Personal Data Protection and Processing Policy

Target audience: All natural persons whose personal data is processed in connection with the Race Of Words mobile application and website.

Prepared and approved by: Adil Onur Karahan Şahıs Şirketi.

1. Introduction

Adil Onur Karahan Şahıs Şirketi (the “Company”) provides its users with word puzzle, duel, quiz, league and social gaming services through the Race Of Words mobile application and website (the “Platform”).

The Company attaches importance to the protection of personal data in its activities. This Personal Data Protection and Processing Policy (the “Policy”) is the fundamental regulation concerning the application of the procedures and principles laid down by Law No. 6698 on the Protection of Personal Data (the “Law”) to the business processes within the scope of the Platform.

1.1. Purpose

The purpose of this Policy is to ensure the effective application of the procedures and principles provided for by the Law and the related legislation in business processes within the scope of the Platform. The Company takes the necessary administrative and technical measures for the processing and protection of personal data and raises awareness.

1.2. Scope

The Policy covers all personal data obtained in business processes within the scope of the Platform by automated means, or by non-automated means provided that they form part of a data filing system.

1.3. Basis

The Policy is based on the Law and the related legislation. Personal data is also processed to fulfil obligations arising from the legislation to which the Company is subject, in particular Law No. 6563 on the Regulation of Electronic Commerce, Turkish Commercial Code No. 6102, Tax Procedure Law No. 213, Law No. 5651 on the Regulation of Publications on the Internet, Turkish Penal Code No. 5237 and Law No. 6502 on Consumer Protection. In the event of any inconsistency between the legislation in force and the Policy, the legislation in force prevails.

1.4. Definitions

2. Protection of personal data

2.1. Ensuring the security of personal data: In order to prevent the unlawful disclosure of, access to or transfer of personal data, or security problems that may arise in other ways, the Company takes the measures provided for in Article 12 of the Law according to the nature of the data and takes into account the guidelines published by the Authority.

2.2. Special categories of personal data: The operation of the Platform does not require special categories of personal data; such data is not requested. Should it become necessary to process a special category of data, it will be processed in accordance with Article 6 of the Law and the measures determined by the Board.

2.3. Awareness: The Company ensures that persons who access personal data are aware of the need to process and protect such data lawfully, and updates these efforts in line with changes in the legislation.

3. Processing of personal data

3.1. General principles — Personal data is processed in accordance with the principles set out in Article 4 of the Law:

• Lawfulness and fairness: processing to the extent required by business processes and without harming the fundamental rights and freedoms of persons.
• Being accurate and, where necessary, up to date: taking the necessary measures to keep processed data accurate and up to date.
• Processing for specified, explicit and legitimate purposes.
• Being relevant, limited and proportionate to the purposes for which they are processed.
• Retention for the period provided for in the legislation or necessary for the purpose of processing; deletion, destruction or anonymisation at the end of that period.

3.2. Conditions for processing — Personal data is processed on the basis of at least one of the conditions listed in Article 5 of the Law:

• It is expressly provided for by law,
• It is mandatory for the protection of the life or bodily integrity of the person, or of another person, who is unable to express consent due to actual impossibility,
• It is directly related to the establishment or performance of a contract (operations under the membership agreement are based on this condition),
• It is mandatory for the Company to fulfil its legal obligation,
• It has been made public by the data subject himself or herself,
• It is mandatory for the establishment, exercise or protection of a right,
• It is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject,
• Where none of the above conditions exists, the data subject has given explicit consent.

Data processing necessary for membership is not made conditional upon explicit consent. Explicit consent is sought only for matters for which it must be obtained separately and on an optional basis, and it may be withdrawn at any time.

3.3. Informing the data subject: Personal data subjects are informed, by means of the KVKK Information Notice and the Privacy Policy published on the Platform, of the purposes for which their data is processed, with whom it is shared, the methods by which it is collected, the legal grounds and the rights they have.

3.4. Sharing of personal data: Personal data may be shared with third parties in line with the purposes of processing and subject to the necessary security measures, in accordance with Article 8 of the Law and, in the case of transfers abroad, Article 9 of the Law.

4. Data categories and recipient groups

The main data categories processed within the scope of the Platform are: identity and account information, contact information, Platform usage information, purchase information, transaction security information, advertising information, and request and legal transaction information. Which data is processed for which purpose and on which legal ground is set out in detail in the KVKK Information Notice.

Personal data may be shared, for the specified purposes and in accordance with the principles in Section 3.4, with the following recipient groups:

Since the Platform is a multiplayer game, the username, profile photo, level, league and ranking information and clan membership may be viewed by other players within the Platform.

5. Measures for the protection of personal data

The Company takes the necessary technical and organisational measures to protect the personal data it processes. Accordingly, data is encrypted with SSL/TLS during transmission, passwords are stored in an irreversible form, card details are not held by the Company, access to personal data is restricted by authorisation, and regular checks are carried out for security vulnerabilities. If, despite all measures taken, personal data is obtained by third parties by unlawful means, the Company will notify the data subjects concerned and the Board of this situation as soon as possible.

6. Retention and destruction of personal data

The Company retains personal data for the period provided for in the relevant legislation, if any, and otherwise for the period necessary for the purpose of processing. Retention periods by data category are set out in the Personal Data Retention and Destruction Policy. Personal data whose retention period has expired is destroyed by one of the methods of deletion, destruction or anonymisation. Destruction carried out upon the application of the data subject is subject to the same principles.

7. Rights of personal data subjects

7.1. Rights — Pursuant to Article 11 of the Law, personal data subjects have the following rights:

• to learn whether your personal data is being processed,
• to request information about the processing if your personal data has been processed,
• to learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• to know the third parties to whom your personal data is transferred within Turkey or abroad,
• to request the rectification of your personal data if it is incomplete or inaccurately processed, and to request that this operation be notified to the third parties to whom your personal data has been transferred,
• to request the erasure or destruction of your personal data where the reasons requiring its processing no longer exist, even though it has been processed in accordance with the Law, and to request that this operation be notified to the third parties to whom your personal data has been transferred,
• to object to a result arising to your detriment by means of the analysis of the processed data exclusively through automated systems,
• to claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.

7.2. Exercise of rights — Personal data subjects may submit their requests concerning these rights by means of the Data Subject Application Form on our Policies page, or by a petition in accordance with the Communiqué, through the following channels:

We kindly ask you to write “Kişisel Verilerin Korunması Kanunu İlgili Kişi Talebi” (Personal Data Protection Law – Data Subject Request) in the subject line of the application envelope or e-mail.

*For applications made in person, only the front side of the document identifying you must be presented (in such a way that the blood type and religion fields are not visible).

7.3. Responding to applications — The Company concludes duly submitted applications free of charge as soon as possible and within 30 (thirty) days at the latest. If the operation requires an additional cost, a fee may be charged in accordance with the tariff determined by the Board.

7.4. Cases in which an application may be rejected — The Company may reject an application, stating its reasons, in the cases listed in Article 28 of the Law (such as processing for statistical purposes by anonymisation; processing for artistic, historical, literary or scientific purposes or within the scope of freedom of expression; judicial and enforcement proceedings; the prevention or investigation of crime; data made public by the person himself or herself; the supervisory and regulatory duties of public institutions; the protection of the economic and financial interests of the State), and where the application is likely to impede the rights and freedoms of others, requires disproportionate effort, or the requested information is publicly available.

7.5. Right to lodge a complaint with the Board — If the application is rejected, the response given is found insufficient, or no response is given in time, the data subject may lodge a complaint with the Board within thirty days from the date on which he or she learns of the Company’s response, and in any case within sixty days from the date of application.

7.6. Information that may be requested from the applicant — In order to determine whether the applicant is the personal data subject and to clarify the application, the Company may request additional information from the data subject and ask questions about the application.

8. Implementation

The Policy has been put into force upon approval by the Company’s authorised officer. The Company’s authorised officer is responsible for the implementation and updating of the Policy and for monitoring the work and operations within this scope. The technical implementation of the Policy is ensured through the Personal Data Retention and Destruction Policy.

9. Entry into force and publication

The Policy enters into force on the date of its publication on the Platform. Amendments to the Policy are made available to personal data subjects by being published on the Platform and apply from the date of their publication.