their gym first (the controller); we help gyms answer them. You can also write to [email protected]; we respond within 30 days, as KVKK requires.

09Cookies

The website uses essential cookies (session, language, e.g. your TR/EN choice) and, with your consent, analytics cookies to understand which pages help visitors.

You can block or delete cookies in your browser at any time; essential features keep working.

10Changes & contact

We announce material changes to this policy in the admin panel and by e-mail at least 15 days before they take effect.

Data controller: GymStack Yazılım A.Ş., Istanbul, Türkiye. Questions and requests: [email protected].

Privacy questions?

Reach our data protection team, we answer within 30 days, as KVKK requires.

[email protected]