PRIVACY POLICY

WOD Türkiye — Privacy Policy

This Privacy Policy explains, in respect of the mobile applications (iOS and Android), the website (wodturkiye.app) and the related digital services offered by WOD Türkiye, the purposes for which users' personal data is collected, how it is processed, the legal bases relied upon, and the circumstances in which it is shared with third parties.

This Policy has been prepared within the framework of the Turkish Personal Data Protection Law No. 6698 (KVKK), the European Union General Data Protection Regulation (GDPR — 2016/679), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the California Online Privacy Protection Act (CalOPPA), the Digital Services Act (DSA — 2022/2065) and other applicable data protection legislation.

Documents presented and consents obtained at registration

During registration the legal documents are presented in three separate ways, each with a different legal nature:

1. Contractual consent. At one of the account creation steps the user ticks the checkbox "I have read and accept the Terms of Use." This constitutes acceptance of a contract; registration cannot be completed without it. The Membership Agreement is presented separately on the Premium subscription purchase screen and is accepted by making the purchase.
2. Information. This Privacy Policy and, for users in Türkiye, the KVKK Information Notice are presented as links on the sign-in and registration screens. These documents are not contracts that are accepted; they are notices by which the user is informed. The version presented to the user and the date on which it was presented are recorded.
3. Explicit consent. Explicit consent is not collected in bulk at registration. For the artificial intelligence analysis and the related international transfer, which Section 5 identifies as consent-based, explicit consent is obtained on a separate screen, through an unticked checkbox, at the moment the user first wishes to use the feature. The user may keep using the Service without giving that consent. Consent that has been given may be withdrawn at any time through Settings → Preferences → AI → "Withdraw AI Consent" (see Section 3.9 and Section 9.1).

Processing necessary for the core functions of the Service relies on the performance of a contract, not on consent.

The framework that applies to your region

WOD Türkiye is operated from Türkiye. While Turkish data protection law (KVKK) is the primary framework, additional sections have been prepared for compliance with the regional regimes below.

The core rights available to all users are listed in Section 9.1.

1. INTRODUCTION AND SCOPE

1.1 Data controller

Authorised data processor. Kürşad Şentürk produces the daily workout content and carries out content moderation under the WOD Türkiye brand. He acts as a data processor on behalf of, and solely upon the instructions of, the data controller; he has no authority to determine the purposes or means of processing or to take independent decisions. Independent commercial use or export of personal data is prohibited. The operational roles of the parties and the processor's obligations are governed by a written data processing protocol.

1.2 Scope

This Policy covers the following digital surfaces:

1. The iOS mobile application (distributed through the App Store)
2. The Android mobile application (distributed through Google Play)
3. The website (wodturkiye.app) — a static site for promotional and informational purposes
4. The administration and operations panel (for authorised content moderation and system administration only)

The scope of processing varies according to the user's status:

• Website visitors (unregistered). No tracking, analytics or advertising cookies are used on the site and no visitor data is collected. See Section 7.2 for details.
• Registered free member. Profile data, technical data, following relationships and benchmark results are processed. These users cannot use interactive features such as score entry and post sharing. For free members who give explicit consent during registration, a free artificial intelligence pre-analysis is produced once (Section 3.9.1). Free members to whom bonus credits have been granted through a gift or a promotional code may also use the artificial intelligence analysis until those credits are exhausted; in those cases artificial intelligence analysis data is processed as well.
• Premium member. In addition to the above, fitness performance data, social content, Team WOD partner records, subscription data and artificial intelligence analysis data are processed.

For the detailed scope of access of each user tier, see Section 3.1 of the Terms of Service.

1.3 Description of the service

WOD Türkiye is a digital sports and social platform focused on functional fitness and high-intensity training, offering its users daily workout content, personal performance tracking tools, social interaction features and optional artificial intelligence assisted analysis.

1.4 Age requirement

WOD Türkiye serves only users who are 18 years of age or older. The date of birth declared by the user at registration is taken as the basis; no official identity verification is carried out. Accounts found to belong to persons under 18 are closed and the related personal data is deleted. The Service is not designed for children and data is not knowingly collected from children.

1.5 Applicable legal framework

This Policy has been prepared so as to cover obligations under the following regimes: KVKK (Türkiye), GDPR (EU and EEA), the Swiss FADP, UK GDPR, CCPA/CPRA and CalOPPA (California), the DSA (EU) and COPPA (USA).

Other jurisdictions. In jurisdictions other than those listed above (for example Brazil's LGPD, Canada's PIPEDA, Singapore's PDPA, South Africa's POPIA), processing is carried out while reserving the user's legal rights under the data protection legislation in force in their country of residence. The data controller aims to keep its data protection standards, across its global operation, at a level consistent with good industry practice; simultaneous and complete compliance with every local law of every country is not undertaken. Mandatory provisions applicable in each country are reserved.

2. DEFINITIONS

3. PERSONAL DATA COLLECTED

Not all of the data categories listed below are processed for every user. The table summarises which category applies to which user tier.

Free members may enter benchmark results; scores for the workout of the day and training notes are subject to a Premium subscription.

The expression "bonus credits" in the table refers to artificial intelligence usage credits granted to a user's account through a gift or a promotional code, which may be used independently of subscription status. Free members holding such credits may use the artificial intelligence analysis feature until those credits are exhausted.

3.1 Identity and profile data

First name, surname, date of birth (as declared), gender, country, language preference, profile photograph (optional) and biography (optional, up to 150 characters).

First name, surname, date of birth, gender and country are mandatory at registration. The country is chosen by the user from a list; no location detection is performed.

3.2 Contact and account data

Email address, account password (stored only as a one-way cryptographic hash; plain text is not retained) and, where social sign-in is used, the Apple or Google account identifier.

3.3 Fitness and performance data

WOD scores (time, repetitions, weight, rounds, distance, calories), personal records, Rx/Scaled labels, benchmark results and training notes. This data is processed in the performance and training record category; the assessment made in respect of health data is explained in Section 5.1.

3.4 Social content and interaction data

Posts (text, photograph, video), comments, likes and reactions, Team WOD formations and partner matches created by users holding an active Premium subscription are processed. Following relationships, blocking records and content reports are processed for all registered users, including free members.

Free members cannot produce posts, comments or likes; no social content creation data is therefore processed for this tier. The user who shares content is responsible for it, including in respect of copyright infringement, the image of a third party, insult or unlawful content. Detailed obligations are set out in the Terms of Service.

3.4.1 Team WOD partner name

A user may mark a person who is not registered with the application as a Team WOD partner and enter their name as free text. The following principles apply to this processing:

1. Before entry, the user is informed within the application and an express declaration is required by means of a checkbox confirming that the consent of the third party whose name is entered has been obtained. A user who ticks the checkbox declares that they have obtained that third party's consent and that they assume the legal responsibility arising from the entry.
2. The data controller remains responsible for its own obligations under the KVKK and the GDPR (including Article 14), independently of the user's declaration.
3. As required by data minimisation, a nickname, alias or initials should be used in the free-text partner field instead of a real first name and surname. The user is guided accordingly within the application.
4. Third parties whose names appear in the application may request the removal of their names by writing to info@wodturkiye.app. Such requests are concluded within thirty (30) days at the latest; in urgent cases, such as an allegation of infringement of personality rights, they are taken up within seven (7) business days.

3.5 Media data

Profile and post photographs and videos, together with file metadata (size, file type, upload time). Media files are hosted on Cloudflare R2.

3.6 Subscription and payment data

Subscription status, purchase identifier, plan type (monthly or annual), store information and the customer identifier held by the subscription management provider.

Financial data such as card details, bank account and billing address is not collected. All payments take place through the Apple App Store and Google Play infrastructures and are subject to the policies of the relevant store; the data controller has no access to this information. The right of withdrawal, automatic renewal and refund conditions are governed by the Membership Agreement.

For the purpose of tracking artificial intelligence usage credits by period, the start and end dates of the period and the number of credits used in that period are retained against the store transaction number. This record contains no name, email address or user identifier.

Relevant store policies: Apple Media Services Terms (apple.com/legal/internet-services/itunes), Apple Privacy Policy (apple.com/legal/privacy), Google Play Terms of Service (play.google.com/about/play-terms), Google Privacy Policy (policies.google.com/privacy).

3.7 Technical and device data

Device identifier, platform information, application version, device model, crash reports and notification token.

The application does not use advertising or device identifiers provided by the operating system (IDFA, GAID, IDFV). Instead, only a random identifier generated by the application itself and held solely in the device's local storage is used. This identifier is not shared between applications and becomes invalid when the application is removed from the device.

Abuse and fraud prevention signals. The following technical indicators may be processed for the purposes of account security, detection of restriction circumvention and automated bot detection:

1. Anomalous behaviour patterns per device or session
2. Sign-in to more than one account from the same device or session
3. Temporary and time-limited examination of the IP address (for security purposes only)
4. Suspicious sign-in or request frequency

The legal basis for this processing is legitimate interest (KVKK Art. 5/2(f), GDPR Art. 6(1)(f)). The retention period is set out in Section 8.2.

3.8 Analytics data

Analytics data that does not directly identify the user, or that is pseudonymised, is processed: in-application event signals (screen views, feature use, application launch, registration and sign-in events) together with segmentation attributes (premium status, gender, country, account type, age group). This data is not intended to be matched directly with a user's identity.

Analytics are collected only in the mobile application. No analytics measurement is performed on the website (see Section 7.2).

3.9 Artificial intelligence analysis data

The artificial intelligence analysis runs only when the user triggers the feature themselves within the application and only after the user's explicit consent has been obtained. Explicit consent is obtained on a separate screen, through an unticked checkbox, when the feature is first used; no data is transmitted to the artificial intelligence service before consent is given. Apart from the pre-analysis described in Section 3.9.1, the right of use is managed on the server on a credit basis and arises from two separate sources:

1. Monthly allowance. A limited usage credit that renews each period is granted to Premium subscribers (currently 20 credits per month). Unused allowance credits do not carry over to the following period; they are reset at the end of the period and granted again in the new period.
2. Bonus credits. Credits granted through a gift or a promotional code give rise to a right of use that is independent of subscription status and that carries over; they do not expire at the end of a period. Free members holding such credits may also run the feature.

The order of consumption is fixed: the monthly allowance, which would otherwise expire at the end of the period, is used first, and bonus credits are used once it is exhausted.

When the feature is run, the following data is transferred to the gemini-2.5-flash model running on the Google Vertex AI platform:

1. The initials of the user's first name and surname (the full name is not transferred)
2. Gender
3. The title, description, type, number of rounds and time limit of the relevant workout
4. Personal record values for each movement analysed: one-repetition maximum weight (kilograms), maximum number of repetitions, the relevant personal record time and whether it was completed at Rx level
5. In Team WOD analyses, and only for mutually accepted partnerships, the partner's initials, gender and relevant performance values

The full first name and surname, user identifier, email address, date of birth, country, social content, device information, account details and subscription status are not transferred to the artificial intelligence service. In accordance with the principle of data minimisation, only the data categories necessary to produce the output are transferred.

Analysis outputs are stored against the user's account and can be viewed only by that user.

Withdrawing consent and choosing not to use the feature. The feature is triggered separately on each use; no data is transmitted to the artificial intelligence service unless the user runs it. Explicit consent that has been given may be withdrawn at any time through Settings → Preferences → AI → "Withdraw AI Consent"; withdrawal has effect for the future, and the feature cannot be run until consent is given again. Withdrawal does not delete analysis outputs already produced and stored on the account; their deletion may be requested through the channels in Section 9 or by deleting the account. Not giving or withdrawing consent does not affect access to services other than the artificial intelligence analysis.

Recommendations and analyses produced by artificial intelligence are for information purposes only; they do not replace the advice of a professional trainer, physician or health specialist. The assessment regarding automated decision-making is explained in Section 11.

3.9.1 Pre-analysis offered during registration

During registration the user is asked, optionally, to enter values from two short measurement workouts. If the user gives explicit consent, a pre-analysis based on these values is produced once per account and free of charge; it does not consume artificial intelligence credits. If the user changes the measurements, the analysis may be regenerated a limited number of times; a single pre-analysis record is kept for each account at all times.

For the pre-analysis only the following data is transferred to the gemini-2.5-flash model running on the Google Vertex AI platform:

1. One-repetition maximum weight (kilograms) for the Power Clean and the Power Snatch
2. Maximum number of repetitions for Toes to Bar
3. The Rx or Scaled choice for Wall Ball and, where Scaled is chosen, the weight used (kilograms)
4. Gender
5. The language in which the analysis is to be written

The first name, surname or their initials, user identifier, email address, date of birth, country, device information and subscription status are not transferred for the pre-analysis.

The measurement values entered are kept temporarily in the account's profile record so that registration can be resumed where it was left, and are removed from that record when registration is completed. If the user chooses to save the measurements as benchmark results, those values are stored among the benchmark results under Section 3.3.

The pre-analysis produced (target time, round plan and movement strategy text), together with the model used, the language and the number of generations, is stored against the account; the measurement values themselves are not kept in this record, only a one-way digest derived from them in order to tell whether the measurements have changed. The pre-analysis can be viewed only by the user concerned, is included in the in-application data download package (Section 9.2) and is deleted when the account is deleted (Section 8.2).

3.10 Notification preferences and notification token

The token provided by the device for the delivery of notifications is processed together with the user's notification category preferences (new WOD, partner request, new follower, like, comment and similar). The user may switch notifications off at any time from the device operating system settings or from the in-application preferences screen.

3.11 Moderation and security data

Content reports, user blocking records, account restriction history and automated abuse detection records.

3.12 Consent records

The date of acceptance and the version of the Terms of Service; the date on which the Privacy Policy and the KVKK Information Notice were presented to the user and their versions; the dates on which explicit consent to the artificial intelligence analysis was given and withdrawn, and the version of the consent text concerned.

3.13 Data not collected

The following data is not collected: sensitive or continuous location data, biometric data, medical health data, financial data (credit card, bank account), browsing history, contact lists, genetic data, political opinions, religious beliefs and sexual orientation data, and behavioural advertising identifiers.

The IP address may be processed temporarily for technical reasons (network connectivity, content delivery routing, fraud prevention); it is not used to infer location or to build a user profile.

3.14 Special categories of data that may appear in user content

The data controller does not request special categories of personal data within the meaning of KVKK Article 6 and GDPR Article 9, and provides no separate field for entering such data. Users may nevertheless, of their own volition, write information concerning health status, injury or similar matters into free-text fields such as training notes, post text and comments.

Such information arises from the user's own sharing; it is not requested by the data controller, is not separately categorised or analysed, and no inferences are drawn from it. Users are advised not to write special categories of personal data into free-text fields. Users who have shared information of this nature may request its deletion through the channels in Section 9.

4. PURPOSES OF USE

Personal data is not processed for marketing purposes. Should marketing processing be carried out in future, separate explicit consent will be obtained from users and a withdrawal mechanism will be provided.

5. LEGAL BASES

5.1 Assessment regarding health data

WOD Türkiye does not aim to provide health services to its users and is not designed for medical diagnosis, treatment or rehabilitation. The fitness and performance data processed consists of sporting performance records entered manually by the user. In this context:

1. No medical data character is intended in respect of this data and it is not processed as health data.
2. No biometric or medical data (heart rate, blood values, fingerprint, facial recognition and similar) is collected.
3. This data is not used to draw inferences about health status.
4. No health prediction is produced through profiling or automated systems.
5. Unless the law expressly requires otherwise, this data is not processed as a special category of personal data within the meaning of GDPR Article 9 and KVKK Article 6.

Section 3.14 applies in respect of special category information that users may write into free-text fields of their own volition.

6. SHARING AND INTERNATIONAL TRANSFERS

6.1 Domestic sharing

Personal data is not shared with third parties in Türkiye for commercial purposes, except with legally authorised institutions. The content provider, technical support personnel and operational sub-processors act solely as authorised data processors, upon the instructions of the data controller.

Exceptions of independent controllership. It is assessed that certain international service providers (Apple and Google social authentication, the App Store and Google Play payment infrastructures, and certain Google services) may act as independent controllers, or in part as joint controllers, within their own platforms. In such cases the provider's own privacy policy and legal undertakings apply.

6.2 Sub-processor list

The sub-processors used in the service infrastructure may change over time according to operational needs; the current list appears in the most recently published version of this text. Notification is given in accordance with Section 17 in the event of material changes.

6.3 Legal grounds for transfers

Transfers are not based on a single legal ground; a separate ground applies to each sub-processor according to its role in the provision of the service and the user's practical ability to refuse.

Because of this distinction, a user's choice not to use the optional services does not affect the core functions of the Service.

Regional preference. Where possible, the European Union or regions close to it are preferred. The database is hosted in Frankfurt, the administration panel servers in Germany, and the artificial intelligence analysis in the Netherlands. Some global service providers offer infrastructure based only in the United States, and those services are used to the extent necessary for the provision of the Service.

Transfer safeguards. Data processing agreements have been concluded with the sub-processors. Some providers are certified under the EU-US Data Privacy Framework; for others, Standard Contractual Clauses or the provider's binding undertakings apply. The currency of the transfer safeguards is reviewed periodically.

6.4 Primary storage locations

6.5 Additional safeguards for analytics processing

1. No behavioural advertising targeting is carried out; no user-level advertising profile is built.
2. Data is processed at the level of segmentation and aggregation rather than individual behaviour tracking.
3. Data is not sold or shared with third-party advertising networks.

6.6 Transfers to authorities

Transfers are made upon a court order, a prosecutor's request or a lawful request from a competent public authority, limited to the scope of data requested.

7. COOKIES, SOFTWARE DEVELOPMENT KITS AND TRACKING TECHNOLOGIES

7.1 Mobile application software development kits

7.2 Website cookies

No tracking, profiling, analytics or advertising cookies are used on the wodturkiye.app promotional site. The site does not place any cookies.

The browser's local storage is used on the site solely to remember the visitor's chosen language preference; this information is not transferred outside the visitor's device.

Because fonts are served on the site through Google Fonts, the visitor's IP address and browser information are transmitted to Google when a page is viewed.

In the administration panel, a strictly necessary session cookie is used solely to maintain the sessions of authorised users. This cookie serves no tracking purpose and the panel is not open to general use.

Should non-essential cookies be used in future for analytics or similar purposes, prior explicit consent will be obtained from users and this Policy will be updated in accordance with Section 17.

7.3 Do Not Track statement

As there is no common technical model for compliance with "Do Not Track" signals in current industry standards, WOD Türkiye does not technically respond to these signals. Because no tracking is carried out on the website, this does not give rise to any additional monitoring of visitors.

7.4 Mobile device tracking identifiers

Because no behavioural advertising tracking is carried out in the application, no additional permission dialog is shown to the user under the Apple App Tracking Transparency framework. Advertising identifiers such as IDFA (iOS) and GAID (Android) are not used.

7.5 Service-specific opt-out methods

8. DATA RETENTION AND ACCOUNT DELETION

8.1 General principle

Personal data is processed only for as long as it is necessary for the provision of the Service; when the purpose ceases to exist, the data is deleted or anonymised. Statutory retention obligations are reserved.

8.2 Retention periods

8.3 Account deletion

8.3.1 In-application account deletion

1. Open the WOD Türkiye application.
2. Go to Settings → Account → Delete My Account.
3. The first screen informs you of the consequences of the operation; tap "Continue".
4. The second screen asks for final confirmation; tap "Permanently Delete My Account".
5. Once the request is received, the account and user data are deleted from the active production systems; copies in backup systems are deleted by being overwritten within the rolling backup rotation.

8.3.2 Users without access to the application

Users without access to the application may submit a request by sending an email headed "Account Deletion Request" to info@wodturkiye.app. Stating information that identifies the account (such as the registered email address) speeds up the process.

8.3.3 Data deleted and data retained

Data deleted:

1. Profile information (first name, surname, date of birth, country, biography, profile photograph)
2. Posts, comments, likes and reactions
3. Following and follower relationships
4. Leaderboard scores and leaderboard records
5. Team WOD partner records and references
6. Artificial intelligence analysis history (including the pre-analysis produced during registration) together with the credit balances held on the account (including the monthly allowance and bonus credits)
7. Device and session data (including the notification token)
8. Uploaded media files

Records that continue to be retained:

1. Transaction records — with the user identifier deleted. Accounting records relating to purchase transactions (product, plan, store, amount, currency, store transaction number) continue to be retained for reconciliation purposes; when the account is deleted, the user identifier in these records is permanently deleted and the record ceases to contain direct identifying information. The data controller does not represent that these records become anonymous: it is not technically impossible for a record to be re-associated if it is considered together with other system records from the same time interval. For this reason such records remain within the scope of this Policy as pseudonymised personal data. Financial records relating to purchase transactions are additionally held by Apple and Google under their own policies.
2. Artificial intelligence credit period records. The usage counter for a subscription period — the store transaction number, the start and end dates of the period and the number of credits used in that period — is held against the store transaction number and is therefore unaffected by account deletion. The record is automatically deleted within ninety (90) days at most from the end of the relevant period and contains no name, email address or user identifier.
3. Records subject to ongoing legal proceedings or to a request from law enforcement or the judiciary
4. Limited records for security and fraud prevention purposes (two years at most)
5. Anonymous statistical data separated from the user's identity

Account deletion is an irreversible operation carried out with two-stage confirmation.

8.3.4 The relationship between account deletion and the store subscription

Deleting an account does not of itself cancel a subscription purchased through the Apple App Store or Google Play. Subscriptions are managed through the relevant store account and, unless cancelled, the store continues to charge for them.

Users with a subscription must cancel it from the relevant store account before requesting account deletion:

• iOS: Settings → Apple Account → Subscriptions
• Android: Google Play → Profile → Payments and subscriptions → Subscriptions

If the subscription is not cancelled, the next renewal notification sent by the store may create a new record with the same identifier at the subscription management provider. This is outside the data controller's control. Users who notice that such a record has been created may request its deletion by writing to info@wodturkiye.app.

Users who register again while their subscription is still running may regain Premium access using the purchase restore feature within the application. Other data belonging to the deleted account (scores, posts, following relationships and similar) cannot be restored.

9. USER RIGHTS

9.1 Core rights for all users

Regardless of their place of residence, all users have the following rights:

1. Right of access — To learn whether personal data is processed and to request a copy of it
2. Right to rectification — To request the correction of data processed incompletely or inaccurately
3. Right to erasure — To request the deletion of personal data, subject to statutory exceptions
4. Right to data portability — To request the transfer of data in a structured, machine-readable format
5. Right to restriction and to object — To object to particular processing activities
6. Right to withdraw explicit consent — Explicit consent given may be withdrawn; withdrawal takes effect for the future and does not render past processing unlawful
7. Right to object to automated decisions — To object to analysis carried out through automated systems
8. Right to complain to a supervisory authority — To apply to the relevant data protection authority

9.2 In-application data download

To make the exercise of the right to data portability easier, an automated flow is offered within the application: Settings → Account → Download My Data. When the request is ready, the user is informed by notification and can access the download link. The data is prepared as a compressed archive containing table files together with the relevant media links; the link is valid for a limited time.

Data included in the automated package:

1. Profile information (first name, surname, gender, date of birth, biography, country, registration date)
2. WOD scores, personal records and benchmark results
3. Posts, comments, likes and reactions
4. Team WOD partner requests, following relationships and blocking records
5. Subscription records and notification history
6. The list of uploaded media files and access links
7. The artificial intelligence pre-analysis produced during registration

Data not included in the automated package: email address, workout-based artificial intelligence analysis outputs, legal document consent and explicit consent records, device records and anonymised analytics data.

The in-application download feature is a convenience tool and does not replace the rights set out above. All rights, including requests concerning data not included in the automated package, may be exercised through the channel in Section 9.3.

9.3 Formal exercise of rights

For users who do not wish to use the in-application route or who wish to exercise their other rights, the channels are:

1. Email: info@wodturkiye.app
2. In writing: a signed petition sent to the registered address

The request is processed once the user's identity has been verified.

9.4 Response times

9.5 Additional rights for users in the European Union, the European Economic Area, Switzerland and the United Kingdom

1. Solely automated decision-making (GDPR Article 22) — No decision based solely on automated processing and producing legal or similarly significant effects on the user is taken. See Section 11 for details.
2. Right to object to marketing (GDPR Article 21(2)) — No marketing is currently carried out; should it be carried out in future, explicit consent will be obtained and a withdrawal mechanism provided.
3. Right to complain to a supervisory authority (GDPR Article 77) — An application may be made to the data protection authority of the member state of residence.
4. Contact channel for data protection requests — Users in the European Union and the United Kingdom may send data protection requests to info@wodturkiye.app; requests are concluded within the periods set out in Section 9.4.

9.6 Additional rights for California users

Under the CCPA and CPRA, California residents have the following rights:

1. Right to know — Information about the categories of personal information collected, their sources, the purposes of sharing and the recipients
2. Right to delete
3. Right to correct
4. Right to opt out of sale or sharing — WOD Türkiye does not sell personal data and does not share personal data for behavioural advertising purposes. For situations that require assessment under the CCPA's broad definitions of sale and sharing, an objection may be made through info@wodturkiye.app.
5. Right to non-discrimination — No different treatment is applied and service quality is not reduced because these rights have been exercised.
6. Right to apply through an authorised agent

CCPA categories collected: Category A (identifiers — email address, account identifier), Category B (customer records — profile information), Category D (commercial information — subscription status), Category F (internet activity — in-application interaction and analytics).

Complaint authority: California Privacy Protection Agency — cppa.ca.gov

9.7 KVKK rights for users in Türkiye

The rights under KVKK Article 11 and the details of the application procedure are set out in the KVKK Information Notice.

Where an application is rejected, the response given is found insufficient, or no response is given within thirty days, the person concerned may lodge a complaint with the Personal Data Protection Board within thirty (30) days of learning of the data controller's response and in any event within sixty (60) days of the date of application.

10. CHILD USERS

WOD Türkiye serves only users who are 18 years of age or older. The date of birth is taken at registration on the basis of the user's declaration. Accounts found to belong to persons under 18 are closed and the related personal data is deleted.

Because the age limit is 18:

1. COPPA (USA, under 13) does not apply; the Service is not designed for children.
2. GDPR Article 8 (parental consent for ages 13–16) does not apply.
3. California Business and Professions Code § 22581 (right of removal for those under 18) does not apply directly; equivalent protection is already provided under the right to erasure in KVKK Article 11 and GDPR Article 17.

11. AUTOMATED PROCESSING, PROFILING AND LEADERBOARD SYSTEMS

Performance leaderboards, personal record tracking mechanisms and the artificial intelligence analysis serve only gamification, motivation, entertainment and information purposes; they are not a decision mechanism producing legal, commercial or similarly significant effects on the user. Although these systems may amount to profiling within the meaning of GDPR Article 22, they do not run automated decision mechanisms of the kind covered by that Article.

These systems do not determine or affect the user's eligibility for the Service, subscription pricing, access to the Service or the privileges available within it. The artificial intelligence analysis makes no medical, legal or financial assessment.

Privacy controls offered within the application:

Visibility on the leaderboard. Setting profile visibility to "Only me" does not prevent the user's name and scores from appearing on the leaderboard; that setting only closes the profile page to other users. Users who do not wish to appear on the leaderboard may request removal from the leaderboard records by writing to info@wodturkiye.app; such requests are concluded within thirty (30) days at the latest. If the account is deleted, all scores and leaderboard records are deleted as well.

The user has the right to object to analysis carried out through automated systems. Objections are assessed individually through info@wodturkiye.app.

12. THIRD-PARTY LINKS AND EMBEDDED CONTENT

The website or the application may contain links to third-party sites or embedded content (for example GIF search results). The privacy policies of those third parties apply and they are not under the data controller's direct control. When embedded components are used or embedded content is displayed (for example GIFs in comments), the relevant search queries and server request metadata are transmitted directly to the third-party service provider. Users are advised to review the privacy policies of the relevant third parties.

13. DATA SECURITY

The following technical and organisational measures are applied for the security of personal data:

1. TLS 1.2 or above encryption in transit; encryption of data at rest on the server side
2. Storage of passwords as one-way cryptographic hashes
3. Role-based access control and two-factor authentication for the administration panel
4. Row-level access control isolating users' data from one another
5. Regular security audits and logging
6. Contractual assurance of data processing obligations in sub-processor agreements

No internet service can offer absolute security; the data controller takes all reasonable measures within the framework of good industry practice.

14. DATA BREACH NOTIFICATION

Where a data breach or unauthorised access is detected, the incident is assessed and contained immediately. Notification is made to the competent authorities in accordance with the KVKK, the GDPR and other relevant legislation; the seventy-two-hour notification framework under GDPR Article 33 applies. In breaches carrying a high risk, affected users are also notified in accordance with GDPR Article 34.

15. PRIVACY BY DESIGN

Data minimisation, privacy by default and data protection principles are taken into account in product design and development processes. A Data Protection Impact Assessment (GDPR Article 35) is carried out where necessary when new features are added.

16. INTERNATIONAL USERS

WOD Türkiye is accessible globally; however, its operation is carried out by a data controller located in Türkiye. By using the Service, it is accepted that data may be transferred to Türkiye and to the other jurisdictions listed in Section 6 of this Policy. Where local legislation provides more restrictive protection, the relevant local rights are reserved.

17. CHANGES TO THIS POLICY

This Policy may be revised in the event of legislative changes, an expansion of the scope of the Service or an update to the purposes of processing. In the event of a material change, notification is given by in-application notice or by email a reasonable time before the effective date. The notice period may be shortened where urgent legal compliance or security requirements arise.

The current English version is available at wodturkiye.app/en/privacy and the Turkish version at wodturkiye.app/privacy.

18. CONTACT

19. LANGUAGE AND INTERPRETATION

This Policy is published in Turkish and English. In the event of any conflict or difference of interpretation between the two versions, the Turkish version prevails.

Version: 1.0 · Effective Date: 7 September 2026 Data Controller: Ali İhsan Gökalp · Contact: info@wodturkiye.app