Privacy Policy

The protection of your personal data and your privacy is an important matter for Hikmet Gürbüz, Maya Yoga Sole Proprietorship (“Maya Yoga”). In order to ensure compliance with the European Union General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”), Maya Yoga adopts the principles set out in these legal regulations and acts with the utmost care in fulfilling its obligations regarding the lawful processing of personal data, data retention periods, deletion, destruction, anonymization, transfer, informing data subjects, and ensuring data security.

This Privacy Policy explains the information regarding the personal data collected through our website www.mayayoga.com.tr
(“Website”), mobile application, and other related electronic platforms, and how such data is used within the scope of the purposes stated above.

a. Methods and Legal Grounds for Collecting Personal Data

Your personal data may be collected verbally, in writing, or electronically through Maya Yoga’s website, mobile applications, social media accounts, call center, cookies, notifications received from official authorities, and communication channels.

Accordingly, the personal information you provide while registering on Maya Yoga’s website and mobile applications; data collected when necessary to adapt our website, mobile applications, and services to user needs and to eliminate technical issues (even if such data does not constitute personal data); data related to your electronic devices that cannot be directly matched with you (such as location data); and data collected through cookies are subject to this collection process.

Such data is collected in accordance with the personal data processing conditions specified under GDPR and Law No. 6698, limited to the legal grounds and purposes stated in this Privacy Policy.

b. Collected Personal Data

Maya Yoga collects the following types of data through its website or mobile applications:

Personal data provided during membership registration:
Name and surname, Turkish ID number, address, location information (country/city/district of residence), date of birth, email address, mobile and landline phone numbers, registered electronic mail (KEP) address (if any), IP address, username and password, photograph.

Personal data provided during the purchase of services/packages:
Type of service/package, bank and credit card information (bank account number, IBAN, credit card number, expiration date, security code, etc.), tax office and invoice details, signature.

Data not provided directly by you:
Non-personal data collected by Maya Yoga for infrastructure improvement purposes and behavioral data collected by third parties where applicable.

c. Purposes of Processing Personal Data

Your personal data is collected for the following purposes:

Enabling membership processes and facilitating product sales via the website and mobile applications

Processing online visitor and user data in accordance with KVKK

Improving existing services, developing new services, and informing you about them

Resolving user/customer complaints and providing effective customer support

Contacting users/customers when necessary and with consent, and improving user experience on the website and mobile applications

Conducting promotional and marketing activities for products and services within the scope of contractual relationships and user preferences, subject to consent

Determining Maya Yoga’s commercial strategies

Responding to information and document requests from administrative and judicial authorities

Ensuring information and transaction security and preventing misuse

Keeping personal data accurate and up to date and ensuring compliance with KVKK

Carrying out and monitoring accounting and financial transactions

Ensuring the security of financial information provided by you

Sharing legal and regulatory information with you

Creating databases through anonymized statistical analyses and using them for market research purposes

d. Credit Card and Mail-Order Information

Your credit card and confidential financial information may be stored by Maya Yoga in accordance with GDPR, KVKK, and this Privacy Policy only if you explicitly request such storage. Otherwise, such information is not stored in our systems.

Identity and credit card information sent via mail-order is stored in accordance with confidentiality principles. This information is retained for 60 (sixty) days to address potential bank disputes related to credit card transactions and is then destroyed. Since you may dispute any unauthorized charges directly with your bank, the approved mail-order form submitted to Maya Yoga does not pose any additional risk.

e. Measures Taken to Protect Personal Data

Maya Yoga takes all necessary technical and administrative measures to ensure the confidentiality, integrity, and security of your personal data.

In this context, the following measures are implemented to prevent unauthorized access, misuse, unlawful processing, disclosure, alteration, or destruction of personal data:

All areas where personal data is collected are protected by generally accepted security technologies such as firewalls and Secure Socket Layer (SSL) encryption

Personal data is transmitted using SSL encryption

Employee access rights to personal data are regularly monitored; penetration tests are conducted periodically to prevent unauthorized access

Cryptographic (encryption) methods are used in systems where personal data is stored, and access is limited to authorized personnel only

Personal data is kept in physical form only when necessary and stored in locked and secure environments with restricted access

Personal or behavioral data processed via third-party cookies is deleted from third-party systems upon termination of membership

In the event of cyberattacks resulting in data breaches, Maya Yoga promptly notifies affected users and the Personal Data Protection Authority and takes all necessary measures

f. Transfer of Personal Data

Maya Yoga may transfer your personal data to third parties solely for the purposes stated in this Privacy Policy and in accordance with Articles 8 and 9 of KVKK.

Accordingly, user/customer data and invoice recipient information may be shared with cargo or postal service providers for the purpose of delivering physical invoices.

For customer satisfaction purposes, only anonymized data may be shared with market research companies.

Personal data or traffic information may also be shared with administrative or judicial authorities only in the event of an official request, in line with legal obligations. In such cases, the user/customer is promptly informed.

g. Your Rights Regarding Personal Data

Pursuant to Article 11 of KVKK, you have the following rights regarding your personal data processed by Maya Yoga:

To learn whether your personal data is being processed

To request information if your personal data has been processed

To learn the purpose of data processing and whether it is used in accordance with that purpose

To know the third parties to whom your data is transferred domestically or abroad

To request correction of incomplete or inaccurate data

To request deletion or destruction of personal data under Article 7 of KVKK

To request notification of correction or deletion actions to third parties

To object to outcomes resulting solely from automated data processing

To claim compensation for damages arising from unlawful processing

If you notify Maya Yoga that you do not wish your personal data to be retained, data that is not legally required for contractual obligations or mandatory retention periods will be deleted.

h. Retention Periods, Deletion, Destruction, and Anonymization

Maya Yoga stores personal data processed via its website and mobile applications for the periods stipulated under KVKK Articles 7 and 17 and Turkish Penal Code Article 138, or as required by processing purposes.

Upon expiration of such periods, data is deleted, destroyed, or anonymized in accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

Deletion means rendering personal data inaccessible and unusable.
Destruction means rendering personal data permanently irretrievable.
Anonymization means ensuring that data cannot be associated with an identifiable individual, even when combined with other data.

Regular (periodic) destruction is carried out every 6 months as specified in this Privacy Policy.

i. Blocking Electronic Communications

You may opt out of informational messages sent via Maya Yoga’s website or mobile application at any time by using the methods specified in such communications.

j. Amendments to the Privacy Policy

Maya Yoga reserves the right to amend or update this Privacy Policy at any time without prior notice. Any changes shall become effective as of the date they are published on the website.