Get in touch

Mad Enough? processes your personal data under Law No. 6698 on the Protection of Personal Data (“KVKK”). This notice, prepared under Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, explains which data we process, for what purposes, on what legal grounds, with whom we share it and for how long.

This is an information notice; it does not ask for consent. Matters that require separate permission, such as commercial electronic messages, are handled with a separate checkbox (see section 9).

The Turkish text is authoritative. This English version is a courtesy translation; in case of any difference, the Turkish text prevails.

Legal name: US NEFES TEKSTİL LİMİTED ŞİRKETİ (Mad Enough?)

Address: Bebek Mah. Bebek Hamamı Sk. No:12 Beşiktaş/Istanbul, Türkiye

Email: info@madenough.com

MERSIS no: —

Registered electronic mail (KEP) address: —

VERBIS: Registration with the Data Controllers’ Registry is made depending on whether a registration obligation applies; if it does, the registration details will be stated in this notice.

Application form: full name, email, phone, date of birth (optional), workplace, occupation and work email (optional), your free-text answers about yourself, social media profile links, the name of the member who referred you, language preference, your statement that you have read the notice and when, and your commercial message preference.

Contact form: full name, email, phone (optional), subject and your message.

Account and membership: full name, email, phone, membership status, language preference, a one-way encrypted digest of your password (the password itself is not stored), packages and remaining entitlements, bookings, waitlist entries, attendance, credit movements and evaluation notes on your application.

Records transferred from our previous system: if you were a member on our earlier site built on Wix, your full name, email, phone, membership status, packages and remaining entitlements, past orders and bookings, and your application form answers were transferred to this site. Transferred data is subject to the purposes, periods and rights in this notice.

Payment and invoicing: invoice type, full name or company name, address, city, country, phone, tax office and tax number (corporate invoices), order and payment status, and the acceptance record of the distance sales agreement and pre-contract information (time, IP address, browser information). We do not ask for your Turkish ID number. Your card number, expiry date and security code are not sent to us and are not stored by us; you enter card details only on the payment provider's secure page.

Technical data: your IP address (for rate limiting against abuse, security and acceptance records), browser information, session cookies, a digest of the one-time password-reset code (the code itself is not stored), server access logs and logs of actions taken in the admin panel.

If you accept cookies: statistical measurement data about use of the site through Google Analytics 4 (pages visited, device and browser type, approximate location and similar).

We do not ask for special categories of personal data such as health information in our forms. Please do not enter such information in free-text fields. We do not ask for photographs in the application.

Receiving and evaluating your membership application and informing you of the result: application data. Legal ground: necessary for entering into a contract (KVKK Art. 5/2-c) and legitimate interest (Art. 5/2-f; protecting the nature of the club community).

Running your membership; keeping booking, waitlist, attendance and credit records; managing account sign-in and sessions; sending transactional emails such as booking confirmations, reminders, session cancellations and entitlement expiry warnings. Legal ground: entering into or performing a contract (Art. 5/2-c).

Selling packages, collecting payment, invoicing, refunds and reconciliation; keeping the acceptance of the agreement and pre-contract information as evidence as required by distance sales law. Legal grounds: performance of a contract (Art. 5/2-c), legal obligation (Art. 5/2-ç; tax, accounting and consumer law) and establishment, exercise or protection of a right (Art. 5/2-e).

Continuing the accounts, entitlements and bookings of members who moved from our previous site and announcing the move by email. Legal ground: performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f). This announcement is transactional, not a commercial message.

Answering your contact form requests. Legal ground: legitimate interest (Art. 5/2-f) and pre-contract steps at your request (Art. 5/2-c).

Ensuring information security, preventing abuse and automated submissions with rate limiting, keeping an audit log of admin actions and checking the consistency of account movements. Legal ground: legitimate interest (Art. 5/2-f) and legal obligation (Art. 12, data security; keeping access logs under Law No. 5651).

Measuring and improving use of the site (Google Analytics 4): based only on the explicit consent you give in the cookie banner. If you decline, measurement does not run; you can withdraw consent at any time from the “Cookie preferences” link at the bottom of the page.

Sending commercial electronic messages (event, campaign and announcement emails): only if you tick the separate checkbox, under Law No. 6563 and its regulation. This permission is not a condition for your application or membership (see section 9).

Fulfilling obligations under legislation and answering requests from authorities and courts. Legal ground: expressly provided for by law (Art. 5/2-a) and legal obligation (Art. 5/2-ç).

Payment provider (Yapı Kredi POSNET, Yapı ve Kredi Bankası A.Ş.): for collecting, verifying and refunding payments: full name, email, phone, billing address, order amount and payment data. You enter card details directly on the payment provider's page.

Email service provider (Google Workspace; Google LLC / Google Ireland Limited): to deliver booking, account and payment emails, contact and application notifications and our business correspondence: your email address, name and the email content. Its servers are abroad (see section 6).

Hosting and infrastructure provider (AltunHost, Istanbul, Türkiye): to run and back up the site and database; all records are kept on this provider's servers in Türkiye. We do not use a content delivery network (CDN).

Google (Google Analytics 4): measurement data is transferred only if you accept cookies. The service is based in the USA (see section 6).

Accountants and e-invoice service providers: your invoice details, to issue invoices and meet tax obligations.

Public authorities, courts, our lawyers and advisers: only as necessary to meet legal obligations and handle legal claims.

We do not sell your data or share it with third parties for marketing. Only authorised staff can access the admin panel.

Our payment and hosting services are in Türkiye; your data is not transferred abroad for these services.

Our email service (Google Workspace) runs on servers abroad: the account, booking and payment emails we send you and the messages you send us are delivered through it. This transfer is necessary to provide the service and is made under KVKK Art. 9 on the basis of an adequacy decision, appropriate safeguards (a standard contract signed with the provider and notified to the Board within the period set by law) or another condition listed in the law.

Google Analytics measurement runs only if you give explicit consent in the cookie banner; if you decline, no measurement is made and no data is transferred for this purpose. Transfers are made under KVKK Art. 9 on the basis of an adequacy decision, appropriate safeguards (such as a standard contract, which is notified to the Board within the period set by law once signed) or another condition listed in the law. Measurement stops when you withdraw your consent.

The information notice and explicit consent are separate: we do not ask for your consent to foreign transfers through this notice; consent is requested only in the cookie banner, for measurement.

We collect your data electronically and directly from you through the application, contact, sign-in, booking and purchase forms on our website and your actions in the member panel. Records of members of our previous site were transferred from the membership and booking records on that site. Technical data arises automatically while you use the site, through cookies and server logs. Payment status and refund information reach us from the payment provider.

We keep your data for as long as the purpose requires and for the periods set by the relevant legislation; afterwards it is deleted, destroyed or anonymised.

Rejected or unfinished membership applications: 1 year. Contact form messages: 2 years. Audit records of admin actions: 2 years. Server access logs: 2 years (Law No. 5651).

Membership, booking and credit records; order, payment and invoice records; and agreement and pre-contract acceptance records (including time, IP address and browser information): 10 years from the end of the relationship (limitation and retention periods under the Turkish Code of Obligations, Commercial Code and Tax Procedure Law).

A session cookie expires after 30 days for members if not renewed and 12 hours for staff, and a new sign-in is required no later than 90 days (members) and 7 days (staff) after signing in. Your cookie choice is kept in your browser for 180 days.

The “I have read the KVKK Information Notice” checkbox on the application form only states that you have read this notice; it is not explicit consent.

Permission for commercial electronic messages is requested with a separate, optional, unticked checkbox. Not giving it does not affect your application or membership. Scope and channel: email only. You can withdraw at any time through the link in each email or by writing to us. Members transferred from our previous site are not treated as having given this permission.

Consent for measurement with Google Analytics is requested separately in the cookie banner, and declining does not prevent you from using the site.

When you sign in we use strictly necessary session cookies (__Host-me_member, __Host-me_staff) to maintain the member and staff session; they are needed to run the site and do not require consent. Measurement cookies (Google Analytics 4) load only if you accept. Your cookie choice is stored in your browser's local storage as “me-consent”. More about cookies is also in the Privacy Policy page.

As a data subject you may: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request correction if it is incomplete or incorrect; request deletion or destruction within the conditions set by law and request that these actions be notified to third parties to whom your data was transferred; object to a result against you arising from analysis of your data exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

Note: our membership decisions are made by our staff, not solely by automated systems.

To exercise your rights, send your request, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, with information that identifies you and clearly stating the right you wish to use, by one of these means: in writing to the address above; to info@madenough.com signed with a secure electronic signature; or by writing to info@madenough.com from your email address registered in our system.

Depending on its nature, your request is concluded free of charge within thirty days at the latest; if the process requires a separate cost, a fee under the Board's tariff may be charged. If you find the response insufficient, you may complain to the Personal Data Protection Board within thirty days of learning the response and in any case within sixty days of the application date.

We update this notice as legislation or our practices change. The current version is published on this page with its last update date.