PRIVACY POLICY

Swimming Analysis — operated by Swimlytics Dijital Spor Teknolojileri Limited Şirketi

Last Updated: 14 October 2026 Version: 1.0

1. WHO WE ARE AND HOW TO CONTACT US

Data Controller: Swimlytics Dijital Spor Teknolojileri Limited Şirketi Altıntepe Mah. İstasyon Yolu Sk. No: 3/1, Maltepe/İstanbul, Türkiye MERSIS No: 0781114070500001 Trade Registry No: 1097519 (İstanbul Trade Registry Office) Tax Office / No: Küçükyalı / 7811140705 Email: contact@swimminganalysis.com Phone: +90 532 673 17 13 KEP address: swimlytics@hs01.kep.tr Website: swimminganalysis.com

Swimming Analysis ("we", "us", "our") is the data controller responsible for your personal data processed through this platform. For any privacy-related inquiries, data subject requests, or complaints, please contact us at contact@swimminganalysis.com.

2. SCOPE AND LANGUAGE

This Privacy Policy applies to all users of swimminganalysis.com and its associated services, regardless of location.

This policy is published in Turkish and English. In the event of any conflict between the two versions, the Turkish text prevails before any court, Consumer Arbitration Committee or public authority in Türkiye, whoever the user is; for users located in Türkiye the Turkish text prevails in every case. Elsewhere the English text prevails, including for users located in the European Economic Area (EEA) or the United Kingdom.

3. WHAT DATA WE COLLECT AND WHY

How we collect your data. We collect your personal data electronically, by wholly or partly automated means: through the forms you complete on the platform (registration, checkout, race upload, and the contact and support forms) and through automatic system records generated as you use the platform. The legal basis for each category of processing is stated in the relevant subsection below, under the EU General Data Protection Regulation (GDPR) and under the Turkish Personal Data Protection Law (KVKK).

3.1 Account Registration

When you create an account, we collect:

• Full name
• Date of birth (athlete accounts)
• Email address
• Password (stored only as a one-way hash; we never store your plain-text password)
• Account type (Athlete, Coach, or Team Owner)
• Gender (athlete accounts)
• Whether the account is registered and managed by a parent or legal guardian (athlete accounts for minors)

We also record the country your IP address resolved to at the moment of registration, looked up offline on our own servers as described in Section 3.5, and store it with your registration consent record for aggregate statistics on where our users come from. If you connect through a VPN or a corporate network this may differ from where you are. It is never used as your place of residence.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)): this data is necessary to provide you with access to our services. Legitimate interests (Article 6(1)(f)) for recording the country your IP address resolved to, for aggregate statistics. Legal basis (KVKK): Processing necessary for the establishment or performance of a contract to which the data subject is a party (Article 5(2)(c)); legitimate interests of the data controller (Article 5(2)(f)) for recording the country your IP address resolved to, for aggregate statistics.

Consent records. When you accept the Terms of Service at registration and confirm that you have read this Privacy Policy (and, where applicable, confirm that you are an adult or the legal guardian of a minor athlete), we record that as proof of consent: the time of acceptance, the exact versions of the Terms and of this policy shown to you, the confirmation text shown to you, your IP address, and your browser information. This record is kept while your account exists and for 5 years after your account is closed, under the de-identified account handle as evidence that consent was given (GDPR Article 17(3)(e)); it is then deleted. It is never shared or displayed.

Legal basis (GDPR): Legitimate interests (Article 6(1)(f)): being able to prove, if a dispute arises, which terms and declarations were accepted and when. Legal basis (KVKK): Processing is necessary for the establishment, exercise or protection of a right (Article 5(2)(e)).

3.2 Minor Athletes (Under 18)

Parents do not have a separate account type: a parent or legal guardian registers an Athlete account on behalf of their minor child. If you are registering on behalf of a minor athlete, you must be that child's parent or legal guardian. During registration you will provide:

• The child's full name and date of birth
• Your own email address as the account holder
• Your declaration that you are the child's parent or legal guardian and will manage the account on the child's behalf

Athlete accounts are open to children who turn 10 or older in the current calendar year, registered by a parent or legal guardian. We do not knowingly collect data from younger children. If you believe we have inadvertently collected data from a younger child, or from a minor without the authority of a parent or legal guardian, please contact us immediately at contact@swimminganalysis.com.

Age verification mechanism. Users who register on behalf of a minor must select the "Parent" pathway during registration, which creates an Athlete account flagged as parent-managed. The parent provides their own email address as the account holder, confirms the child's name and date of birth, and declares, by checking a dedicated checkbox, that they are the child's legal guardian and will manage the account on the child's behalf. By completing registration, the parent or guardian confirms that they have this authority and that the processing described in this policy may be carried out for the child's account. We rely on this declaration as reasonable verification of parental authority; the checkbox records that confirmation and is not a separate consent to processing. If we receive credible information that an account was registered without the authority of a parent or legal guardian, we will investigate and delete the relevant data promptly.

Data rights for minor athlete accounts are exercised by the parent or legal guardian; a minor capable of discernment may also exercise them personally.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)) concluded on the child's behalf by the parent or guardian as the child's legal representative; the parental-authority declaration is recorded as described in Section 3.1. Legal basis (KVKK): Performance of a contract (Article 5(2)(c)) concluded on the child's behalf by the parent or guardian as the child's legal representative; the dedicated checkbox records the parent's confirmation of authority, not a separate consent.

3.3 Race Videos

When you upload a race video, we collect:

• The video file itself
• Race metadata you provide: event (meet) name, event date, distance, stroke, pool type, race session, lane number, split/lap times, and any notes

A coach or Team Owner of your team, or our staff at your request, may upload a race on your behalf; in that case the video and race details are provided by them rather than by you.

Race videos are kept only as long as needed to perform the analysis and are then deleted automatically and permanently:

• Analyzed videos: deleted 14 days after the analysis is completed.
• Rejected races: the video, the race details and the rejection reason are deleted 14 days after rejection.
• Exception: where a video is rejected for breaching our Terms of Service and we restrict or close the account, we may keep a copy of it and the rejection record as evidence until the matter and any claim arising from it are concluded (Section 8.1 of the Terms of Service), on the basis, under the GDPR, of our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f) and Article 17(3)(e)) and, under KVKK, of the processing being necessary to establish, exercise or protect a right (Article 5(2)(e)). You are informed when this applies.
• Videos not analyzed within 30 days of upload: automatically rejected (the credit is refunded) and the video is deleted at that point.

If you delete a race from your profile, all of its remaining data (including the video, where one still exists) is permanently erased within 30 days. After deletion we retain no working copy of the video; residual copies leave our backups as described in Section 7. Video deletion never affects your saved race metrics and analysis outputs.

Uploaded videos are accessible only to the authorized personnel who perform the analysis and are never publicly displayed within the platform.

Race videos may contain images of multiple individuals (spectators, other athletes, coaches) who have not consented directly to data processing. By uploading a race video, you confirm that: (a) the video was recorded at a public sporting event or competition venue; (b) you have the right to share the video for analysis purposes; and (c) where required by applicable law, appropriate consent or authorization exists.

While we hold a video for analysis, we may also use it and the measurements taken from it to develop, test and improve our analysis methods and tools (Section 9.1 of the Terms of Service). This does not extend how long the video is kept.

If you appear in footage uploaded by someone else, you can ask us to remove it as described in Section 8.4 of the Terms of Service. We meet our obligation to inform the individuals who appear in footage under Article 10 of KVKK by publishing this policy.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)): video analysis is the core service you have purchased. Legitimate interests (Article 6(1)(f)) for the other individuals who may appear in the footage: our interest in performing the analysis you requested, with the video kept only for the period stated in this Section and never displayed. The improvement of our analysis methods described above also rests on our legitimate interest in the accuracy and quality of the service, within that same period. Legal basis (KVKK): Performance of a contract (Article 5(2)(c)); legitimate interests of the data controller (Article 5(2)(f)) for other individuals appearing in the footage and for the improvement of our analysis methods described above.

3.4 Performance and Analysis Data

We collect the following performance metrics derived from your race video and retain them for as long as your account exists and, after it is deleted, as described below and in Section 7:

• Split times and lap times
• Segment velocities
• Stroke rate
• Distance per stroke (DPS)
• Underwater phase metrics
• Start and turn metrics
• Any other technical metrics generated through our analysis process

Upon account deletion, your profile is de-identified within the response period in Section 9.3: your name, email address, phone number and saved billing details are removed, your date of birth is reduced to the year of birth, and the account is renamed to a de-identified handle. An internal administrative record of the deletion, containing the former name and email address, is kept for 120 days and then purged. We keep this record on the basis of our legitimate interests (GDPR Article 6(1)(f); KVKK Article 5(2)(f)): being able to identify the deleted account if a dispute, a payment query or a data-subject request follows.

The following data is retained after de-identification, for as long as we maintain our benchmark dataset, for benchmark analysis and as our work product: year of birth (from which an age in whole years is derived at the time of analysis), gender (Men/Women), performance metrics (together with pool type, stroke, and distance), and the race records those metrics belong to, reduced to the year of the race and the race session. At the same time we remove every direct competition identifier from each race record: the event name is replaced by a fixed placeholder, the race date is reduced to 1 January of its year, the lane number is cleared, and any notes you entered are deleted. These records are no longer linked to your name or contact details.

We treat the retained set as pseudonymized personal data: we keep it on the basis of our legitimate interest in long-term performance benchmarking, and we review every five years whether that purpose still requires it. Races you deleted yourself before closing your account are not retained: they were erased under Section 3.3.

From the retained set we may compute aggregate performance statistics (for example percentiles, medians and distributions by age group, gender, event and pool type) for benchmarking and for the development of age-group standards, and we may provide such statistics to swimming federations, sports bodies and similar organizations, including under contract. Only aggregates leave: no individual race record, metric or swimmer is ever disclosed, and every release is checked so that no figure can be traced back to a person, by the recipient or by anyone else. Statistics that meet that test are not personal data.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)) for service delivery; legitimate interests (Article 6(1)(f)) for the de-identification step and for retaining the pseudonymized benchmark data for statistical purposes (Article 89). Legal basis (KVKK): Performance of a contract (Article 5(2)(c)); legitimate interests of the data controller (Article 5(2)(f)).

3.5 Credits and Payment Data

Our platform operates on a credit system. You purchase credit packages using a debit or credit card processed by Iyzico Ödeme Hizmetleri A.Ş. ("Iyzico").

We retain:

• Records of credit purchases (amount, date, package type, transaction reference)
• Records of credit usage (which race each credit was applied to)
• Credit refund records
• The card brand, card type (credit or debit), instalment count, the first six digits (which identify the bank that issued the card and its country) and the last four digits of the card used, as reported to us by Iyzico after a completed payment (never the full card number)

Refunds: the circumstances in which a credit is returned or a payment is refunded are set out in our Refund Policy.

What Iyzico receives. To process a payment we pass to Iyzico your name and surname, email address, phone number, billing address, city and country (the billing address is also supplied as your registration and delivery address), your IP address, your account identifier, and the name and price of the package purchased.

Checkout currency. The currency you are charged in is determined from your IP address using an offline IP-to-country database (DB-IP) on our own servers (no lookup request leaves them) and the resulting country code and currency are stored with the transaction and with your checkout consent records (see below). For sales to buyers outside Türkiye, this country and the first six digits of the card are also kept with the invoice records as evidence for the VAT exemption on exported services; legal basis: legal obligation.

Checkout consent records. When you start a purchase we record your acceptance of the Pre-Contract Information Form and Distance Sales Agreement and, for purchases in US dollars, your express consent to immediate delivery: the time, the wording shown to you, the exact document versions, the order details (package, amount, currency, order date, buyer name, billing address, phone number and email address), your IP address and your browser information. After a completed purchase we also keep a copy of the confirmation email we send you (the address it was sent to, its text, a fingerprint of each attached document and our email provider's delivery reference) as evidence that the contract was sent to you. Legal basis: legal obligation (KVKK Article 5(2)(ç); Article 20(1) of the Distance Contracts Regulation; GDPR Article 6(1)(c)).

Credit freezing. When credits approach the date on which they will be frozen (Section 7.2 of the Terms of Service) we send an in-app notification and an email beforehand; the timing of those notifications is set by the platform.

Discounts. We may set a discount percentage on your profile for personal credit purchases; it is stored with your profile and applied at checkout. Legal basis: performance of a contract (GDPR Article 6(1)(b); KVKK Article 5(2)(c)).

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for financial record retention. Legal basis (KVKK): Performance of a contract (Article 5(2)(c)); legal obligation (Article 5(2)(ç)).

Saved billing preferences (optional). During checkout, you may tick a box to let us save your billing details (phone number, address, city, and country) on your profile for faster future checkouts. This is opt-in: we store these details only when you explicitly request it, and we record the timestamp of your consent. The saved details contain no name: the buyer name is pre-filled from your profile name at each checkout, except on a parent-managed account, where the parent or guardian enters their own name as the buyer each time. You can clear these saved details at any time from your profile settings under "Delete my Billing Information", or by emailing us at support@swimminganalysis.com.

Legal basis (GDPR): Consent (Article 6(1)(a)). Legal basis (KVKK): Explicit consent (Article 5(1)).

3.6 Team Accounts

Team Owners may invite coaches and athletes to their team. When an invitation is sent, we store the invited person's email address. Invited individuals may accept or decline; invitation records are retained for operational and audit purposes.

Coach and Team Owner access to athlete data. When an athlete (or, for minors, their parent/guardian) accepts an invitation to join a team, the Team Owner and any coaches assigned to that athlete's sub-team are granted access to the athlete's performance data within the platform. This includes: your name and, for Team Owners, your email address; your credit balance; race metadata submitted while on the team; performance insights and analysis outputs; race metrics (split times, stroke rate, DPS, underwater/start/turn metrics, etc.) and progress over time; and race and event history. Race videos themselves are never viewable by Team Owners or coaches; they are accessible only to our analysis personnel (see Section 3.3). This access is a core part of the team coaching feature and continues for as long as the athlete remains a member of the sub-team. Athletes (or their parent/guardian) may revoke this access at any time by leaving the team. This data sharing applies equally to minor athletes: the parent or guardian must be logged in to their account and explicitly accept the team invitation on behalf of the child; that acceptance is recorded as the decision to join.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)): the team feature you joined; legitimate interests (Article 6(1)(f)): the Team Owner's and coaches' interest in coaching the athletes on their team. You may object at any time by leaving the team. Legal basis (KVKK): Performance of a contract (Article 5(2)(c)); legitimate interests of the data controller (Article 5(2)(f)): our interest in operating the team feature the athlete joined. Leaving the team ends the processing.

Team dissolution and access changes. Athlete data belongs to the athlete, not to the team. Team Owner and coach access to an athlete's data ends when the team is dissolved (including when the Team Owner's account is deleted), when the coach is removed, or when the athlete leaves the team or sub-team; the athlete's own account, race history and analyses are unaffected (Section 10.3 of the Terms of Service).

Elite-athlete benchmark library. We maintain a separate library of elite-athlete race analyses sourced from public competitions, used by all users as a benchmark reference. For each race the library stores the athlete's name, the competition, date, session and lane, and the performance metrics we derive; the race video itself is deleted 7 days after our analysis is complete. These athletes are not users of the platform. Public competition data used for benchmark analysis is processed on the basis of legitimate interests (GDPR Article 6(1)(f); KVKK Article 5(2)(f)): our interest in giving users a reference drawn from publicly available elite performances. Any athlete in the library may exercise the rights in Section 9 by contacting us. We do not notify these athletes individually: given the number of public results involved and the absence of any contact details for them, doing so would involve disproportionate effort (GDPR Article 14(5)(b)). We meet our obligation to inform them under Article 10 of KVKK by publishing this policy.

3.7 Transactional and Service Emails

Every email we send is transactional or service-related and necessary for the operation of the platform. These include: account sign-up confirmation emails, email-change confirmation emails (sent to both your current and your new address), payment confirmations and credit purchase receipts, password reset emails, race rejection notifications (delivered in-app, and by email where we offer it), credit-freeze reminders, and other service notifications directly related to your use of the platform. You cannot opt out of transactional emails while maintaining an active account.

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)). Legal basis (KVKK): Performance of a contract (Article 5(2)(c)).

In-app notifications. We also show notifications inside the platform about events in your account and your team (such as a completed analysis, a rejection, credits added, about to be frozen or frozen, and team invitations) and platform-wide announcements about the service. Announcements are delivered in-app, and by email where we offer it. Retention is set out in Section 7. Legal basis (GDPR): Legitimate interests (Article 6(1)(f)): keeping you informed of events in your own account and of changes to the service. Legal basis (KVKK): Legitimate interests of the data controller (Article 5(2)(f)), for the same purpose.

3.8 Support Communications

When you contact us by email or through our contact and support forms, we collect:

• Your name and email address
• The content of your message
• Any attachments or information you choose to share

Messages sent through the logged-in support form also include your account's user ID and role, so we can find your account.

Support communications are kept for as long as they are needed to handle your enquiry and any follow-up, and are then deleted. Where correspondence records a request or a decision we may need to evidence (such as an account-deletion request, a refund decision, or a complaint), we keep it with the related record for 5 years after your account is closed.

Legal basis (GDPR): Legitimate interests (Article 6(1)(f)): responding to your inquiry and maintaining service quality records. Legal basis (KVKK): Legitimate interests of the data controller (Article 5(2)(f)).

3.9 Technical and Usage Data

When you use our platform, we automatically collect certain technical data necessary to operate the service:

• Session authentication data
• Browser type and operating system (for compatibility purposes)
• IP address (used for security, for rate limiting, and to determine the currency shown at checkout; the country it resolves to is recorded with your registration and checkout consent records, Section 3.1 and Section 3.5; the address itself is recorded with your consent records and with security events such as password changes and failed re-authentication attempts; see Section 7)
• Pages visited and features used within the platform: performance data and error reports are sent to our monitoring provider Sentry; the reports from our servers carry your account identifier (see Section 5.1)

Legal basis (GDPR): Legitimate interests (Article 6(1)(f)): ensuring platform security and functionality. Legal basis (KVKK): Legitimate interests of the data controller (Article 5(2)(f)).

3.10 AI-Generated Race Reports

After our analyst completes a race analysis, our systems may automatically generate a plain-language narrative report explaining that analysis. The report text is produced using an artificial-intelligence model operated by Anthropic, PBC ("Anthropic"), a US-based AI provider acting as our data processor.

What is sent to Anthropic (no name and no contact details):

• Age in whole years (e.g. 16): a single integer calculated from the athlete's year of birth. The day and month of birth are never used in the calculation and are never transmitted.
• Gender
• Race and performance data: the analysis metrics (split times, segment velocities, stroke rate, distance per stroke, underwater metrics, and similar technical values), together with the race context (distance, stroke, pool type, race session), comparisons against your own previous races on our platform (personal-best times and the differences from them), and benchmark-derived values (performance tier letters, rank positions, World Aquatics points and the age-group comparison label).

Age and gender are included because the report is athlete-specific: without them, the model would have no way to relate the times to the correct comparison group for the athlete.

What is never sent to Anthropic: full name, date of birth (day and month), email address, contact details, meet or event names, free-text notes, and the race video itself. The report text never contains your name; where your name appears on a downloaded PDF alongside the report, it is printed from your account data on our own servers.

Report generation is initiated by our systems as part of the platform service (Section 5 of the Terms of Service), or by you when you request a report update from your analysis page. In either case the model receives only the data described above; users cannot submit free-form content to the AI model. Generated reports are stored on our EU-hosted infrastructure together with the associated race analysis and are removed when that analysis is deleted. Under our agreement with Anthropic, data submitted through its API is not used to train Anthropic's models.

Because Anthropic processes data in the United States, this transfer is safeguarded as described in Section 6 (International Data Transfers).

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)): the narrative report is part of the platform service we provide under the Terms of Service. Legal basis (KVKK): Performance of a contract (Article 5(2)(c)).

4. COOKIES AND LOCAL STORAGE

We use only the cookies and browser storage set out in our Cookie Policy, which lists each item, its purpose and its lifetime. We do not use advertising or behavioural-tracking cookies.

5. HOW WE SHARE YOUR DATA

We do not sell your personal data. We share data with the following categories of recipients:

5.1 Service Providers (Data Processors)

We require our service providers to process your data only on our instructions and in accordance with applicable data protection law, under data-processing terms.

5.2 Legal Requirements

We may disclose your data where required by law, court order, or government authority, including Turkish courts and regulators (the Personal Data Protection Board), EU supervisory authorities, or equivalent bodies in other jurisdictions.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the acquiring entity.

5.4 Professional Advisers and Business Services

Where necessary for the purpose concerned, we also share personal data with our professional advisers (such as our accountant and our lawyers) and with the providers of the invoicing and accounting systems we use to issue and record invoices for purchases. They receive only the data needed for that purpose: for invoicing, the details listed in Section 3.5. Our advisers are subject to professional confidentiality obligations, and we require the providers of these systems to process your data only on our instructions, under data-processing terms.

5.5 Aggregate Statistics for Federations and Sports Bodies

As described in Section 3.4, we may provide aggregate performance statistics to swimming federations, sports bodies and similar organizations. These recipients receive statistics only, never personal data: no race record, metric or account is shared with them, and the statistics are prepared so that no individual can be identified from them.

6. INTERNATIONAL DATA TRANSFERS

Our primary database is hosted in the European Union.

For users in the EEA and UK (GDPR): where data is transferred to processors outside the EU/EEA (for example, Plus Five Five, Inc. (Resend), Cloudflare Inc. and Anthropic, PBC in the United States, and Supabase Pte. Ltd. in Singapore), we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer safeguard. The data shared with Anthropic carries no name or contact details, as described in Section 3.10.

For users in Türkiye: transfers of personal data outside Türkiye are subject to Article 9 of KVKK, which provides for safeguard mechanisms including the standard contract announced by the Personal Data Protection Board.

7. DATA RETENTION

When data is deleted, it is removed from our backups in the ordinary course of our hosting provider's backup rotation.

8. SECURITY

We implement the following security measures to protect your data:

• Data in transit is encrypted using TLS/HTTPS
• Data at rest is protected by encryption provided by our infrastructure providers
• Access to production systems is restricted to authorized personnel only
• Payment data is handled exclusively by Iyzico (PCI-DSS compliant); we do not store card numbers or security codes
• We apply rate limiting and brute-force protections to authentication
• When you change your password, we end your other sessions

We do not ask you for health information, and we do not collect biometric or genetic data. The swimming performance measurements we produce (times, splits, stroke rate, and similar values) are athletic performance data.

Despite these measures, no system is completely secure. In the event of a data breach we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it: under KVKK, the Personal Data Protection Board in every case where personal data has been obtained by others by unlawful means; and under GDPR, the competent supervisory authority where the breach is likely to result in a risk to your rights and freedoms. We will also notify the affected users without undue delay: under KVKK, whenever personal data has been unlawfully obtained by others; and under GDPR, where the breach is likely to result in a high risk to your rights and freedoms. We give that notice by email to the address registered to the account, by an in-app announcement, or by both.

9. YOUR RIGHTS

Depending on your location, you have the following rights regarding your personal data:

9.1 Rights Under KVKK (All Users, Including Turkish)

Under Article 11 of KVKK, you have the right to:

• Learn whether your personal data is being processed
• Request information about the processing if your data has been processed
• Learn the purpose of processing and whether data is used in accordance with that purpose
• Know the third parties to whom data has been transferred domestically or abroad
• Request rectification if data is incomplete or inaccurate
• Request deletion or destruction of your data within the conditions laid down in Article 7 of KVKK
• Request notification of rectification/deletion to third parties to whom data was transferred
• Object to an outcome adverse to you arising from processed data being analyzed solely by automated systems
• Claim compensation for damages arising from unlawful processing

9.2 Additional Rights Under GDPR (EEA and UK Users)

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion ("right to be forgotten") where no overriding legal basis exists
• Right to restriction: restrict processing in certain circumstances
• Right to data portability: receive your data in a structured, commonly used, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint with your local supervisory authority

9.3 How to Exercise Your Rights

Submit your request by email to: contact@swimminganalysis.com

Application channels. For requests sent by email, your request must be sent from the email address registered to your account; this is how we verify your identity for the email channel. In accordance with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), you may also submit your request in writing (a signed letter, delivered in person, through a notary, or by post) to our postal address in Section 1, or via registered electronic mail (KEP) to swimlytics@hs01.kep.tr, or via secure electronic signature or mobile signature. We do not refuse a request solely because it arrives through one of these other channels. Where we have reasonable doubt about the identity of the person making a request, we may ask for the additional information necessary to confirm it. For requests under KVKK, that request neither suspends nor extends the thirty-day period stated below; for requests under GDPR, the response period runs from the date we receive that information, under Article 12(6) GDPR.

What your application must contain (per the Communiqué): your name and surname; your signature, if the application is in writing; your Turkish ID number (or, for foreign nationals, your nationality, passport number or identity number if any); your residential or workplace address for notification; your email address, telephone, or fax number for notification, if any; and the subject of your request. Any information and documents relating to the subject are attached to the application. The Communiqué requires the application to be made in Turkish; we will also accept and act on one sent in English.

Response times:

• Requests under KVKK: we will conclude your request free of charge as soon as possible and at the latest within 30 days of receiving it, as required by Article 13(2) of KVKK; this period is not extendable. We will either fulfil your request or notify you of our reasoned refusal in writing or electronically (Article 13(3)). Where the Communiqué's fee tariff permits a charge (for example, for printed copies beyond the free page limit), we charge no more than that tariff.
• Requests under GDPR (EEA and UK users): we will respond free of charge within one month. In complex cases we may extend this by up to two additional months, in which case we will notify you within the first month. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee reflecting our administrative costs, or refuse to act on it; we will tell you why.

To request account deletion specifically: email support@swimminganalysis.com from the email address registered to your account with the subject line "Account Deletion Request". We will confirm receipt and process your request within the response period stated above. Note that de-identified race records and performance metrics are retained after deletion as described in Section 3.4. Where a payment dispute, chargeback or investigation concerning your account is open, we still conclude your request within 30 days; we tell you with reasons which data we are keeping, on what legal basis (Article 5(2)(e) of KVKK) and for how long, and we delete the remaining data within the same period.

9.4 Supervisory Authorities

For users in Türkiye: Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority) kvkk.gov.tr

If you believe your application was refused, answered insufficiently, or not answered in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of our response and in any case within 60 days of the date of your application (Article 14 of KVKK). Under Article 14(2), the application procedure in Section 9.3 must be exhausted before a complaint is lodged with the Board.

For users in the EU/EEA: Contact the data protection authority in your country of residence. A list is available at: edpb.europa.eu

For users in the UK: Information Commissioner's Office (ICO) ico.org.uk

10. AUTOMATED DECISION-MAKING

We do not currently make any decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.

Profiling for analytics. We do conduct performance profiling in the sense of tracking and comparing individual athlete metrics over time and against population benchmarks. As described in Section 3.4, the race records and performance metrics that remain after account deletion are retained in pseudonymized form as our work product for as long as we maintain the benchmark dataset, on the basis of our legitimate interests.

AI-generated race reports. The narrative race reports described in Section 3.10 are produced automatically by an AI model from your computed analysis metrics. They are informational summaries only: they produce no legal or similarly significant effects, and no decision about you or your access to the service is based on them.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy where a change in law, a decision of a court, public authority or supervisory authority, a security requirement, a change in how we process personal data, or a technical or operational necessity requires it. Where a change materially affects how we process your personal data or reduces your rights under this policy, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users by an in-app announcement, or by email, before the change takes effect
• Where required by law, obtain fresh consent

Corrections, clarifications, and other changes that do not disadvantage you take effect when they are published; we update the "Last Updated" date for those as well.