User Privacy Notice

Privacy Notice Regarding Users' Membership, Service Procurement and/or Corporate Information, Promotion and Commercial Communication Processes

Last Updated: 02 September 2026

1 Data Controller

Your personal data and the personal data of persons for whom you are the parent/guardian/legal representative are processed by the data controller FitxDiet – Online Fitness Services Platform and Web/Mobile Applications ("Company" or "FitxDiet") within the scope of the Personal Data Protection Law No. 6698 ("KVKK") and within the framework of this Privacy Notice.

Scope of This Privacy Notice

Provided by FitxDiet:

  • Online fitness service
  • Fitness programs
  • Creating membership via mobile and web applications
  • Service application, purchase and after-sales support processes
  • Corporate information, promotion and commercial communication activities

explains for what purposes and how the personal data collected within this scope is processed.

The FitxDiet platform https://fitxdiet.com website and/or by accessing via the mobile application and creating a membership on your own behalf or on behalf of persons for whom you are the parent/guardian/legal representative and benefiting from the services, your personal data is processed within the scope of this notice.

2 Legal Status of the Data Controller

This Privacy Notice covers only the personal data processing activities carried out by FitxDiet in its capacity as data controller.

We note that you must submit your requests or complaints regarding the counseling services of the experts providing the service to the expert providing the service directly.

3 Categories of Personal Data Processed and the Purposes and Legal Grounds for Processing Personal Data

3.1. Regarding Users

The categories of personal data processed within the framework of your membership relationship with our Company, along with the purposes and legal grounds for processing this data, are explained below.

Important Note: In accordance with legal regulations, you cannot create a registration or receive services on behalf of persons for whom you are not the parent/guardian/legal representative. Real persons who are of legal age and not restricted must create the membership on their own behalf. Otherwise, any resulting liability belongs to you.
A Explicitly Stipulated in Laws (KVKK 5/2-a)
Categories of Personal Data
Identity (full name) Contact (e-mail, phone, province/district) Customer Transaction (service purchased, invoice information) Finance (payment/bank information)
Data Processing Purposes
  • Fulfillment of legal obligations (issuing invoices, retention, keeping financial records)
  • Reporting commercial electronic message approvals to the Message Management System (İYS)
  • Making tax-related and official notifications
  • Retention and archiving processes
Legal Ground
KVKK 5/2-a (explicitly stipulated in laws)
B Establishment and Performance of the Contract (KVKK 5/2-c)
Categories of Personal Data
Identity Contact Finance Customer Transaction Request/Complaint/Suggestion Transaction Security (IP, log, OTP) Legal Action
Data Processing Purposes
  • Establishment and execution of the Membership and Service Agreement
  • Creation, verification, management, and termination of the membership account
  • Billing, payment, and accounting processes
  • Online expert counseling service provision
  • Service process notifications
  • Matching of users with the most suitable expert being carried out
  • Operation and supervision of services
  • Information security processes
  • Retention and archiving processes
Legal Ground
KVKK 5/2-c (establishment/performance of the contract)
C Legal Obligation (KVKK 5/2-ç)
Categories of Personal Data
Identity Contact Finance Customer Transaction Request/Complaint Transaction Security Legal Action
Data Processing Purposes
  • Making notifications to authorized institutions and organizations
  • Conducting legal dispute processes
  • Retention and archiving activities
Legal Ground
KVKK 5/2-ç (legal obligation)
D Legitimate Interest (KVKK 5/2-f)
Categories of Personal Data
Identity Contact Customer Transaction Request/Complaint Transaction Security Marketing Legal Action
Data Processing Purposes
  • Management of user requests and complaints
  • Improvement of product/service processes
  • Quality control and reporting processes
  • Member satisfaction management
  • Internal audit processes
  • Ethics and abuse investigation processes
  • Compliance with company policies
  • Retention and archiving processes
  • Data security processes
Legal Ground
KVKK 5/2-f (legitimate interest)
E Processes Requiring Explicit Consent (KVKK 5/1)
Categories of Personal Data
Identity Contact Customer Transaction Request/Complaint Marketing Transaction Security
Data Processing Purposes
  • Campaign, advertising, promotion, and promotional messages
  • Profile-based targeting, segmentation, and analysis activities
  • Surveys and satisfaction measurements
  • Digital marketing and social media activities
  • Sending commercial electronic messages
Legal Ground
KVKK 5/1 (explicit consent)
Categories of Personal Data
Data Processing Purposes
  • Matching users with a suitable expert
  • Creating a profile and preparing a personalized nutrition guide
  • Quality management and service improvement
  • Internal audit and reporting processes
  • Retention and archiving activities
Legal Ground
F2 Community (Social Interaction) Data
FitXDiet Community is a social sharing space. The items you create in the community — profile, posts, comments, and photos — are visible to other users by default. It is recommended that you do not publish sensitive or private information you do not wish to share in the community; sharing is done entirely at the user's own discretion.
Categories of Personal Data
Profile

(username/@username, display name, biography, profile photo, username change history)

User Content

(posts, comments, uploaded photos — including before/after images, surveys and votes)

Social Interaction

(likes/votes, following and follower relationships, saved posts, reputation score, badges, leaderboard ranking)

Moderation & Notification

(block records, complaint/report records, notification preferences, device token for push notifications)

Data Processing Purposes
  • Provision of the community service — displaying posts, comments, and interactions
  • Creating the follow feed, notifications, and leaderboard
  • Sending push notifications — follows, comments, likes, mentions, etc.
  • Content moderation, enforcement of community rules, complaint and block management
  • Prevention of abuse, spam, and fraud; service security
  • Service improvement and statistics (aggregated/anonymized)
Data Retention, Visibility, and Deletion
  • Visibility: Your profile and posts are public; the anonymous post option hides your identity from other users.
  • Retention: Content is retained until you delete it or your account is deleted.
  • Deletion: When you delete a post/comment, the content is removed. In the event of an account deletion request, your community content is permanently deleted or removed by being stripped of your identity (anonymized).
  • Exception: Records that must be kept due to moderation and legal obligations (e.g., complaint/violation records) may be retained for the relevant period.
Legal Ground
KVKK 5/2-c (performance of the contract — provision of the community service) KVKK 5/2-f (legitimate interest — moderation, security, prevention of abuse) KVKK 5/1 — explicit consent (public profile and content sharing done at the user's own discretion)
G Live Lesson (Audio/Video Call) Data
The audio and video data processed during the live lesson not recorded or stored; it is processed only for real-time transmission between the parties. The metadata that establishes the connection (session ID, IP address, connection duration) may be stored for a limited time.
Categories of Personal Data
Visual/Auditory Data Transaction Security Identity (User ID)

During the call, the parties' audio and video stream (not recorded, not stored on servers, flows end-to-end between the parties);
Mandatory for establishing the connection: session ID, user ID (UID), IP address, browser/device information, call start/end time and duration.

Data Processing Purposes
  • Performance of the live lesson service (audio/video transmission)
  • Verification of the parties authorized for the call
  • Keeping call participation records (audit log); detection of abuse and rights violations
  • Charging for the service and keeping records of session usage
  • Technical troubleshooting and improving service quality
  • Providing evidence in legal disputes
Legal Ground
KVKK 5/2-c (necessity for the establishment/performance of the contract) KVKK 5/2-ç (fulfillment of legal obligation) KVKK 5/2-f (legitimate interest — detection of abuse) KVKK 5/1 (explicit consent — camera/microphone access is granted via approval in the browser)
Retention Period
  • Audio/video stream: No recording is made; it only flows over the network during real-time transmission.
  • Session metadata (audit log): 10 years after the call is completed (for evidence and audit purposes within the framework of the retention obligations under the Turkish Commercial Code (TTK) and Tax Procedure Law (VUK)).
  • IP / device information: For a reasonable period as required by KVKK No. 6698 and Law No. 5651.
Third-Party Infrastructure

Audio/video transmission Agora.io (Agora Lab, Inc.) is carried out end-to-end encrypted over the infrastructure. Agora is FitxDiet's data processor and does not record, store, or share the call content with third parties; only metadata mandatory for transmission is processed. The transfer falls within the scope of transfer abroad; it is carried out in accordance with the provisions of KVKK 9/6 and with the User's explicit consent.

4 Transfer of Your Personal Data to Third Parties Located Domestically and Abroad

Your personal data processed within the scope of each personal data category specified above may be transferred to the following recipient groups in accordance with Articles 8 and 9 of the KVKK, provided that the legal grounds specified for the relevant data category exist:

a) Suppliers and Service Providers

Information technology service providers, data hosting and cloud service providers, legal advisors, audit and consultancy firms, website and mobile application providers, intermediary service providers

Domestic and/or abroad
b) Banks

For the purpose of carrying out payment, refund, change, and financial transactions

Domestic
c) Business Partners

For the purpose of establishing and maintaining collaborative relationships in service provision

Domestic
e) Shareholders and Group Companies

For the purpose of managing corporate activities and carrying out reporting, audit, and communication processes

Domestic
f) Authorized Public Institutions and Organizations

Institutions such as courts, prosecutors' offices, regulatory-supervisory authorities, the Ministry of Finance, and İYS

Domestic
g) Real-Time Communication Infrastructure Provider (Agora.io)

For audio and video communication in the live lesson service, the Agora Lab, Inc. (Agora.io) infrastructure is used. Data is processed only for real-time transmission; content is not recorded or stored. Transfer abroad takes place with the User's explicit consent and in accordance with KVKK 9. Agora's privacy policy: agora.io/en/privacy-policy

Abroad

5 Your Rights Under the KVKK

As a personal data owner, you have the following rights under Article 11 of the KVKK:

Learning whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether it is used in accordance with that purpose
To know the third parties to whom it has been transferred domestically or abroad
To request correction if it has been processed incompletely or incorrectly
To request its deletion or destruction if the conditions for processing no longer exist
To request that these actions be notified to the third parties to whom the data has been transferred
To object to a result arising against you as a consequence of analysis carried out through automated systems
To claim compensation for damages if you suffer harm due to unlawful processing
Application Channels
Postal Address

Merkez Mahallesi Hasat Sk. No:52, 34381 Şişli/İstanbul

Email Address

info@mdatechnologies.net

Applications will be evaluated in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Documents verifying identity in applications must not contain special categories of personal data (e.g., religion, blood type, etc.).

FitxDiet - Online Fitness Services Platform

info@fitxdiet.com

www.fitxdiet.com

Back to Home