Privacy Policy

Introduction

At iceprofile, we take the security of personal data seriously on the digital platform we build for figure skating clubs, athletes, guardians and coaches. This Privacy Policy explains the scope of personal data processing carried out for individuals (together, "user" or "you") who visit, use or create an account on the iceprofile web application (admin.iceprofile.com and associated domains) and the iceprofile mobile applications.

As a data controller operating in Türkiye, we also publish a detailed KVKK disclosure — please see the Data Protection Notice. This Privacy Policy is complementary to it; in the event of conflict, the KVKK (Turkish) notice prevails.

Data We Collect

iceprofile collects personal data in the categories below within the scope of the services offered. Each category is processed to the minimum extent necessary for delivering the service.

Account data

First name, surname, email address, phone number, password hash or one-time passcode (OTP), preferred language and account creation/update timestamps. These are used to create your account, authenticate you and send notifications.

Club and membership data

The club you are affiliated with, your membership role (admin, coach, athlete, guardian), membership status (active, pending, inactive), group assignment and role within the group. For club administrators: your club's name, contact details, city and discipline.

Athlete profile data

Where appropriate on the athlete profile: birth year, gender, level, event/tournament participation, coach-entered performance notes and attendance records. For minor athletes these are processed only with parent/guardian consent.

Content data

Comments you post, messages you send, profile photos and other media you upload, club descriptions and announcements you author.

Technical data

IP address, browser and device information (User-Agent), operating system, language, visited pages, error logs, session cookies. These are processed to provide the service securely, reliably and performantly.

Communications data

Emails, messages and attachments you send us via support; club application form submissions.

How We Use the Data

We process the personal data we collect only for the purposes below:

• Creating accounts, authenticating you and maintaining platform access.
• Delivering the core service — club management, groups, training schedule, attendance and payment tracking.
• Producing reports, dashboards and calendars for administrators, coaches and athletes.
• Delivering announcements, messages and notifications; managing in-platform communication.
• Securing the service, preventing abuse and resolving errors.
• Meeting our legal obligations (accounting, tax, authority requests, etc.).

Legal Basis

Processing is based on the following legal grounds set out in Articles 5 and 6 of Law No. 6698 on the Protection of Personal Data:

• Processing necessary for the establishment or performance of a contract (KVKK Art. 5/2(c)).
• Compliance with our legal obligations (KVKK Art. 5/2(ç)).
• Our legitimate interests, provided they do not override your fundamental rights and freedoms (KVKK Art. 5/2(f)).
• Explicit consent — only for operations that require separate approval such as marketing communications and cookie-based profiling (KVKK Art. 5/1).

Who We Share Data With

Your personal data is shared within club-specific roles (administrators, coaches and guardians) only within the scope of that club. We rely on the following processors to operate the platform infrastructure:

Supabase, Inc.

Amerika Birleşik Devletleri (ABD)

Hosting, database, authentication, file storage and transactional email infrastructure.

Expo / EAS

Amerika Birleşik Devletleri (ABD)

Mobile push notification and over-the-air update delivery.

Vercel, Inc.

Amerika Birleşik Devletleri (ABD)

Web hosting, edge network (CDN) and deployment.

We may disclose personal data to public authorities within the legal framework upon written request (court order, KVKK Board, public prosecutor, etc.).

Cross-Border Transfers

Processors listed above such as Supabase, Vercel and Expo are located outside of Türkiye, primarily in the USA. Such transfers are carried out based on your explicit consent or on other conditions set out in Article 9 of the KVKK. The list of safe countries and the standard contractual clauses published by the Personal Data Protection Board form the legal basis for these transfers.

For the current text of our cross-border transfer commitments and the applicable safeguards, please contact us at kvkk@iceprofile.com.

Cookies and Similar Technologies

The platform uses only cookies strictly necessary for the service. The primary cookies used are:

sb-*

HttpOnly cookies set by Supabase to maintain your session and authenticate you.

NEXT_LOCALE

Remembers your language preference and renders pages in the correct locale.

ice_loc

Stores the country/city estimate derived from your network and any explicit "Use my location" choices for 30 days, used to personalise content (nearby clubs and rinks). Lawful basis: legitimate interest under GDPR Art. 6(1)(f). You can clear it any time from the location bar.

We do not use advertising or third-party tracking cookies. The browser Geolocation API is invoked only when you tap "Use my location" with explicit consent; your precise coordinates are stored only in the cookie on your device and never persisted to iceprofile servers. You can reject all cookies from your browser settings; doing so limits your access to session-protected areas.

Retention Periods

We retain personal data for as long as the processing purpose persists and for the maximum periods imposed by applicable law. For example, account records are kept while your club membership is active and for up to 12 months after account deletion. Accounting and tax records are retained up to 10 years as required by law. At the end of the retention period, the data is deleted, destroyed or anonymized.

Security Measures

We apply appropriate administrative and technical measures to prevent unlawful processing of and access to personal data. These include TLS 1.2+ encryption in transit, row-level security (RLS) at the database tier, role-based authorization, strong-password and one-time-code authentication, access logs, regular backups, the principle of least privilege and timely rollout of security patches.

Your Rights

Under Article 11 of the KVKK, you have the right to learn whether your data is processed, request information about processed data, learn the purposes of processing, know the third parties in Türkiye or abroad to whom data has been transferred, request correction of incomplete or inaccurate data, request erasure or destruction, and exercise other statutory rights. For the full list and application procedure, please see the Article 11 section of our Data Protection Notice.

Children and Minors

Most figure skating athletes on the platform are children or young adults. Accounts for athletes under 18 are created only with parent/guardian consent and as part of a club invitation. If we learn that a minor's data has been processed without such consent, the parent/guardian may contact us to have the account and related data deleted.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services and applicable law. The effective date on this page is updated accordingly; material changes are additionally announced by email or in-product notice.

Contact

For any questions or requests relating to this Privacy Policy or the processing of your personal data, please reach out via the channels below:

Data controller

iceprofile Bilişim Hizmetleri A.Ş.

Address

TODO(lawyer): resmi tebligat adresi

General email

legal@iceprofile.com

KVKK email

kvkk@iceprofile.com

KEP

TODO(lawyer): KEP adresi

MERSİS

TODO(lawyer): MERSİS no