KVKK Information Notice (Aydınlatma Metni)

This Information Notice has been prepared by Türkiye Oyun Geliştiricileri Derneği ("TOGED"), in its capacity as data controller, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation, in order to inform visitors of the Games from Türkiye website (the "Site").

This English text is provided for the convenience of non-Turkish-speaking readers; it summarises the rights and obligations set out in Turkish law. The legally binding KVKK reference text is the Turkish version of this Notice.

1. Identity of the data controller and the operator

Data Controller

• Türkiye Oyun Geliştiricileri Derneği (TOGED)
• Address: Teknoloji Geliştirme Bölgesi, Üniversiteler Mahallesi, Bilkent Cyberpark, Çankaya / Ankara, Türkiye
• Email: privacy@gamesfromturkiye.com

Data Processor (Site Operator)

• Seti Medya İletişim Ltd. Şti.
• Address: Göksu Otağtepe Caddesi, Onur Sitesi, Beykoz / İstanbul, Türkiye

Seti Medya processes your personal data only on the documented instructions of TOGED and under a written data-processing agreement.

2. Categories of personal data processed

The following categories of personal data, within the meaning of Article 3 of the KVKK, are processed through the Site:

• Identity data — first name, last name, the organisation you represent and your role.
• Contact data — email address and, if you choose to provide them, telephone number and postal address.
• Customer / applicant transaction data — the content of the application, question, or request you submit through a form.
• Studio data — the name, founding year, location (city and the latitude / longitude used by the studio map), website, social-media handles, and short description of the Turkish game studio you represent.
• Process-security data — IP address, browser information (User-Agent), session records, log records, and the IP hash used for rate-limiting.
• Marketing data — if you subscribe to the newsletter: your email address, the timestamp of your double-opt-in confirmation, and engagement information related to the newsletter.
• Account data — when you claim and edit a studio listing: the email address used for magic-link sign-in and the timestamps of each sign-in.
• Chatbot interaction data — when you use the incentives chatbot: the prompt text you submit, the generated reply, and the time of the interaction.
• Consent records — the version of the legal text you accepted, the timestamp of your acceptance, your IP address, and your User-Agent.

Special-category personal data (such as health, religion, sexual orientation, biometric, or genetic data) is not knowingly processed through the Site. Please do not include such data in any free-text field.

3. Purposes of processing

Your personal data is processed in accordance with the general principles set out in Article 4 of the KVKK and the conditions set out in Article 5, for the following purposes:

• to receive, evaluate, and respond to applications, inquiries, and contact requests submitted through the Site;
• to review submissions about Turkish game studios, to publish approved studio listings on the Site, and to display them on the studio map;
• to authenticate studio owners through magic-link sign-in for the studio-owner edit area;
• to operate the newsletter and manage commercial-electronic-message consent;
• to operate the incentives chatbot service;
• to keep the Site and its services secure, to prevent abuse and detect fraud;
• to measure and improve usage of the Site through Google Analytics, on the basis of your explicit consent, in aggregate form;
• to comply with obligations arising from the KVKK and other legislation, to maintain audit logs, and to respond to lawful requests from competent public authorities.

4. Legal grounds for processing

Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the KVKK:

• KVKK Art. 5(2)(a): processing is expressly provided for by law (for example, retention of commercial-electronic-message consent records under Law No. 6563 on the Regulation of Electronic Commerce).
• KVKK Art. 5(2)(c): processing is directly related to the formation or performance of a contract (for example, operating the studio-owner edit area).
• KVKK Art. 5(2)(ç): processing is necessary for the controller to comply with its legal obligations.
• KVKK Art. 5(2)(e): processing is necessary for the establishment, exercise, or protection of a right.
• KVKK Art. 5(2)(f): processing is necessary for the legitimate interests of the controller, provided that fundamental rights and freedoms of the data subject are not harmed (for example, Site security, error diagnosis, and abuse prevention).
• KVKK Art. 5(1): your explicit consent, in particular for newsletter subscription, publication of the studio listing, use of the incentives chatbot, analytics cookies, and any cross-border transfers carried out on the basis of explicit consent.

5. Recipients and purposes of transfer

Your personal data may be transferred, in compliance with Articles 8 and 9 of the KVKK and only for the purposes set out above, to:

• the authorised editorial team within TOGED for the evaluation of applications and requests;
• the data processor Seti Medya İletişim Ltd. Şti. for operating the Site, on the documented instructions of TOGED;
• hosting and database providers located in Türkiye and within the European Union for storing the Site infrastructure and data, in compliance with KVKK Art. 8 and, where applicable, Art. 9;
• email-delivery providers for the transmission of transactional emails and newsletter messages;
• large-language-model providers (OpenAI and Anthropic) solely for the operation of the incentives chatbot, for the purpose of generating a reply to your prompt. The prompt you submit is transmitted to the relevant provider; please do not include personal data in chatbot prompts.
• competent public authorities and judicial bodies when we are required to disclose by law, court order, or a binding official request;
• with your explicit consent — data you submit for publication on the Site (for example, an approved studio listing) becomes publicly accessible to all visitors of the Site.

Your personal data is under no circumstances sold or transferred to third parties for those parties' own marketing purposes.

6. Cross-border transfers

Some of our sub-processors and the language-model providers used for the incentives chatbot (OpenAI and Anthropic) are established outside Türkiye, including in the United States. Cross-border transfers are carried out under Article 9 of the KVKK on the following basis:

• on the basis of your explicit consent under Article 9 of the KVKK; or
• on the basis of one of the exceptions provided in Article 9 of the KVKK, where applicable; and
• through written agreements with the relevant providers, reinforced by the Standard Contractual Clauses adopted by the European Commission and supplementary technical and organisational measures.

You may request further information about the transfer mechanisms by writing to privacy@gamesfromturkiye.com.

7. Method of collection

Your personal data is collected through the Site, by automatic or partly automatic means, in electronic form, when you fill in forms, subscribe to the newsletter, interact with the chatbot, sign in as a studio owner, or otherwise use the Site. In addition, technical data such as your IP address and User-Agent is collected automatically from your browser.

8. Retention periods

Your personal data is retained only for the minimum period necessary for the relevant purpose and in accordance with TOGED's Personal Data Retention and Destruction Policy. Indicative retention periods are:

• form submissions and inquiries — 24 months;
• consent records — 24 months;
• newsletter subscription records — until unsubscribe; plus a suppression record evidencing the unsubscribe;
• studio-owner account records — for as long as the listing is published and 12 months after removal;
• chatbot interaction records — short-term operational retention only;
• cookie and analytics data — as described in the Cookie Policy;
• records subject to a statutory retention obligation — for the period prescribed by the relevant legislation.

Personal data whose retention period has expired is deleted, destroyed, or fully anonymised.

9. Your rights under Article 11 of the KVKK

In accordance with Article 11 of the KVKK, you may apply to TOGED as the data controller to exercise the following rights:

• to learn whether your personal data is processed;
• to request information about the processing if your personal data has been processed;
• to learn the purpose of the processing and whether the data is used in line with that purpose;
• to learn the third parties to whom your personal data is transferred, in Türkiye or abroad;
• to request rectification of incomplete or inaccurate personal data;
• to request the deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
• to request that rectification, deletion, and destruction operations are notified to the third parties to whom your personal data has been transferred;
• to object to results that arise to your detriment from the analysis of your personal data exclusively by automated means;
• to claim compensation for damage suffered as a result of the unlawful processing of your personal data.

10. How to make an application

To exercise the rights above, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller, you may apply:

• by email to privacy@gamesfromturkiye.com from your registered email address or together with information that allows us to verify your identity; or
• in writing, with a wet-ink signature, to the postal address of TOGED set out above.

In accordance with Article 13 of the KVKK, your application will be answered free of charge within thirty (30) days at the latest. If the operation requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.

We may need to verify your identity before acting on your request. If you consider that your application has been concluded contrary to the KVKK, you have the right under Article 14 of the KVKK to file a complaint with the Turkish Personal Data Protection Authority in cases where the application is rejected, the response is found insufficient, or no response is provided within the statutory time limit.

11. Data concerning children

The Site is not designed for children. We do not knowingly collect personal data from children under the age of thirteen (13). The Families page is intended to inform parents and guardians.

12. Updates to this Information Notice

This Information Notice may be updated to reflect changes to applicable legislation or to our processing activities. Each version is identified by the version number and effective date displayed at the top of this page. Material changes are announced on the Site, and where required your explicit consent is requested again.