Privacy Policy

1. Data Controller

As Gravis Pazar Araştırma ve Danışmanlık Hizmetleri Ltd. Şti. ("Gravis" or "Company"), we exercise the utmost care regarding the security and confidentiality of your personal data, in our capacity as data controller within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK"). This Disclosure Statement has been prepared to inform you about the methods of collection, purposes of processing, legal grounds, parties to whom data is transferred, and your rights regarding your personal data.

2. Personal Data Collected

The following categories of personal data are collected and processed through the Gravis platform:

• Identity Information: First name, last name, Turkish ID number, date of birth, gender.
• Contact Information: Phone number, email address, address details.
• Account Information: Username, password (in encrypted form), account creation date.
• Demographic Information: Age group, education level, occupation, income group (SES), city and region of residence (NUTS12).
• Task and Transaction Information: Completed tasks, task responses, photos, videos, audio recordings, barcode data, file uploads, GCoin balance and transactions, marketplace requests.
• Location Information: Location data collected for the purpose of task verification.
• Profile Information: Survey responses, profile question answers, user preferences.
• Technical Information: IP address, browser information, device information, cookie data, session information.
• Financial Information: IBAN number, payment requests and history.

3. Purposes of Processing Personal Data

Your collected personal data is processed for the following purposes:

• Creating membership records and providing account management
• Offering, managing, and evaluating the results of tasks on the Platform
• Conducting and reporting market research activities
• Performing demographic and profile-based filtering to determine task eligibility
• Operating the GCoin system and fulfilling marketplace requests
• Carrying out payment transactions
• Providing user support services
• Ensuring Platform security and preventing misuse
• Fulfilling legal obligations
• Conducting statistical analyses and improving service quality
• Sending notifications and announcements to users

4. Method of Collecting Personal Data and Legal Grounds

Your personal data is collected through registration forms on the Platform, profile information, task completion processes, support requests, cookies, and automated means.

The legal grounds for processing your personal data, within the scope of Articles 5 and 6 of the KVKK, are as follows:

• Your explicit consent
• Being directly related to the establishment or performance of a contract
• Being mandatory for the Company to fulfil its legal obligations
• Data processing being mandatory for the legitimate interests of the Company, provided that the fundamental rights and freedoms of the data subject are not harmed

5. Transfer of Personal Data

Your collected personal data may be transferred to the following parties for the purposes specified in this Disclosure Statement and in accordance with Articles 8 and 9 of the KVKK:

• Our business partners who are market research clients (in anonymised and aggregated form)
• Payment service providers
• Authorised public institutions and organisations and judicial authorities, within the scope of legal obligations
• Suppliers providing technical infrastructure and hosting services
• Advertising service providers

In the event that your personal data is transferred abroad, the provisions of Article 9 of the KVKK are complied with.

6. Data Retention Period

Your personal data is retained for the period required by the purposes of processing and in accordance with legal retention obligations. Upon expiry of the retention period stipulated in the relevant legislation or upon the cessation of the purpose of processing, your personal data is deleted, destroyed, or anonymised.

7. Data Security

Our Company takes the necessary technical and administrative measures to ensure the security of your personal data. In this scope, SSL encryption, firewalls, access authorisation, hashing, and regular security audits are implemented.

8. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose
• To know the third parties to whom your personal data is transferred, domestically or abroad
• To request the correction of your personal data if it has been processed incompletely or incorrectly
• To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK
• To request that the correction and deletion processes be notified to the third parties to whom your personal data has been transferred
• To object to a result against you arising from the analysis of your processed data exclusively through automated systems
• To request compensation for damages in case you suffer damages due to the unlawful processing of your personal data

9. Application Method

To exercise the rights specified above, you can submit your application — including information identifying you and the content of your request — to our Company through the following methods:

Email: bilgi@gravis.com.tr

Postal Address: Gravis Pazar Araştırma ve Danışmanlık Hizmetleri Ltd. Şti., Eğitim Mah. Adım Sok. Keptioğlu İş Merkezi No: 11 D: 7, Hasanpaşa, Kadıköy, Istanbul 34726

Your applications will be finalised free of charge as soon as possible and within at most 30 (thirty) days, depending on the nature of the request.

10. Changes

Our Company reserves the right to make changes to this Disclosure Statement in line with legislative changes or updates to business processes. Updates take effect on the date they are published on our platform.