Inner Joy Meditation Yazilim ve Bilgi Teknolojileri Anonim Sirketi (“InnerJoy,” “us,” “we,” or “our”) is committed to protecting and respecting your privacy in connection with your use of our website, www.innerjoy.app (the “Website(s)”), applications (“Apps”) and other products, services and features thereof (the Website, the Apps and such other products, services and features are collectively referred to herein as the “Product” or “Products”, which may be updated from time-to-time at the sole discretion of InnerJoy). This privacy policy (“Privacy Policy”) and any other documents referred to herein set forth the basis on which any personal data we collect from you, or that you provide to us, in connection with the Products will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will collect, use and disclose your personal data.

1. DATA WE MAY COLLECT
We may collect and process the following data about you:

Personal data including, for example, your name, e-mail address, password, and in certain instances, telephone number, data about your usage of the Products and data collected by tracking technologies as further described in section 4 below that may identify you as an individual or allow online contact with you as an individual.

We do not use the data gathered in the health, fitness and motion context for marketing, advertising marketing or use-based data mining purposes.

For individuals who participate in a InnerJoy Family plan, we may collect additional personal data, for example, home address in order to verify family member status.

If, as a primary account holder of a InnerJoy Family plan, you choose to invite additional family members to become subsidiary account holders, we will ask you for their name and email address. We will use this data to invite him or her to join the Products. We store this data for the sole purpose of sending invitations and confirming family member status. If your subsidiary account holder(s) would like us to delete their data, they can do so by contacting the primary account holder of their family plan to be removed.

InnerJoy does not collect or process credit or debit card (“Payment Card”) data. Apple and Google collect Payment Card data with respect to in-app purchases made through the Apps, and our payment processor collects Payment Card data with respect to purchases made through the Websites. Such payment processors generally provide us with some limited data related to you, such as a unique, anonymous token that enables you to make additional purchases using the data they’ve stored, and your card’s type, expiration date, billing address, and the last four digits of your card number.

For individuals using the Products in connection with a Community client account as described in section 6, business data such as your company name, and company email address to the extent that you or your Community provides such data.

Facebook profile information, such as name, email address, and Facebook ID, if you choose to log in to the Products through Facebook.
Device information such as operating system version, device type, and system performance data.

Data collected via tracking technologies, as fully described in section 4.
If you choose to invite a “WiseBuddy” to use the Products using our WiseBuddy system, we will ask you for their name and email address. We will use this data to invite him or her to join the Products. We store this data for the sole purpose of sending invitations and tracking the success of our Buddy program. If your Buddy would like us to delete his or her data, they can do so by opting-out as described in each invitation or by contacting us at support@innerjoy.app.

If you choose to have your account verified to confirm your status as a student, we may allow a third party platform to access the specific personal data you provide in order to perform the verification. All the information you need to fill in the open text fields during account registration is mandatory. Any failure to complete that information or any response InnerJoy considers abnormal may result in InnerJoy refusing (or being unable) to process your request. You agree that the personal data you provide about yourself or subsidiary account holders or “Buddies” to InnerJoy will be current, accurate, complete and unequivocal.

If you chose to have your account verified to confirm your status as a US-based healthcare provider, we may collect your National Provider Identifier (“NPI”) in connection with your email address in order to perform the verification.

When you access the Services, we collect certain data by automated means, including but not limited to technical data about your computer or device, like your IP address, device type, operating system type and version, unique device identifiers, browser, browser language, domain and other systems data, and platform types (“System Data”); usage statistics about your interactions with the Services, including selected training plans, time spent on the Service (or a specific training plan), features used, your search queries, click data, date and time, and other data regarding your use of the Services (“Usage Data”); an approximate geographic location, including information like country, city, and geographic coordinates, calculated based on your IP address. We also collect certain information through Apple Health and/or Google Fit, provided that you have given your explicit consent. Apple HealthKit. We use Apple’s HealthKit framework, which provides a central repository for health and fitness data on iPhone and Apple Watch and – with your explicit consent – lets apps communicate with the HealthKit to access and share this data. If you download our Apple Watch app when it will be available, and use Apple Watch, we may collect and process your heart rate data, obtained through the HealthKit framework and the Apple CoreMotion framework, with your explicit consent. New data attributes may be added to the HealthKit framework, which will be portrayed in the App and which you have to consent to. If you grant the App access to HealthKit, it can add information to certain sections of HealthKit, i.e. adding your steps and burned calories into the relevant section in HealthKit. We kindly would like to remind you that we do not connect and share your information with HealthKit and your HealthKit information is not shared with us, unless you give your explicit consent, which you can always withdraw by changing the settings of your mobile device. The information you provide to HealthKit will be governed by the Apple Terms and Conditions and Privacy Policy. We may analyze the data shared by HealthKit for research purposes designed to provide a personalized experience and motivate engagement in healthy habits. We do not use information gained through the HealthKit framework for marketing, advertising or use-based data mining and we do not transfer that information to third parties for those purposes. Information gained through the HealthKit framework may only be used to provide health, motion or fitness services in connection with the App and may only be transferred to third-parties for that purpose and with your explicit consent. Google Fit. We use Google Fit SDK which is an open platform that lets users control their fitness data. Similar to the HealthKit, provided that you have given your explicit consent, Google Fit may share certain information with us and we may add your information to certain sections of Google Fit. We do not use information gained through the Google Fit SDK for marketing, advertising or use-based data mining and we do not transfer that information to third parties for those purposes. Information gained through the Google Fit SDK may only be used to provide health, motion or fitness services in connection with the App and may only be transferred to third-parties for that purpose and with your explicit consent. We also use cookies to access information when you sign in, store your preferences, to keep you logged in, and to store a limited amount of behavioral data. A cookie is a small file placed onto your device which enables our features and functionality. We do not use any marketing cookies and all our cookies are essential for providing our services. These cookies (“Cookies”) include some of the following: Google Analytics cookies – We need to use these cookies in order to measure the traffic on our websites, which pages of our websites a visitor visit and to calculate the time spent on any page of our websites. Google Tag Manager cookies – We need to use these cookies to keep our websites up-to-date. We do not collect or process any Personal Data through these cookies. Cloudflare cookies – We need to use these cookies to ensure security of our websites. We do not collect or process any Personal Data through these cookies. We also use our own security cookies and only to prevent any attacks on our websites and to prevent any frauds including but not limited to misdirecting frauds, i.e. xxs attack. Should you have any specific questions or concerns regarding Cookies, please do not hesitate to contact us

2. CONFIDENTIALITY AND SECURITY
The security of your personal data is important to us. We follow generally accepted standards to protect the personal data submitted to us, both during transmission and once it is received. If you have any questions about the security of your personal data, you can contact us at support@innerjoy.app. Except as described under the “Disclosure of Your Data” section below, we do not provide your personal data to any third party without your specific consent, as defined by applicable law.

3. NEWSLETTERS OR OTHER ELECTRONIC COMMUNICATIONS
If you sign up to receive promotional materials from us via email and/or (push notifications) we will use the data you give us to provide the communications you have requested. If you inform us that you wish to cancel email promotional materials by selecting “unsubscribe” at the bottom of such communication or by emailing us at support@innerjoy.app, we will remove you from our mailing list. If you no longer wish to receive push notifications, you may turn them off at the device level. If you provide your phone number to us directly or through a third-party for the specific purpose of receiving an SMS message with a link to our Apps, you will receive such SMS message (the “SMS Service”). Standard text message rates will apply.

4. TRACKING TECHNOLOGIES
InnerJoy and our analytics partners use technologies such as cookies, beacons, tags, and scripts to enable a service to recognize your device so you don’t have to provide the same data several times during one task, to recognize that you may have already given a username and password so you don’t need to do it for every web page requested, and to measure how people are using the Products.

We use local storage, such as HTML5, to store content data and preferences. Third parties with whom we partner to provide certain features on the Products also use HTML5 to collect and store data. Various browsers may offer their own management tools for removing HTML5.

We partner with third parties, such as Facebook and Google, to manage our advertising of the Products on other sites or platforms as well as across your other devices based on your past visits to our Website. Our third party partners may use technologies such as cookies to gather data about your activities within the Products to deliver such advertising to you, such as retargeting ads. We are not always able to respond to do-not-track signals. You may continue to receive generic ads on these third party platforms. You may also opt out of receiving ads across devices by adjusting your ad preference in your Google account.

We use third party trackers to let us know when users have visited the Products by “clicking-through” our sponsored advertising or content hosted on third party platforms. The Products use Google Analytics code to gather statistical data. Google Analytics sets cookies to help us accurately estimate the number of visitors to the Products and the volumes of usage of the Products. This is done to ensure that the Products are available when you want them and are fast. For more data on how Google Analytics processes this data, visit www.google.com/analytics.

We will acquire consent from you in order to use such trackers to the extent required by applicable law. For more information on the types of cookies used by InnerJoy and your ability to restrict the behavior of cookies or disable them in your browser’s settings, please refer to the InnerJoy Cookie Policy.

MOBILE ANALYTICS
We use mobile analytics software to allow us to better understand the functionality of our mobile software on your phone. This software may record data such as how often you engage with the Products, the events that occur within the Products, aggregated usage and performance data, and where the Applications were downloaded from. We may link the data we store within the analytics software to any personal data you submit within the mobile application.

LOG FILES
As true of most websites, we gather certain data and automatically and store it in log files. This data may include Internet Protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data.

If you receive the HTML-formatted version of our email newsletter, your opening of the newsletter is notified to us and saved. Your clicks on links in the newsletter are also saved. These and the open statistics are used in aggregate form to give us an indication of the popularity of the content and to help us make decisions about future content and formatting.

5. WHERE WE STORE YOUR PERSONAL DATA
All data you provide to us through the Products is stored on our secure servers located in Turkey, EU or the US. Any payment transactions will be encrypted using SSL technology; all payment data is stored with our payment processor and is never stored on InnerJoy’s servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the Products, you are responsible for keeping this password confidential. We ask you not to share a password with anyone, and suggest that you change your password frequently.

Unfortunately, the transmission of data via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the Products; any transmission is at your own risk. Once we have received your data, we will use strict procedures and security features to try to prevent unauthorized access.

6. CORPORATE AND OTHER COMMUNITY SHARING
InnerJoy is also offered through partnerships with organizations. Sometimes corporations, governments, hospitals, universities and other organizations and groups (“Partner(s)”) wish to make InnerJoy available to their members, employees and their families, patients, customers, residents or others. For example, employers may offer their employees and their families access to InnerJoy and brands that promote wellness may wish to and do offer InnerJoy through their loyalty programs. When an entity provides access to InnerJoy to others, we call those “Communities.” If you have registered to use the Products through a code, credential, or other means of registration furnished by a Partner (a “Community Subscription”), the Partner may have access to your name, email address, the date you registered to use the Products, and the date on which you last used the Products. The Partner may also have access to your Community’s aggregated and anonymized general usage data.

7. SINGLE SIGN-ON
You may be able to log-in to our Products using sign-in services such as Facebook Connect or an Open ID provider. These services will authenticate your identity, provide you the option to share certain personal data (such as your name and email address) with us, and to pre-populate our sign-up form. Services like Facebook Connect give you the option to post data about your activities on our Products or to your profile page to share with others within your network.

8. YOUR DATA RIGHTS
As you may know, a recent European Union law called the General Data Protection Regulation (“GDPR”) gives certain rights to applicable individuals in relation to their personal data. Accordingly, we have implemented transparency and access controls to help such users, including residents of the EU, Switzerland, and the United Kingdom exercise those rights. As required under applicable law, the rights afforded to you are: A right of access: you have the right to obtain (i) confirmation as to whether personal data concerning you are processed or not and, if processed, to obtain (ii) access to such data and a copy thereof. We provide an easy-to-view snapshot of such data via the “My Data” tab in the Products.

A right to rectification: you have the right to obtain the rectification of any inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

A right to erasure: in some cases, you have the right to obtain the erasure of personal data concerning you. Upon request, InnerJoy will permanently and irrevocably anonymize your data such that it can never be reconstructed to identify you as an individual. However, this is not an absolute right and InnerJoy may have legal or legitimate grounds for keeping such data.

A right to restriction of processing: in some cases, you have the right to obtain restriction of the processing of your personal data.

A right to data portability: you have the right to receive the personal data concerning you which you have provided to InnerJoy, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from InnerJoy. This right only applies when the processing of your personal data is based on your consent or on a contract and such processing is carried out by automated means.

A right to object to processing: you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you when such processing is based on the legitimate interest of InnerJoy. InnerJoy may, however, invoke compelling legitimate grounds for continued processing. When your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of such data. You may, in particular, exercise that right by clicking on the “unsubscribe” link provided at the bottom of any messages received, or by managing your privacy preferences by logging in to your InnerJoy account and following the instructions here.

A right to lodge a complaint with the competent supervisory authority: you have the right to contact the supervisory authority to complain about InnerJoy’s personal data protection practices.

A right to give instructions concerning the use of your data after your death: as required by applicable law, you may have the right to give InnerJoy instructions concerning the use of your personal data after your death. To exercise one or more of these rights, you can email support@innerjoy.app. You may access your personal data to modify or update at any time via an online account, or by emailing support@innerjoy.app.

We will respond to your request in a reasonable timeframe in accordance with applicable law.

9. USES MADE OF THE DATA
We use information held about you in the following ways:

To provide you with the Products.
To answer your questions or requests for information or handle your complaints.
To ensure that content provided by the Products is presented in the most effective manner for you and for your computer or other device.
To provide you with promotional communications, such as email, to the extent that you have provided consent to receive such communications under applicable law.
To carry out our obligations arising from any agreements entered into between you and us.
To allow you to participate in interactive features of the Products, when you choose to do so.
To notify you about updates or changes to Product features and content.
To understand your broad, non-specific geographic location to help us identify groups of users by general geographic market (such as zip code, state or country).
To account for applicable sales taxes based on zip codes provided to our payment processors for purchases made through the Website.
To inform Partners about your registration and use of the Products as described under Corporate and Other Community Sharing in section 6 above.
To serve our advertisements to you through third party platforms, such as Facebook or Google, on other sites and apps or across your devices, to the extent that you have provided consent for such uses under applicable law.
To provide you with the SMS Service to the extent that you have provided consent for such practices under applicable law.
We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
To manage your payments and orders.

If you are an existing customer, we will only contact you by electronic means (e-mail or in-Product communication) with information about products and services similar to those which were the subject of a previous sale to you, except if you opt-out to such communications.

If you choose to become a primary account holder of a InnerJoy Family plan, we may cross reference the address you’ve provided with that of any subsidiary account holder seeking to join your InnerJoy Family plan in order to verify the validity of the subsidiary account holder.

If you choose to become a subsidiary account holder of a InnerJoy Family plan, we may cross reference the address you’ve provided with that of any primary account holder administering your InnerJoy Family plan in order to verify the validity of your subsidiary account.

Any data gathered in the health, fitness, and motion context, including but not limited to the data gathered from HealthKit Framework and GoogleFit SDK, may only be used for improving your health management and may not be used for marketing, advertising marketing, or use-based data mining purposes. 

10. LEGAL BASES OF PERSONAL DATA PROCESSING
In accordance with GDPR, InnerJoy provides the following information regarding its Article 6 legal bases for personal data processing:

The performance of the contract (the InnerJoy Terms & Conditions) between you and InnerJoy for the data processing relating to your use of InnerJoy’s Products (including your orders and payments);

InnerJoy’s legitimate interest, more specifically:

Our business interest in providing you with emails and push notifications for timely introductory materials and information about your InnerJoy account, our Product features and updates, and offers to upgrade your free account to a subscription account.

Our financial interest in providing you with promotional offers and/or discounts with respect to paid subscriptions and special offerings, such as the InnerJoy Family Plan.

Our business interest in offering you particularized or adapted content based on your usage of the Products.

Our business interest in collecting data regarding your general usage activities for the purpose of improving our InnerJoy user experience.

Our business interest in requesting that you partake in Product surveys in order to better understand your needs and expectations.

Our financial interest in providing you the opportunity to purchase InnerJoy subscriptions for the benefit of a third party through the InnerJoy “gifting” program.

Our business interest in providing you the opportunity to invite a “Buddy” to InnerJoy and share information about your InnerJoy activities with your connected “Buddies”.

Our business interest in providing you with customer service communications regarding your account, questions about our content offerings or your mindfulness practice, or any other matters directed to customer service staff, in order to have clear and easy communication with you and to respond to all your requests.

Our business interest in collecting data related to unplanned downtime or errors in the Products.

Our business interest in complying with our legal obligations, such as maintaining accurate financial records.

Our business interest in verifying your eligibility in a Community and providing limited reporting to Partners associated with such Community, as further described in section
6.

11. DISCLOSURE OF YOUR DATA
We may disclose your personal data to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.

We may also disclose your personal data to third parties as follows:

In some circumstances, based on your specific requests, we may need to disclose your personal data to a third party so that it can provide a service you have requested from such party, or fulfill a request for data from such party. An example of this is the SMS Service.
In some circumstances, we may disclose the personal data that you have provided to InnerJoy to a third party that offers and/or provides goods or services complementary to our own for the purpose of enhancing our users’ experiences by offering you integrated or complementary functionality, complementary services or bundled pricing options.
If InnerJoy’s service providers (like hosting, IT maintenance, market analytics, and payment service providers) require this data to provide services to InnerJoy. InnerJoy requires each of its service providers to agree to maintain the confidentiality and security of your personal data.
In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

If InnerJoy or substantially all of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets.

If we are under a duty to disclose or share your personal data in order to comply with any legal obligation such as to comply with a subpoena, bankruptcy proceedings, similar legal process, or in order to enforce or apply our agreements with you; or to protect the rights, property, or safety of InnerJoy, our customers, or others. This includes exchanging data with other companies and organizations for the purposes of fraud protection and credit risk reduction.

With your Community, if your subscription is a Community Subscription, as described under Corporate and Other Community Sharing above.

With third parties, such as Facebook, in order to serve InnerJoy advertisements on such third party platforms, to the extent that you have consented to such practices under applicable law.

If you choose to have your account verified to confirm your status as a student, we may allow a third party platform to access the specific personal data you provide in order to perform the verification.

If you chose to have your account verified to confirm your status as a US-based healthcare provider, we may collect your National Provider Identifier (“NPI”) in connection with your email address in order to perform the verification.

We would like to remind you that we do not share any of your Personal Data related to your health, motion and fitness, and any information gained through the HealthKit framework or Google Fit SDK with third parties for marketing and advertising purposes.

12. DATA RETENTION
The retention periods applied by InnerJoy comply with applicable legislation in effect on the date hereof, namely:

For data relating to your account: such data will be permanently and irrevocably anonymized in the event that your account is: (i) inactive for a period of two (2) years; and (2) not subscribed to “InnerJoy Plus.” Moreover, we will permanently and irrevocably anonymize your account data within thirty (30) days of your written request to do so via email to support@innerjoy.app.

For transactional data relating to your purchases: such data is kept for the entire period of the contractual relationship, then in accordance with legal obligations and applicable statute of limitation periods. Please note that this data does not include

Payment Card information, which is processed by our third-party payment processors, and not InnerJoy.

For data collected based on your consent to receive our marketing communications: we will use such data until you withdraw consent or applicable law requires that such data is no longer used.

When your data are collected in the context of requests/queries: such data are kept for the period necessary to process and reply to such requests or queries.

When cookies or other trackers are placed on your terminal, they are kept for a period of 12 months. Other data will be kept as long as necessary for the purposes pursued and in compliance with our legal obligations, including the applicable statute of limitations.

13. WITHDRAWAL OF CONSENT FOR PROCESSING ACTIVITIES
To the extent that you have provided appropriate consent under applicable law to certain processing activities, such consent can be withdrawn at any time by emailing support@innerjoy.app.

14. LINKS TO THIRD PARTY SITES
The Products may, from time to time, contain links to and from the Products of our partner networks, advertisers and affiliates. If you follow a link to any of these external websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these websites or their policies. Please check these policies before you submit any personal data to these external websites.

15. SOCIAL MEDIA WIDGETS
Our Products include social media features, such as the Facebook Like button, and widgets, such as the “Share This” button, or interactive mini-programs. These features may collect your Internet protocol address, which page you are visiting on or Products, and may set a cookie to enable the feature to function properly. Social media features and widgets are hosted by a third party or hosted directly on our Products. Your interactions with these features are governed by the privacy statement of the company providing it.

16. HEALTHKIT
Apple iOS users may opt-in to allow the Products to provide data regarding the amount of minutes meditated to the Apple iOS “Health” application for display. This data will not be shared with third parties or used for marketing purposes.

17. USE OF InnerJoy BY MINORS
You must be 18 years of age, or the age of majority in your province, territory or country, to sign up as a registered user of the Products. Individuals under the age of 18, or the applicable age of majority, may utilize the Products only with the involvement of a parent or legal guardian under such person’s account.

18. DATA POSTED ON FORUMS
InnerJoy users may have the ability to post content to one or more InnerJoy forums. All such users may request and obtain removal of such posted content by contacting InnerJoy at support@innerjoy.app and specifically identifying the content to be removed. Please be advised that any such removal does not ensure complete or comprehensive removal of all traces of the content posted on the InnerJoy forum(s).

19. CHANGES TO OUR PRIVACY POLICY
We may update this Privacy Policy to reflect changes to our data practices. If we make any material changes we will notify you by in-Product message, email (sent to the e-mail address specified in your account) or by means of a notice in the Products prior to the change becoming effective. We encourage you to periodically review this page for the latest data on our privacy practices.

20. CONTACT

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to support@innerjoy.app.

InnerJoy’s principal office address is Sultan Selim M. Sultan Selim C. No: 1/5 Kagithane / Istanbul / Turkey

21. TRANSMISSION TO OTHER COUNTRIES
The subsidiaries, service providers or other third parties listed above to whom InnerJoy may disclose your personal data may be domiciled abroad, and in particular outside the European Union, Switzerland, and the United Kingdom.

In such case, InnerJoy will require them to take, in accordance with applicable legislation, contractual, organizational and technical measures designed to ensure an adequate level of protection of your personal data, such as the use of Standard Contractual Clauses approved by the European Commission.

We remain certified under the EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield (https://www.privacyshield.gov/) and are committed to the important privacy principles set forth in Privacy Shield. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield List. https://www.privacyshield.gov/list

However, in light of the recent Schrems II decision by the European Court of Justice on July 16, 2020, we are no longer relying on EU-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield and are working to implement other transfer mechanisms such as Standard Contractual Clauses to address any transfers of personal data to the U.S., consistent with applicable law.

For personal data collected from individuals located in the European Union, Switzerland and the United Kingdom, you have the ability to opt-out of whether such personal data is disclosed to a third-party (apart from service providers) or is to be used for a purpose that is materially different for the purpose for which it was originally collected or subsequently authorized. You can contact InnerJoy at support@innerjoy.app in order to make such choices.

CCPA ADDENDUM

Effective Date: January 1, 2020 Last Reviewed On: December 20, 2019

This California Consumer Privacy Act (“CCPA”) Addendum for California residents supplements the information contained in the above Privacy Policy and applies solely to all visitors, users and others who reside in the State of California. We adopt this CCPA Addendum to comply with the CCPA, and any terms defined in the CCPA have the same meaning when used in this Addendum.

1. INFORMATION WE MAY COLLECT FROM YOU
Our Products collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, the Products have collected the following categories of personal information from consumers within the last twelve (12) months:

CATEGORY EXAMPLES COLLECTED
Identifiers First and last name, email address, Internet Protocol address, online identifiers. Yes
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). First and last name. Yes
Internet or other similar network activity. Browsing history or information on a consumer’s interaction with the Products or our advertisements on third-party platforms. Yes

The specific types of personal information we collect are described more fully in section 1 of the Privacy Policy. Personal information does not include: (1) deidentified or aggregated consumer information; (2) publicly available information from government records; or (3) information excluded from the CCPA’s scope.

We obtain the categories of personal information listed above from the following categories of sources:

Directly from you. For example, from forms you complete when registering for the Products. Indirectly from you. For example, from observing your actions on our Products.

Directly from Partners associated with your Community, if you have a Community Subscription that is authenticated through the Community’s use of eligibility files as described in section 6 of the Privacy Policy.

2. USE OF PERSONAL INFORMATION
We may use or disclose the personal information we collect for the purposes described in section 9 of the Privacy Policy.

3. SHARING PERSONAL INFORMATION
We may disclose your personal information to third parties for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not to use it for any purpose except performing the contract.  Any third party with whom InnerJoy shares user data will provide the same or equal protection of user data as stated in the this privacy policy and required by the App Store Guidelines. In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

Category 1: Identifiers
Category 2: Personal Information
Category 3: Internet activity
Specific examples of such sharing activities can be found in sections 6 and 11 of the Privacy Policy.

4. YOUR RIGHTS AND CHOICES
Access to Specific Information and Data Portability Rights The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting that personal information.
The categories of third parties with whom we share that personal information.
The categories of personal information we share with third parties.
The specific pieces of personal information we collected about you (also called a data portability request).

Deletion Request Rights
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will permanently and irrevocably anonymize your personal information, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).

Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

Comply with a legal obligation.

Make other internal and lawful uses of that information that are compatible with the context in which you provided it. Exercising Access, Data Portability, and Deletion Rights To exercise the access, data portability, and deletion rights described above,
please submit a verifiable consumer request to us by either:
Emailing us at support@innerjoy.app

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. We also provide an easy-to-view snapshot of your personal information that we have processed via the “My Data” tab in the Products.

Response Timing and Format
Upon receiving a request for access, portability, or deletion, we will confirm receipt of the request within 10 days and provide information about our verification process and how we will process the request.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response to the email address associated with the account for account holders, and to the email address provided with the request submission for non-account holders.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily readable and useable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

5. Cookie-Based Marketing Opt-Out
Like most companies, we partner with third parties, such as Facebook and Google, to manage our marketing of InnerJoy on other platforms, where such advertising is based on your past visits to our Products. These third party partners may use technologies, such as cookies, to gather information about your activities on the Products to deliver such advertising to you when you visit their platforms. For instance, if you visit www.innerjoy.app, a cookie may be attached to your browser in the form of the Facebook Pixel that allows InnerJoy to deliver advertising to you on the Facebook platform.

You can opt-out of the above-referenced cookie-based retargeting by visiting the InnerJoy Cookie Policy and clicking “opt-out of marketing / analytics cookies” at the bottom of the page. Doing so will erase all current marketing cookies and disable the placement of future marketing cookies.

We do NOT use cookies so that third parties can serve ads to you about their own products or services.

We do NOT sell or rent your personal information to any third parties for their own advertising or marketing purposes.

6. Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

7. Changes to our CCPA Addendum
We reserve the right to amend this CCPA Addendum at our discretion and at any time. When we make changes to this CCPA Addendum, we will post the updated notice on the Website and update the effective date. Your continued use of our Products following the posting of changes constitutes your acceptance of such changes.

8. Contact Information
If you have any questions or comments about this CCPA Addendum, the ways in which we collect and use your information described above and in the Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Email: support@innerjoy.app

Postal Address: Inner Joy Meditation Yazilim ve Bilgi Teknolojileri Anonim Sirketi.,
Attn: Legal ; Sultan Selim M. Sultan Selim C. No: 1/5 Kagithane / İstanbul / Turkey