In accordance with Article 10 of the Personal Data Protection Law No. 6698 (“PDPL”), we, Terappin Teknoloji Anonim Şirketi (“Terappin”, “Us”, “the Company”) would like to provide you, of our website and mobile application with the domain https://www.therappist.ai/ (“Platform”), information about our processing of your personal data throughout your membership and usage of Platform, including about our identity, our purposes for processing personal data, our purposes for transferring personal data and the parties for these transfers, the legal bases of our processing, our methods of processing and your rights regarding this processing:

Data Controller: Terappin Teknoloji Anonim Şirketi, registered at Atakent Mah. Mithatpaşa Cad. Çağla Plaza Blok No:116 İç Kapı No:18 Ümraniye/İstanbul, Türkiye under the trade registration number 250270-5

Your personal data is processed in compliance with the following principles laid out in Article 4 of the PDPL:

Lawfulness and fairness,
Being accurate and kept up to date where necessary,
Being processed for specified, explicit and legitimate purposes,
Being relevant, limited and proportionate to the purposes for which they are processed.

The following is an exhaustive list of the relevant personal data and personal data processing activities:

Data Category	Data Type	Purposes of Processing	Legal Grounds	Gathering and Processing	Retention Period	Parties and Purposes for Transfer[1]
Identity	Name, Surname	Conducting Communication Activities, Conducting Processes for the Sale of Goods and/or Services, Conducting Advertising / Campaign / Promotion Processe	The necessity to process the personal data of contractual parties, provided that it is directly related to the establishment or execution of the contract	Through filling the sign-up form, by automated means	10 years from the date of processing	Conducting Storage and Archiving Activities (Service Providers)
Identity	Age Group	Conducting Processes for the Sale of Goods and/or Services, Conducting Advertising / Campaign / Promotion Processes	The necessity to process the personal data of contractual parties, provided that it is directly related to the establishment or execution of the contract	Through filling the sign-up form, by automated means	10 years from the date of processing	Conducting Storage and Archiving Activities (Service Providers)
Contact Information	E-Mail Address	Conducting Communication Activities, Conducting Processes for the Sale of Goods and/or Services, Conducting Advertising / Campaign / Promotion Processes	The necessity to process the personal data of contractual parties, provided that it is directly related to the establishment or execution of the contract	Through filling the sign-up form, by automated means	10 years from the date of processing	Conducting Storage and Archiving Activities (Service Providers) Conducting Customer Relations Management Processes (Call Center)
Contact Information	Mobile Phone Number	Conducting Communication Activities, Conducting Processes for the Sale of Goods and/or Services, Conducting Advertising / Campaign / Promotion Processes	The necessity to process the personal data of contractual parties, provided that it is directly related to the establishment or execution of the contract	Through filling the sign-up form, by automated means	10 years from the date of processing	Conducting Storage and Archiving Activities (Service Providers) Conducting Customer Relations Management Processes (Call Center)
User Operations	Chat with Therapist AI	Conducting Processes for the Sale of Goods and/or Services	The necessity to process the personal data of contractual parties, provided that it is directly related to the establishment or execution of the contract	Through the usage of Platform, by automated means	10 years from the date of processing	Conducting Storage and Archiving Activities (Service Providers)
Health Data	Data About the State of Mental Health	Conducting Processes for the Sale of Goods and/or Services	Your explicit consent	Through the usage of Platform or as the resolution of Psychology Tests/Questions, by automated means	10 years from the date of processing, as long as the explicit consent is not withdrawn	Conducting Storage and Archiving Activities (Service Providers)

1) Your Personal Data may be transferred to Authorized Persons, Institutions, and Organizations only if relevant legislation and an authorized body require such transfer. If data transfer is required in this regard, your data shall be stored as required by relevant legislation.

All data types included in this Privacy Policy are transferred to Digital Ocean LLC., a service provider of server and infrastructure services. This data transfer is due to the fact that the servers are located within the relevant company in order to meet the need to host the data types we process on a server, and does not require an active data transfer and is realized due to the nature of the hosting service.

Pursuant to Article 11 of the PDPL, you have the following rights regarding your personal data:

The Right to be Informed	The Right to Request	The Right to object
Whether your data is processed or not, Whether your data is used in accordance with the purpose and purpose of processing, Whether your data is transferred domestically or abroad.	For your data to be processed in accordance with the purpose for which it is intended to be transferred domestically or abroad, For your data to be corrected if incorrect or incomplete and for third parties to be notified about, For your data destroyed and for third parties to be notified if the relevant reasons for processing no longer exist; and relavant, compensation for damages;	To the occurrence of a result against you through the analysis of data processed solely through automated systems,

Your Rights and Choices Under the EU GDPR & UK GDPR

Terappin undertakes to respect the confidentiality of your Personal Data and to guarantee Users can exercise their rights.

Users have the right under this Policy, and by law if they are within the UK or EU, to:

- Right of Access: Users have the right to obtain confirmation from us as to whether or not Personal Data concerning Users are processed, and, where that is the case, Users have the right to request and get access to such Personal Data.

- Right to Rectification: Users have the right to request rectification by us of inaccurate Personal Data and Users have the right to provide additional Personal Data to complete any incomplete Personal Data.

- Right to Erasure (“Right to be Forgotten”): In certain cases, Users have the right to request from us the erasure of their Personal Data.

- Right to Restriction of Processing: Users have the right to request from us restriction of processing, for a certain period and/or for certain situations.

- Right to Data Portability: Users have the right to receive their Personal Data from us in a structured format and Users have the right to (let) transmit such Personal Data to another controller.

- Right to Object: In certain cases, Users have the right to object to the processing of their Personal Data, including with regards to profiling. Users have the right to object to the further processing of their Personal Data in so far as such data has been collected for direct marketing purposes.

- Right to be Not Subject to Automated Individual Decision-Making: Users have the right to not be subject to a decision based solely on automated processing.

- Right to Filing Complaint: Users have the right to file complaints with the applicable data protection authority on our processing of their Personal Data.

- Right to Compensation of Damages: In case we breach applicable legislation on the processing of Users’ Personal Data, Users have the right to claim damages from us for any damages such breach may cause to Users.

Exercising of Your UK & EU GDPR Data Protection Rights

Users have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. If you are a resident of United Kingdom, you may complain to Information Commissioner’s Office (ICO) regarding your data protection rights. If you are a resident in the European Economic Area (EEA), please contact your local data protection authority in the EEA. However, we would be appreciated to deal with your concerns before you apply to a Data Protection Authority.

You may exercise your rights of access, rectification, cancellation, and opposition by simply contacting us. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you as soon as possible.

You can send us a declaration about your use of the aforementioned rights, along with documents ensuring your identification and pertaining to the subject of your request through the following channels:

By email, with or without a secured electronic signature, to [email protected];

By Registered Electronic Mail (KEP), with a secured electronic signature, to [email protected],

By hand, through the notary or registered mail with return receipt requested to Atakent Mah. Mithatpaşa Cad. Çağla Plaza Blok No:116 İç Kapı No:18 Ümraniye/İstanbul, Türkiye.

We undertake to respond to your request as soon as possible, but not more than 30 (thirty) days, and without charge, as long as there is no cost for the transaction.