Privacy notice on the processing of personal data

This English version is provided for information only. In case of any discrepancy, the Turkish text prevails.

As HSA Sportif Yatırımlar Sanayi ve Ticaret A.Ş., we take measures to protect your personal data under the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”). In our capacity as “data controller”, we process your personal data for the purposes and by the methods explained below, in accordance with the KVKK and the related legislation.

Data controller: HSA Sportif Yatırımlar Sanayi ve Ticaret A.Ş. (Kent Paten)
MERSİS (central registry) no.: 1-6788-5749-7461676
Address: Oran Mahallesi, 631. Cad., Buz Pateni Apt., No: 5, 06550 Çankaya/Ankara, Türkiye
E-mail: bilgi@kentpaten.com

This Customer Information Notice has been prepared pursuant to Article 10 of the KVKK (“Data Controller’s Obligation to Inform”) in order to inform you as transparently as possible about the identity of the data controller, the method and legal grounds of collecting your personal data, the purposes for which it is processed, to whom and for what purposes it may be transferred, the retention period, and your rights listed in Article 11 of the KVKK.

This notice has been prepared to fulfil our obligation to inform regarding the processing, by our Company and under the KVKK and other related legislation, of personal data obtained from our customers over the age of 18 who take part in sports (ice skating) activities and from the legal representatives of our customers under the age of 18.

1. Collection and Processing of Your Personal Data and Purposes of Processing

a. Personal Data We Process

Your personal data is processed securely and in accordance with the KVKK. In this context, the personal data listed in the table below is collected:

Data category	Personal data
Identity	Name, surname, date of birth, gender, nationality; Turkish ID number where an invoice must be issued; mother’s and father’s names for course registration.
Contact	Telephone number, address
Physical Premises Security	Security camera audio and video recordings, made 24/7 for security purposes
Visual and Audio Recordings	Photographs, audio and video recordings
Health Information	The note from a family physician stating that “there is no objection to doing sports”, requested when registering for athlete courses, private lessons and group lessons.

b. Purposes of Processing Your Personal Data

Your personal data and special categories of personal data obtained as described above are processed for the following purposes:

• Carrying out the relevant activities and the registration process in accordance with the legislation,
• Following up requests and complaints and carrying out document registration activities,
• Managing, auditing and reporting business processes,
• Evaluating requests and complaints to ensure the satisfaction of our members and customers,
• Using data for statistical purposes after anonymisation or digitisation,
• Contacting our members and customers as part of communication activities,
• Responding to requests from competent authorities,
• Carrying out inspection and/or regulatory duties of the competent public institutions and organisations,
• Ensuring security at our facility,
• Following up and conducting legal proceedings, including applying to the competent judicial and administrative authorities and filing complaints or criminal complaints where the rules are broken or damage is caused,
• Carrying out advertising, promotion, campaign and marketing activities,
• Fulfilling obligations arising from tax legislation, such as issuing invoices,
• Confirming that the health condition is suitable for participation in sports activities,
• Informing you about the products and services offered by our Company and helping you benefit from them,
• Informing you about our services and providing explanations when necessary.

Your personal data is processed only for and limited to these purposes.

c. Method and Legal Grounds of Collection

Your personal data is collected from the information and documents you provide to us in writing, verbally or electronically during and/or after your membership, course and lesson registration and in the entry and consent form you complete when entering a public session, and through the security cameras at our facility, which record audio and video 24 hours a day, 7 days a week for security purposes. This information and these documents may also include special categories of personal data such as health information, and are stored physically and electronically. Your personal data is processed for the purposes set out in this Notice, in accordance with the basic principles of the KVKK and within the conditions for processing personal data set out in Articles 5 and 6 of the KVKK.

Your personal data is processed for the purposes stated above on the basis of the following legal grounds set out in Article 5(2) of the KVKK:

1. It is expressly provided for by law,
2. Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract,
3. It is mandatory for the data controller to fulfil its legal obligation,
4. Processing is mandatory for the establishment, exercise or protection of a right,
5. Processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your health data is processed on the basis of your explicit consent, obtained separately during registration, pursuant to Article 6 of the KVKK.

2. Transfer of Your Personal Data

Having taken all technical and administrative measures necessary to ensure an appropriate level of security under the KVKK and the related legislation, your personal data may be transferred:

• to legally authorised public institutions and organisations, upon their request and limited to the purpose of the request,
• for the performance and continuity of public services,
• to the competent judicial and administrative authorities, in complaints and criminal complaints, for conducting legal proceedings and protecting our rights,

within the framework of the conditions for processing personal data set out in Article 8 of the KVKK.

As a rule, your personal data is not transferred abroad. However, if you contact us through communication channels based abroad, such as WhatsApp or Instagram, the information you share may be processed on these service providers’ servers abroad. In that case, the transfer is carried out in accordance with the conditions set out in Article 9 of the KVKK.

3. Processing and Retention Period

Your personal data will be processed by our Company, limited to the purposes set out in this Notice, in compliance with the processing and limitation periods set out in all relevant laws and other legislation. If the statutory processing periods change, the new periods will apply.

Audio and video recording is carried out at our facility 24 hours a day, 7 days a week for security purposes. Audio and video recordings made for security purposes are processed solely to ensure the safety and security of the facility, its users and its staff; they are not used for promotional or any other purpose. No recording takes place in toilets or changing cubicles. These recordings are kept for a maximum of 120 days and are deleted at the end of this period. Public skating entry and consent forms are completed on paper, kept physically and destroyed after at most 1 year. The name and phone number you give us to reserve a product in our sports shop are kept for at most 30 days after the reservation ends and are then deleted.

In line with the principle of purpose limitation, your personal data is processed only for as long as necessary to fulfil the purposes explained in this Notice, in accordance with the State Archive Services legislation and in any case within the statutory periods under Article 7 of the KVKK; once these periods expire, it is deleted, destroyed or anonymised.

4. Your Rights Regarding the Processing of Personal Data

Under Article 11 of the KVKK, you may apply to our Company with the following requests:

1. To learn whether your personal data is processed and, if so, to request information about it,
2. To learn the purpose of processing your personal data and whether it is used in line with that purpose,
3. To know the third parties in Türkiye or abroad to whom your personal data is transferred,
4. To request the correction of your personal data if it is incomplete or inaccurately processed,
5. To request the deletion, destruction or anonymisation of your personal data if the reasons requiring its processing no longer exist, within the scope of Article 7 of the KVKK,
6. To request that the actions taken under (d) and (e) be notified to the third parties to whom your personal data has been transferred,
7. To object to a result against you arising from the analysis of the processed data exclusively through automated systems,
8. To claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.

5. Right to Apply

As a data subject, you may submit your requests regarding your rights to our Company by e-mail to bilgi@kentpaten.com, in writing to Oran Mahallesi, 631. Cad., Buz Pateni Apt., No: 5, 06550 Çankaya/Ankara, Türkiye, or by other methods determined by the Personal Data Protection Board.

For a request to be made by a person other than the data subject, a notarised special power of attorney issued by the data subject in the name of the applicant is required.

If finalising your request incurs an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If the response is provided on a recording medium such as a CD or flash drive, a fee not exceeding the cost of the medium may be requested.

To verify whether the applicant is the data subject, our Company may request information from the applicant and may ask questions about the application to clarify the matters stated in it.

6. Responding to Your Applications

Your requests regarding your personal data are evaluated and answered as soon as possible and within 30 days at the latest from the date they reach our Company. Whether your request is accepted or rejected with reasons, our response is sent to the address you specified, primarily by post or e-mail as indicated in the application form, and/or, where possible, by the same method in which your request was made.

7. Our Website and Cookies

Our website kentpaten.com does not collect personal data from visitors through membership. Only the cookies that are strictly necessary for the website to work (e.g. the “kp_consent” cookie that remembers your cookie choice) are used automatically; any other cookies are used only with your explicit consent.

The message you send us via the “Report a problem / share feedback” form on our website, and the e-mail address you optionally share, are processed only to evaluate your report and to get back to you when necessary. Your IP address is not recorded through this form. These messages are deleted automatically after 1 year.

The Google Maps map on our website is third-party content provided by Google and is loaded only if you allow it through the cookie banner on our website or the “Show the map” button in the map area. When the map is loaded, technical information such as your IP address may be sent to Google, and Google may use its own cookies. For more information, you can review Google’s privacy policy.

The images of the Instagram posts on our website are served from our own server; when you click a post, you are taken to Instagram, which is operated by Meta.

You can change your cookie choice or withdraw your consent at any time via the “Cookie preferences” link at the bottom of the website. You can also block or delete cookies in your browser settings.