MerkezKort Privacy Policy

Last Updated: March 15, 2026

At MerkezKort, we place great importance on the security and privacy of your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the principles of the EU General Data Protection Regulation ("GDPR"). This Privacy Policy explains how personal data collected through our website merkezkort.com.tr and our cloud-based tennis club management software service at app.merkezkort.com.tr is processed, protected, and what your rights are.

---

1. Data Controller

In accordance with the KVKK, the data controller is:

• Name: Alho Yazılım ve Ticaret Limited Şirketi
• Address: Ankara, Turkiye
• Email: info@merkezkort.com.tr
• Phone: +90 554 566 10 15
• Website: merkezkort.com.tr
• Application: app.merkezkort.com.tr

---

2. Personal Data We Collect

We process the following categories of personal data to provide and improve our services:

2.1 Identity Information

• First name and last name
• Turkish ID number (only for invoicing purposes)

2.2 Contact Information

• Email address
• Phone number
• Company/club address

2.3 Account Information

• Username
• Password (stored in encrypted form)
• Profile photo (optional)
• Account preferences and settings

2.4 Financial Information

• Billing address
• Payment method details (credit card information is not stored directly by us; it is processed through our payment infrastructure provider)
• Billing history and subscription information

2.5 Usage Data

• Service usage history and interaction data
• Feature usage statistics
• Session durations and frequencies
• Club member records, court reservations, lesson schedules, and other service content

2.6 Technical Data

• IP address
• Browser type and version
• Operating system
• Device type and unique device identifiers
• Screen resolution
• Language preference

2.7 Location Information

• General location information (IP address-based)
• Device location data (only with your explicit consent)

2.8 Cookie and Tracking Data

• Data collected through cookies and similar tracking technologies (see Section 10 for details)

---

3. Purposes of Processing Personal Data

Collected personal data is processed for the following purposes:

3.1 Service Provision

• Providing and operating the cloud-based tennis club management software
• Creating and managing user accounts
• Delivering court reservation, member management, lesson scheduling, and other core service functions
• Processing subscription transactions and billing
• Providing customer support services

3.2 Communication

• Informing you about service statuses, updates, and changes
• Technical support and customer service communication
• Marketing and promotional communication with your explicit consent

3.3 Analytics and Improvement

• Monitoring and improving service performance
• Enhancing user experience
• Analyzing usage trends
• Planning and developing new features

3.4 Security

• Ensuring account security and preventing unauthorized access
• Detecting and preventing fraud and misuse
• Ensuring system security and protection against cyber attacks
• Investigating and reporting security incidents

3.5 Legal Obligations

• Fulfilling legal obligations arising from applicable legislation
• Providing information to authorized public institutions and organizations
• Meeting accounting and tax obligations
• Use as evidence in legal disputes

---

4. Legal Basis for Processing Personal Data

Your personal data is processed based on the following legal grounds under Articles 5 and 6 of the KVKK, and in alignment with GDPR principles:

4.1 Explicit Consent (KVKK Art. 5/1; GDPR Art. 6/1-a)

• Communication for marketing and advertising purposes
• Processing of location information
• Data collection through cookies and tracking technologies (except strictly necessary cookies)

4.2 Performance of a Contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b)

• Establishment and fulfillment of the service agreement
• Processing of subscription and payment transactions
• Provision of customer support services
• Account creation and management

4.3 Legal Obligation (KVKK Art. 5/2-c; GDPR Art. 6/1-c)

• Obligations under tax legislation
• Requirements under the Law No. 6563 on the Regulation of Electronic Commerce
• Maintaining log records under Law No. 5651
• Obligations arising from other applicable legislation

4.4 Legitimate Interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f)

• Improving and enhancing service quality
• Ensuring system security
• Preventing fraud and misuse
• Business process and reporting analyses

---

5. Third-Party Services

We work with the following third-party service providers to deliver and improve our services. These providers access your personal data only for the stated purposes and by taking necessary security measures:

5.1 Cloud Storage and Infrastructure

• Server hosting and data storage services
• Storage, database management, and processing power provision

5.2 Analytics Tools

• Google Analytics and similar web/application analytics tools
• User behavior analysis tools
• Performance monitoring and error reporting tools

5.3 Payment Infrastructure

• Secure payment processing services (PCI DSS compliant)
• Credit card information is not stored directly by us; it is processed through the payment infrastructure provider

5.4 Email and Notification Services

• Transactional email delivery services
• Push notification services (mobile application notifications)
• SMS notification services

5.5 Customer Support

• Live support and contact management tools

The selection of third-party service providers takes into account KVKK compliance, data security practices, and conformity with international data protection standards including GDPR requirements.

---

6. Transfer of Personal Data

6.1 Domestic Transfers

Your personal data may be transferred to the following parties within the scope of Article 8 of the KVKK and for the purposes stated above:

• Business partners and service providers
• Legal advisors and auditors
• Authorized public institutions and organizations (in case of legal obligation)
• Payment institutions and banks

6.2 International Transfers

Your personal data may be transferred abroad under Article 9 of the KVKK, to countries with adequate protection or with your explicit consent. In cases of international transfer:

• Appropriate security measures are taken through data processing agreements
• Data protection legislation and practices in the receiving country are evaluated
• Actions are taken in compliance with GDPR standards
• Adequate data protection levels are required in countries where cloud infrastructure providers' data centers are located

International transfers are carried out in compliance with both KVKK and GDPR requirements, including the use of Standard Contractual Clauses (SCCs) where applicable.

---

7. Data Retention Periods

Your personal data is retained for the duration required by the processing purpose and within the mandatory retention periods prescribed by applicable legislation:

Data Category	Retention Period
Account information	As long as the account is active, plus 3 years after account closure
Transaction and billing information	10 years from the date of the relevant transaction (Tax Procedure Law)
Communication records	3 years from the date of last communication
Log records	2 years as required by Law No. 5651
Cookie data	30 days to 2 years depending on cookie type
Marketing communication data	Until withdrawal of explicit consent
Customer support records	3 years from the date of last interaction

Personal data whose retention period has expired is deleted, destroyed, or anonymized in accordance with Article 7 of the KVKK.

---

8. Data Subject Rights

Under Article 11 of the KVKK and in alignment with GDPR Articles 15-22, as a data subject, you have the following rights:

1. Right to information: To learn whether your personal data is being processed
2. Right of access: To request information regarding processed personal data
3. Right to rectification: To request correction of incomplete or inaccurate personal data
4. Right to erasure/destruction: To request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK
5. Right to data portability: To request that processed data be transmitted to third parties in a structured, commonly used, and machine-readable format
6. Right to notification of third parties: To request that rectification or deletion operations be notified to third parties to whom personal data has been transferred
7. Right to object to automated decision-making: To object to outcomes arising from the analysis of processed data exclusively through automated systems
8. Right to compensation: To claim compensation for damages arising from unlawful processing of personal data

How to Apply

You may exercise your rights through any of the following methods:

• Email: Written application with identity verification to info@merkezkort.com.tr
• Mail: Notarized or registered letter to Ankara, Turkiye
• In-app: Through the account settings section at app.merkezkort.com.tr

Your applications will be finalized free of charge within 30 (thirty) days at the latest. However, if the process requires additional costs, fees may be charged according to the tariff determined by the Personal Data Protection Board.

If you find the response to your KVKK application insufficient, or if you do not receive a response within 30 days, you have the right to file a complaint with the Personal Data Protection Board (KVKK). For individuals within the EU, you may also lodge a complaint with the relevant supervisory authority under the GDPR.

---

9. Children's Privacy

MerkezKort services are not directly targeted at individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If, as a parent or legal guardian, you realize that your child has shared personal data with us, please contact us. If such data collection is identified, the relevant data will be deleted immediately.

For tennis club members under the age of 18, the processing of relevant data is subject to the explicit consent of the parent or legal guardian, in accordance with both KVKK and GDPR requirements.

---

10. Cookie Policy

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. Cookies are used for the proper functioning of our website, ensuring security, improving user experience, and collecting analytical data.

10.2 Types of Cookies Used

Cookie Type	Purpose	Duration
Strictly Necessary Cookies	Core website functionality, session management, security	Session duration
Functional Cookies	Remembering user preferences such as language preference and display settings	1 year
Analytics Cookies	Visitor statistics, page views, usage analysis	2 years
Marketing Cookies	Targeted advertising and marketing activities	1 year

10.3 Cookie Preferences

You can manage, block, or delete cookies from your browser settings. However, blocking strictly necessary cookies may prevent some features of our website from functioning properly.

A cookie consent banner is displayed on your first visit to our website to allow you to set your cookie preferences. You can update your preferences at any time.

---

11. Security Measures

The following technical and administrative measures are taken to ensure the security of your personal data:

11.1 Technical Measures

• Data transmission security with SSL/TLS encryption
• Encrypted data storage (AES-256)
• Regular security scans and penetration tests
• Firewall and intrusion detection/prevention systems
• Access control mechanisms and multi-factor authentication
• Regular backup and disaster recovery plans
• Timely application of security patches

11.2 Administrative Measures

• Regular data security training for employees
• Authorization restrictions for access to personal data (principle of least privilege)
• Data processing inventories and recording systems
• Regular auditing of third-party service providers
• Establishment of data breach notification procedures
• Signing of confidentiality agreements

---

12. Policy Changes

This Privacy Policy may be modified in the event of legal regulatory changes, service changes, or updates to our business processes. After changes are made, the current policy will be published at merkezkort.com.tr/privacy and the "Last Updated" date will be revised.

In the event of significant changes, registered users will be informed in advance via email or through in-app notifications.

Your continued use of our services constitutes your acceptance of the updated Privacy Policy.

---

13. Contact

For questions, requests, or complaints regarding our Privacy Policy or the processing of your personal data, you can reach us through the following channels:

• Email: info@merkezkort.com.tr
• Phone: +90 554 566 10 15
• Address: Ankara, Turkiye
• Web: merkezkort.com.tr

For information about the Personal Data Protection Authority and to file a complaint: kvkk.gov.tr

For EU residents, you may also contact the relevant data protection supervisory authority in your country of residence.

---

14. Effective Date

This Privacy Policy became effective on March 15, 2026.