At CourtyCLUB, we are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the CourtyCLUB application.

1. Data Controller

• Company: CourtyCLUB
• Contact: info@courty.club
• Website: courty.club

2. Personal Data We Collect

2.1 Identity and Contact Data

• First name and last name
• Email address
• Phone number
• City / region

2.2 Profile and Application Data

• Profile photo
• Sport level and playing preferences
• Reservation history
• Ratings and reviews
• In-platform message content
• Tournament participation and results
• Match and partner matching data
• Friend relationships and player connections
• Block and report records

2.3 Technical and Usage Data

• Device identifier
• IP address
• Application session data
• Error logs
• Usage statistics and analytics

2.4 Club and Coach Data (Role-Specific)

• Club name, address and contact information
• Court specifications and pricing
• Operating hours and availability
• Coach certifications and areas of expertise

3. Purposes and Legal Bases for Processing

3.1 Performance of Contract (KVKK Art. 5/2-c | GDPR Art. 6/1-b)

• Account creation and management
• Processing reservations and bookings
• Payment and credit transactions
• Customer support

3.2 Legitimate Interest (KVKK Art. 5/2-f | GDPR Art. 6/1-f)

• Ensuring platform security
• Fraud prevention and abuse detection
• Service quality measurement and improvement
• Technical error detection and resolution

3.3 Legal Obligation (KVKK Art. 5/2-ç | GDPR Art. 6/1-c)

• Compliance with applicable laws and regulations
• Responding to lawful requests from authorities

3.4 Explicit Consent (KVKK Art. 5/1 | GDPR Art. 6/1-a)

• Marketing and promotional communications (optional)
• Transfer of personal data to third countries (obtained separately)

4. International Data Transfers

Your personal data is transferred to servers operated by Supabase Inc. to provide the technical infrastructure of the CourtyCLUB application.

• Recipient: Supabase Inc.
• Registered Office: 970 Toa Payoh North #07-04, Singapore 318992 (Operations: San Francisco, CA, USA)
• Server Location: European Union — Germany / Frankfurt (eu-central-1)
• Transfer Safeguards: EU Standard Contractual Clauses (SCCs), Full GDPR compliance, SOC 2 Type II, ISO 27001

Your explicit consent for this transfer is obtained separately during the registration process, in compliance with KVKK Article 9.

5. Domestic Data Sharing

• Clubs and coaches with whom you make reservations (booking and communication data)
• Payment service providers (payment transaction data, minimum necessary scope)
• Competent public authorities (only when required by law)

6. Data Retention Periods

• Account data: Duration of active account + 3 years
• Reservation/payment records: 10 years (Turkish Commercial Code Art. 82)
• Messaging data: 3 years
• Log and technical data: 2 years
• Marketing consent: Until consent is withdrawn

7. Data Security

Technical Measures

• End-to-end SSL/TLS encryption (data transmission)
• AES-256 encryption (database storage)
• JWT-based secure authentication
• Role-based access control (RBAC)
• Web application firewall (WAF) and intrusion detection
• Regular security testing and penetration testing

Administrative Measures

• Staff privacy training and confidentiality agreements
• Data breach notification procedures (72-hour rule)
• Vendor security assessments
• Periodic data protection audits

8. Your Rights

8.1 Rights under Turkish KVKK (Article 11)

• a) Right to learn whether your personal data is being processed
• b) Right to request information about processed data
• c) Right to learn the purpose of processing
• d) Right to learn the third parties to whom data is transferred
• e) Right to request correction of inaccurate or incomplete data
• f) Right to request deletion or destruction of data (KVKK Art. 7)
• g) Right to request notification of corrections/deletions to third parties
• h) Right to object to results of automated processing systems
• i) Right to claim compensation for damages arising from unlawful processing

8.2 Rights under GDPR (for EU/EEA residents)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Rights related to automated decision-making (Art. 22)
• Right to withdraw consent at any time (Art. 7/3)

9. How to Exercise Your Rights

Your request should include: full name, identity/passport number, contact details, the service used, and a clear description of your request.

Under KVKK, your request will be processed free of charge within a maximum of 30 (thirty) days.

If your request is rejected, the response is deemed insufficient, or no response is received within the statutory period, you have the right to file a complaint with the Personal Data Protection Authority of Turkey (KVKK Kurumu) at www.kvkk.gov.tr or your national Data Protection Authority (for EU/EEA residents).

10. Cookies and Tracking

The CourtyCLUB mobile application does not use browser cookies. Session management is performed via secure JWT tokens. Anonymous usage analytics may be collected to improve service performance.

11. Children's Privacy

The CourtyCLUB platform is not directed to children under the age of 13. Users between 13 and 18 years of age may only use the platform with parental or guardian consent. If we become aware that personal data of a child has been collected without appropriate consent, we will delete it promptly.

12. Changes to This Policy

CourtyCLUB reserves the right to update this Privacy Policy in response to changes in applicable laws or platform functionality. Material changes will be communicated via in-app notification and/or email to your registered address before taking effect.

13. Governing Law

This Privacy Policy is governed by Turkish Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

For disputes: Istanbul Courts and Enforcement Offices (Turkey)

For EU residents: Your local Data Protection Authority

14. Contact

For any questions, complaints or requests regarding this Privacy Policy:

© 2025 CourtyCLUB. All rights reserved. This document is prepared pursuant to Turkish Law No. 6698 (KVKK) and EU GDPR.