Data Protection Notice (Türkiye — KVKK)

Data controller

The operator of the Ruh Eşi app acts as data controller under Law No. 6698. You can send requests to destek@ruhesi.net.

Categories of personal data processed

• Identity: first name, last name, date of birth
• Contact: email address
• Location: approximate location (never stored at full precision)
• Visual records: profile photos and verification selfie
• Communication content: the text of the messages you exchange with other users
• Other user-generated content: the interests you suggest, the text you write about yourself, and the descriptions you add to reports
• Transaction security: session records, IP hash, device information
• Customer transactions: subscription and purchase records
• Special category data: only where you gave separate explicit consent, your answers to the relevant questions

Purposes

• Creating your membership and verifying your identity
• Calculating compatibility and presenting match suggestions
• Showing nearby users at approximate location
• Maintaining service security and preventing abuse
• Reviewing reports and taking necessary measures
• Meeting legal obligations

Legal grounds

• Necessary for the establishment and performance of a contract (art. 5/2-c)
• Compliance with a legal obligation (art. 5/2-ç)
• Legitimate interest (art. 5/2-f) — security and abuse prevention
• Explicit consent (art. 5/1, and art. 6/2-a for special category data) — location and sensitive questions

Method of collection and legal reason

Your personal data is collected through the mobile app and the website, by wholly or partly automated means, from the following channels:

• Information you enter yourself when you register and fill in your profile
• If you signed in with Apple or Google, the user identifier the provider passes to the app and your email address where you shared it
• The approximate location, device and connection information your device reports while you use the app
• Content you produce inside the app: your answers to questions, your messages, the interests you suggest and the descriptions you add to reports
• Reports other users file about you, and the moderation reviews carried out on those reports
• The content of the emails you send when you write to destek@ruhesi.net

The legal reason for this collection is the set of grounds listed under "Legal grounds" above; location and special category data are processed on the basis of your explicit consent alone.

Parties data is transferred to

Limited to the purposes above, and shared only as much as needed, your personal data may be transferred to the following groups of recipients:

• Hosting and database provider — to run the service and store the data
• Email provider — to deliver sign-in codes and essential notices
• Notification provider — to deliver app notifications to your device
• Subscription verification provider and the stores (Apple, Google) — to verify purchases and subscriptions
• Competent public authorities where we are legally required — to meet a legal obligation

We do not sell your data for advertising and do not share it with third parties for marketing. Some of these providers may be located abroad; where that is the case, the order set out under "Transfers abroad" below applies.

Transfers abroad

The app is available worldwide, and hosting, email delivery, notification and subscription verification services may be obtained from providers located outside Türkiye. Transfers abroad follow the order set out in article 9 of the Law:

• Adequacy decision: where the Personal Data Protection Board has issued an adequacy decision for the destination country, for sectors within that country, or for an international organisation, the transfer relies on that decision.
• Appropriate safeguards: where there is no adequacy decision, the transfer relies on one of the appropriate safeguards — the standard contract published by the Board, signed between the parties and notified to the Personal Data Protection Authority within five business days of signature; binding corporate rules approved by the Board; or a written undertaking permitted by the Board.
• Exception in incidental cases: where neither an adequacy decision nor an appropriate safeguard is available, a transfer may only be made on an incidental basis, relying on the exceptions listed in the Law. Your explicit consent for the transfer is one of those exceptions.

Explicit consent is the last resort here, not our first route: it applies only to incidental transfers where no adequacy decision and no appropriate safeguard exist. Transfers that are ongoing are not based on consent. Where we do ask for it, you are separately informed about the possible risks of the transfer and you can withdraw your consent at any time.

Which mechanism a transfer relies on can differ from provider to provider. If you want to know which one applies to a given provider, write to destek@ruhesi.net and we will tell you, and send a copy of the safeguard where there is one.

Your rights (art. 11)

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose and whether it is used accordingly
• To know the third parties to whom it is transferred, at home or abroad
• To request correction if it is incomplete or inaccurate
• To request erasure or destruction within the conditions of the Law
• To request that corrections and erasures are notified to third parties
• To object to a result against you produced solely by automated analysis
• To claim compensation for damage arising from unlawful processing

Send requests to destek@ruhesi.net. We respond free of charge within 30 days at the latest.

Automated decision-making

Compatibility is calculated automatically and affects which people are shown to you. This calculation produces no legal effect; it only determines the order of a suggestion list. You can see how it works in the Privacy Policy and in the compatibility breakdown inside the app.