Personal data and privacy: how do we protect our members' data?

When you join a gym, you share not only your training plan but also a great deal of personal data, from identity details to health history. Gym KVKK (Turkish data protection law) practices clarify why this data is collected, how it is stored and which rights the member has. In this article we outline the general approach to processing personal data at O'Wellness Beytepe and the key points members should know; for the current, full text of your contract and privacy notice, please confirm with our team.

What personal data do gyms collect?

The data collected when joining a wellness club generally falls into a few categories. The main ones are identity and contact details (name, phone, email, address), membership and payment information (membership type, payment method, invoice details), health and physical assessment information (a health declaration if applicable, body composition measurements, training history) and records for facility security (entry and exit logs, security camera footage). Members who receive one-to-one services such as Reformer Pilates or Personal Training may also be asked for additional health information so that a safe program can be built. You can learn which data is requested and its scope from our team when the membership contract is signed.

For what purposes is data processed?

The purposes for processing personal data can generally be grouped under the following headings:

• Membership management: Creating and renewing the membership record, handling package changes and running invoicing.
• Safe delivery of services: Preparing a program suited to the member's physical condition in services such as Reformer Pilates, Personal Training or the sports physiotherapist.
• Facility security: Entry and exit control and the safety of the complex car park and common areas.
• Communication and notices: Passing on program changes, opening-hour updates and membership-related announcements.
• Meeting legal obligations: Keeping the records that must be retained for invoicing and under legislation.

The basic principle is that data is not shared with third parties outside these purposes or without the member's explicit consent. You can also confirm with our team whether separate consent is requested for marketing communications and how you can withdraw it.

Retention periods and security measures

Personal data is retained for the periods set out in legislation and for as long as the membership relationship requires; what is kept and for how long after the membership ends depends on legal retention obligations. Data aimed at facility security, such as camera footage, is usually kept for a shorter, defined period. Access authorization and physical and digital security measures are applied to protect the data. We recommend asking our team for exact information on retention periods and current practice; policies may be updated over time as legislation changes.

Camera recordings and physical security data

Gyms and wellness clubs generally use security cameras to protect common areas. Apart from places that require privacy, such as locker rooms and showers, recordings may be kept in common corridors, entry and exit points and the car park. The retention period, access authorization and who can reach the recordings are set according to the facility's security policy. The purpose of these recordings is security only; they are not used for marketing or any other purpose. Members who want to know the exact practice and retention period can ask our team.

Data processing through digital systems and membership software

Tasks such as membership registration, reservations and entry tracking are mostly handled through a membership management software. These systems keep the member's identity details, membership history and class attendance records digitally. In such software, data security is supported by technical measures such as access authorization and encryption. Staff with access to the system are authorized to reach only the data their role requires. Members who want technical details about the infrastructure and where data is hosted can request information from our team.

Your rights as a member

Under personal data protection legislation, members have rights such as learning whether data about them is being processed, requesting information if it has been processed, learning whether it is used in line with its purpose, knowing the third parties to whom it is transferred in Turkey or abroad, requesting correction if it is incomplete or inaccurate, and requesting deletion or destruction of data they believe is processed contrary to the law. You can learn how to exercise these rights, and through which channel to apply, from our team or our contact page.

Data sharing during membership: step by step

1. Membership application: Identity and contact details are collected and the membership type is determined.
2. Privacy notice: The notice explaining which data is processed and why is presented to the member and signed.
3. Health declaration (if needed): For services such as Reformer Pilates and Personal Training, health information may be requested for a safe program.
4. Contract approval: The membership contract and, if any, a separate KVKK text are approved by the member.
5. Active membership period: Data is used for membership management and service delivery.
6. End of membership: Data outside the legal retention periods is destroyed in accordance with legislation.

Common wrong assumptions

Wrong assumption	Actual situation
"My data is automatically shared with advertising companies."	Passing data to third parties for marketing without explicit consent goes against the basic principle; confirm exact practice with our team.
"All my data is deleted as soon as my membership ends."	Because of legal retention obligations, some data may be kept for a further period.
"My health information is shared only with my trainer and is not recorded."	For safe service the health declaration is usually recorded; ask our team for details.
"KVKK rights only apply to big companies."	Like any institution that processes personal data, gyms fall within its scope.

Data security and facility security together at Yaka Beytepe

As a facility serving within the Yaka Beytepe complex, O'Wellness Beytepe aims to run digital and physical security measures together. The complex car park, entry control and in-facility records are meant to protect both the safety of members and the integrity of data. The documents and privacy notices signed during membership are presented to the member together with the process described on our membership page. As our club is in its founding stage, you can leave a founding membership pre-registration and learn about the process from our about page and our team.

Points to note about photo and video sharing

Photos or videos may occasionally be taken for club events, classes or promotional content. Using members' images in such shoots usually depends on a separate consent or notification process. If you do not want your image used, it is important to tell the relevant staff before the shoot. For posts on channels such as social media or the website, the use of member images relies on explicit consent; members who want to learn the current practice can ask our team.

What to do when you have a request about your data

When you want information about your personal data, request a correction or exercise a right, the most practical route is to speak directly with our team or reach the club through the contact page. Your request is assessed in line with the current procedure and you receive a reply. In such processes, clear written communication helps both you and the club follow the steps.

Frequently asked questions

For questions about how personal data is processed, you can reach us through our contact page and also plan your free facility tour and trial session.

• Membership
• About us
• Contact
• Blog