KVKK privacy notice.

01

Data controller

Your personal data is processed by the company that runs the RichlyMe club (“the Club”), as data controller. Contact: door@richlyme.com.

02

Data, purposes and legal grounds

Your data is processed for these purposes, on these legal grounds under the KVKK:

1. 01Identity (name, surname, date of birth, nationality): assessing the application, the membership agreement, age verification — art. 5/2-c contract, art. 5/2-ç legal obligation.
2. 02Contact (phone, email): application, invitations, notifications and support — art. 5/2-c.
3. 03Professional details and social link: committee review — art. 5/2-c and art. 5/2-f legitimate interest.
4. 04Biometric data (liveness selfie and face match with the document, at the verification provider): identity verification — art. 6 explicit consent.
5. 05Sanctions, PEP and adverse media screening result: legal compliance and club safety — art. 5/2-ç and art. 5/2-f.
6. 06Images and location (at the moment of a proof; only the city is published): verifying challenges and preventing fraud — art. 5/2-c and art. 5/2-f.
7. 07Transaction security (device integrity, IP, audit log, watermark): preventing fraud and leaks — art. 5/2-f and art. 5/2-ç.
8. 08Customer transactions (membership, purchase record, concierge requests): membership management and accounting — art. 5/2-c and art. 5/2-ç.
9. 09Health data (only yes/no, optional challenges): verifying challenges — art. 6 explicit consent.
10. 10Marketing permission (email, SMS): club news — explicit consent and İYS registration.

03

How data is collected

Through the app and web application forms, the in-app camera, device location services if you allow them, Apple and RevenueCat payment notifications, the identity verification provider, the support channel and club events — partly by automated and partly by non-automated means.

04

Transfers

Within Türkiye, data is passed to competent public authorities only where the law requires it. To provide the service, data is transferred abroad to providers: Supabase (Germany, hosting), Apple and RevenueCat (USA, purchases and notifications), the identity verification provider, the proof image analysis provider, and infrastructure, error logging, map and communication providers. For countries without an adequacy decision, these regular transfers use the Personal Data Protection Board’s standard contract, notified to the Authority within 5 business days of signing; they are not based on your consent. No personal data is passed to brand partners.

05

Retention

Data is kept for as long as the purpose requires and for the statutory limitation periods, then deleted, destroyed or anonymised. In short: raw location and original proof, 30 days after the decision; identity images only at the provider, at most 30 days; refused applications, 12 months; payment records, the legal period.

06

Your rights

Under KVKK art. 11 you may learn whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to; ask for correction if incomplete or wrong and for deletion or destruction under art. 7; ask that these steps be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

07

How to apply

In the app (Settings → Request my data) or by writing to door@richlyme.com from your registered email address. Requests are answered free of charge within 30 days at the latest. If you find the answer insufficient, you may complain to the Personal Data Protection Board.