KVKK Information Notice

1. The data controller

Your personal data is processed by Nodelabs Software Ltd, established in the United Kingdom ("we", "us"), as data controller within the meaning of Article 3 of the KVKK, in connection with the ElvanOnline mobile game, its account service, game servers, community forum, voice chat, closed beta waitlist and the website elvanonline.com (together, the "Service").

2. Whose data we process

• Players: persons who create an account in the ElvanOnline app with Sign in with Apple, Sign in with Google or as a guest, and play the game.
• Forum and voice chat users: players who use the community forum or voice chat.
• Beta waitlist applicants: persons who leave their email address on elvanonline.com to be invited to the closed beta.
• Website visitors: persons who visit elvanonline.com.
• Persons who contact us: persons who write to our support address or open a support request in the community forum.

3. Categories of personal data

We do not process special categories of personal data listed in Article 6 of the KVKK. Please do not share such data in chat, the forum, voice chat or support requests.

4. Purposes of processing

We process your personal data for the following purposes:

• creating and managing your account, signing you in and keeping you signed in, and connecting you to our game servers;
• providing the game and its features, including saving your characters and progress, chat, guilds and trading;
• providing the community forum, voice chat and push notifications you choose to use;
• ensuring the security of the Service, accounts and data: detecting unusual sign-ins, preventing and investigating cheating, bots, multiple-account abuse, ban evasion and fraud;
• moderating chat, the forum and voice chat, handling reports and enforcing our Terms of Service and community rules;
• running the closed beta waitlist, sending beta invitations and preventing automated sign-ups;
• answering your requests and complaints, including requests under Article 11 of the KVKK;
• informing you about important changes to the Service, our Terms or our policies;
• showing other players, in the game, the flag of the country you sign in from (the country is derived from your sign-in IP address; no other location or network information is shown);
• producing aggregated statistics (for example, players per country or platform) to plan and improve the Service; and
• complying with our legal obligations, responding to requests of authorised public institutions and courts, and establishing, exercising or protecting our rights.

5. Legal grounds

We process your personal data on the following legal grounds in Article 5(2) of the KVKK, without relying on your explicit consent:

• Article 5(2)(c): processing is directly related to the establishment or performance of a contract and necessary for the parties to it: providing the Service under our Terms of Service, and taking the steps you request before you join the Service (the beta waitlist);
• Article 5(2)(ç): processing is necessary for us to fulfil a legal obligation, such as responding to lawful requests and keeping records required by law;
• Article 5(2)(a): processing is expressly provided for by law;
• Article 5(2)(e): processing is necessary for the establishment, exercise or protection of a right, such as handling disputes and enforcing bans; and
• Article 5(2)(f): processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms: keeping the game fair and secure, preventing abuse and fraud through sign-in records and IP address information, moderating the Service and producing aggregated statistics.

The use of your microphone for voice chat and the delivery of push notifications also depend on the permission you grant on your device, which you can withdraw at any time in your device settings.

6. Method of collection

Your personal data is collected by fully or partially automated means through the ElvanOnline app, our account service and game servers, the community forum, the voice server, elvanonline.com and our support email address, as follows:

• from you, when you enter it (for example, the email address on the beta waitlist, your forum nickname and posts, messages to support, or support requests and their attachments);
• from Apple or Google, in the signed identity token they issue when you sign in with them;
• automatically, when your device connects to our servers (for example, IP addresses, platform and app version, sign-in times and in-game events); and
• from an IP intelligence database (ipapi.is, queried through our own IP lookup service), which provides the approximate location and network information associated with an IP address.

7. Recipients and transfers

Within the limits of Article 8 of the KVKK and for the purposes above, your personal data may be transferred to:

• service providers acting on our behalf: hosting and data-centre providers (such as Hetzner Online GmbH); Cloudflare, Inc. (website hosting, network protection, content delivery and storage); ipapi.is (IP intelligence, IP addresses only); Google LLC (Google Fonts on our website); and our email provider;
• Apple Inc. and Google LLC, for sign-in and for delivering push notifications (Apple Push Notification service, Firebase Cloud Messaging);
• other players, to the extent required by the nature of the game: character names and in-game actions, chat messages, forum nickname, badge and posts, and your voice in real time in voice chat;
• authorised public institutions and courts, upon their lawful request or where required by law; and
• a successor business, in the case of a merger, acquisition or transfer of the Service, subject to the same protections.

We do not sell your personal data or transfer it to third parties for advertising or marketing.

8. Transfers abroad

Some of the recipients above process data outside Türkiye, including in the United Kingdom, the European Union and the United States. We transfer personal data abroad in accordance with Article 9 of the KVKK: on the basis of an adequacy decision of the Personal Data Protection Board where one exists; otherwise by providing appropriate safeguards, such as the standard contracts announced by the Board (which are notified to the Personal Data Protection Authority within the statutory period); or, for incidental transfers, on one of the grounds in Article 9(6). You can ask us for information about the safeguard used for a specific transfer.

9. Retention and destruction

We keep personal data for as long as required by the purpose of processing and the applicable legislation, and then delete, destroy or anonymise it ex officio or upon your request, in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. For example, sign-in and app launch records are deleted automatically after 180 days, voice room membership after 24 hours, unused sessions after 90 days and support request attachments 90 days after the request is closed. The full list of retention periods is in section 9 of our Privacy Policy.

10. Your rights under Article 11

As a data subject, you have the right to apply to us and:

1. learn whether your personal data is processed;
2. request information about the processing if your personal data has been processed;
3. learn the purpose of the processing and whether your data is used in accordance with that purpose;
4. know the third parties in Türkiye or abroad to whom your personal data is transferred;
5. request correction of your personal data if it is incomplete or inaccurate;
6. request deletion or destruction of your personal data under the conditions in Article 7 of the KVKK;
7. request that the third parties to whom your personal data was transferred be notified of the operations carried out under (e) and (f);
8. object to an outcome against you that arises from the analysis of your personal data exclusively by automated systems; and
9. claim compensation for damage you suffer because your personal data was processed unlawfully.

11. How to apply to us

Under Article 13 of the KVKK and the Communiqué on the Principles and Procedures for Applications to the Data Controller, you can submit your application:

• in writing, by a signed letter sent to us (please ask us at the email address below for our postal address); or
• by email to support@elvanonline.com from an email address you have previously notified to us and that is registered in our systems (for example, the email address linked to your ElvanOnline account or entered on the beta waitlist), or using a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature.

Your application should include your name and surname and, if written, your signature; for citizens of Türkiye, your Turkish identity number, or for foreign nationals, your nationality and passport or identity number; your residential or business address for notifications; your email address and, if available, telephone number; and the subject of your request. To help us find your data, please also include your character name or the email address linked to your account. The Communiqué provides that applications are made in Turkish; we also accept applications in English.

We will conclude your application free of charge as soon as possible and at the latest within 30 days, depending on the nature of the request. If the request requires an additional cost, we may charge the fee set by the Personal Data Protection Board. We may ask for information to verify that you are the data subject. If your application is rejected, our answer is found insufficient or we do not answer in time, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of our answer and in any case within 60 days of the date of your application.

12. Updates to this notice

We may update this notice when our processing activities or the law change. The current version is always available at elvanonline.com/kvkk, with the date of the last update at the top of the page.