PRIVACY AND PERSONAL DATA PROTECTION POLICY

The organisation responsible for the processing of your personal data:

HOLIREM LIMITED

United Kingdom

For your questions and requests regarding data protection matters, you may contact us through the communication channels indicated on our website.

Depending on your use of the services offered by HOLIREM, the following categories of personal data may be processed:

Identity Information

Name, surname and other identity information provided by the user.

Contact Information

Email address, phone number and information communicated to us in the context of correspondence.

Account Information

User account, membership status, account preferences and transaction information associated with the account.

Purchase and Subscription Information

Information relating to purchased services, trainings, sessions, subscription plan, payment status, transaction date and billing.

Where payment card information is processed directly by a third-party payment institution, HOLIREM does not store your full card details.

Contact and Support Records

Contact forms, support requests, messages submitted by the user and customer service correspondence.

Technical Data

IP address, device type, browser information, operating system, session information, error logs and technical data relating to platform usage.

Usage Data

Information relating to the pages visited, features used, content viewed and interactions carried out with the platform.

Session and User-Submitted Information

Information that the user voluntarily provides in the context of an online session, form or similar service may be processed.

Where such information relates to health or otherwise constitutes special category/sensitive personal data, it is processed only within the legal conditions permitted by applicable data protection legislation.

Your personal data may be processed for the following purposes:

• Creating and managing the user account,
• Managing memberships and subscriptions,
• Scheduling and carrying out online sessions,
• Providing access to trainings and digital content,
• Carrying out purchase and payment processes,
• Responding to user requests and support applications,
• Ensuring platform security,
• Preventing fraud and misuse,
• Detecting and resolving technical issues,
• Improving our services,
• Sending marketing and informational communications where the user has opted in,
• Complying with legal obligations,
• Establishing, exercising or defending legal claims.

Depending on applicable law, personal data may be processed under one or more of the following legal bases:

• Performance or entry into a contract with the user,
• Compliance with a legal obligation to which HOLIREM is subject,
• The legitimate interests of HOLIREM or third parties,
• The explicit consent of the user,
• The establishment, exercise or protection of legal rights,
• Additional processing conditions required by applicable law for special category or sensitive personal data.

Where processing is based on consent, the user may withdraw that consent at any time in accordance with applicable law.

Due to the nature of some of HOLIREM's services, users may share health conditions, symptoms or similar sensitive information within online sessions or related forms.

Such data may be regarded as special category or sensitive personal data under applicable legislation and is subject to the additional security and legal processing conditions this requires.

Users may be asked not to share sensitive personal information that is not necessary for the service.

Your personal data may be shared, to the extent necessary for the provision of the services, with the following categories of recipients:

• Payment service providers,
• Hosting and cloud infrastructure providers,
• Email and communication service providers,
• Analytics and technical service providers,
• Authorised advisors and service providers,
• Public authorities and regulatory bodies with legal authority.

Service providers' access to personal data is limited to what is necessary for the provision of the relevant service.

As HOLIREM is based in the United Kingdom and makes use of international technology infrastructure, personal data may be processed by service providers located in different countries.

Appropriate legal mechanisms and safeguards required by applicable data protection legislation are applied to international data transfers.

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, or for the periods required by applicable legal, tax, accounting and regulatory obligations.

In determining the retention period, the following are taken into account;

• The nature of the data,
• The purpose of processing,
• Legal obligations,
• Possible legal claims,
• Security requirements

Once the purpose of retention no longer applies, personal data is deleted, anonymised or securely destroyed in accordance with applicable legislation.

HOLIREM may use cookies and similar technologies to ensure the website and digital services function properly, remember user preferences, ensure security and, where permitted, analyse usage statistics.

Detailed information about the use of cookies is provided in the Cookie Policy.

Where required, and provided the user has given permission, HOLIREM may send informational communications by email or other communication channels about new content, trainings, services, campaigns and similar developments.

The user may opt out of marketing communications at any time.

Transactional, security, membership or account notifications necessary for the operation of the service are treated separately from marketing communications.

Depending on applicable data protection legislation and the legal basis of the relevant processing, users may have the right to;

• Access their personal data,
• Request correction of their personal data,
• Request deletion of their personal data in certain circumstances,
• Request restriction of processing,
• Object to certain processing activities,
• Request data portability where applicable,
• Withdraw consent where processing is based on consent,
• Exercise applicable rights relating to automated decision-making

Data subjects in Turkey may also exercise the rights set out in Article 11 of the KVKK, to the extent applicable.

Users in the United Kingdom have the right to lodge a complaint with the UK data protection authority, the Information Commissioner's Office (ICO), regarding concerns about the processing of their personal data.

Data subjects in Turkey may, where applicable, apply to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

We encourage you to contact HOLIREM first so that we may seek to resolve the matter.

HOLIREM aims to implement appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, loss or unlawful processing.

However, no method of data transmission over the internet can be guaranteed to be completely secure.

Where HOLIREM services are offered to children, age-appropriate privacy information and parental or guardian consent mechanisms required by applicable legislation may be used.

For services not directed at children, the applicable age restrictions apply.

The platform may contain links to third-party websites or services.

HOLIREM is not responsible for the personal data processing activities carried out by third parties on their own websites. Users are advised to review the privacy policies of the relevant services separately.

This policy may be updated in line with changes to legislation, our services or our personal data processing activities.

The current version is published on the HOLIREM platform, and the last update date is indicated on this page.

This section contains additional information specific to users of the Holirem mobile application (the 'App'). It applies in addition to, not instead of, the general provisions above.

No In-App Purchases

The App does not support any in-app purchases. Premium membership, education purchases, and appointment payments are handled exclusively through the Holirem website (holirem.com). Payment details are never collected or processed by the App.

Data Collected Specifically by the App

• An optional profile photo you upload from your device's photo library
• A device-specific push notification token, collected via Firebase Cloud Messaging so we can send you notifications
• The name and email information provided by Google or Apple when you sign in with those providers
• Device type, operating system version, and in-app usage data

Deleting Your Account from Within the App

You can permanently delete your account and associated personal data directly within the App, via Profile > Account Settings > Delete My Account, without needing to visit any website.

For your questions and requests regarding your personal data or this policy, you may contact us through the communication channels indicated on HOLIREM's website.

HOLIREM LIMITED

United Kingdom