Privacy Policy

ARTICLE 1 — PURPOSE AND SCOPE

1.1. This Privacy Policy and KVKK Information Notice (the "Policy") has been prepared pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "KVKK") and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform, in order to inform natural persons who visit the Platform, become members, or carry out transactions through the Platform about the processing of their personal data.

1.2. Data is processed lawfully and in accordance with the principles of good faith; accurately and, where necessary, kept up to date; for specific, explicit and legitimate purposes; in a manner that is relevant to, limited to and proportionate with those purposes; and is retained for the period prescribed by legislation or required for the purpose for which it is processed (Article 4 of the KVKK).

ARTICLE 2 — IDENTITY OF THE DATA CONTROLLER

The group company is involved solely in international payment collection processes and, in that capacity, is a category of recipients subject to the international transfer regime described in Article 9; the data controller is in every case HİPOPOTAMYA BİLİŞİM LİMİTED ŞİRKETİ.

ARTICLE 3 — CATEGORIES OF PERSONAL DATA PROCESSED

ARTICLE 4 — COLLECTION METHODS

4.1. Data is collected through forms on the Platform and its mobile interfaces, account and order transactions, cookies and similar technologies, support channels, e-mail/KEP correspondence, transaction results returned by payment institutions, profile information shared by social login providers, and identity verification services; by wholly or partly automated means, or by non-automated means forming part of a data filing system.

ARTICLE 5 — PURPOSES OF PROCESSING

• Establishing the membership; managing the account and sessions;
• Carrying out order, delivery, wallet and withdrawal processes;
• Managing buyer–seller and supporter–streamer transactions and the related escrow (hold) and payment flows within the Player Market and Streamer Support;
• Issuing invoices and statutory documents; accounting and tax obligations;
• Preventing fraud, detecting suspicious transactions, and ensuring information security;
• Identity and contact verification (SMS/e-mail verification; where necessary, confirmation of identity against official records);
• Resolving support requests and complaints;
• Improving the service, detecting errors, and statistical analysis;
• Fulfilling legal obligations and responding to requests of competent authorities;
• Where explicit consent/approval has been given: displaying the supporter's message/name on stream, non-essential cookies, and e-mail newsletter/campaign messages (see the Explicit Consent Text).

ARTICLE 6 — LEGAL BASES FOR PROCESSING

ARTICLE 7 — IDENTITY VERIFICATION AND DOCUMENTS

7.1. As part of security and regulatory requirements, phone/e-mail verification is mandatory. Depending on the nature and amount of the transaction, the Turkish ID number may be confirmed against official records (the identity verification service of the Directorate of Civil Registration and Citizenship Affairs), and the submission of identity/address documents may be requested.

7.2. Special categories of data that may appear on submitted documents (e.g. the religion and blood group fields on old-format identity cards) fall outside the purpose of processing; the data subject is asked to mask those fields, any unmasked documents are processed in a manner limited to and proportionate with the purpose, and they are destroyed upon expiry of the applicable period. Document reviews are carried out under human control; no automated biometric matching is used.

ARTICLE 8 — DOMESTIC TRANSFERS

8.1. Data may be transferred, strictly for the purposes set out above and in accordance with Article 8 of the KVKK, to the following categories of recipients:

• Payment and electronic money institutions, banks: collection, refund and withdrawal transactions;
• E-invoice/e-archive and accounting service providers: issuing statutory documents;
• IT infrastructure providers: hosting, e-mail delivery, search and performance infrastructure, security verification, live support tools;
• Identity verification services: confirmation of identity against official records;
• Legal and audit advisers: dispute and compliance processes;
• Authorised public institutions and bodies: obligations arising from legislation and duly made requests;
• The counterparty to the transaction: the limited information required for delivery in the Player Market; the consent-based display name/message in Streamer Support.

ARTICLE 9 — INTERNATIONAL TRANSFERS

9.1. Because the servers of certain IT infrastructure providers are located abroad, and because the group company HIPOPOTAMYA BILISIM LTD (United Kingdom) may act as an intermediary in international payment collection processes, data may be transferred abroad.

9.2. International transfers are carried out in accordance with Article 9 of the KVKK, as amended by Law No. 7499: (a) to countries in respect of which an adequacy decision exists; (b) in the absence of an adequacy decision, subject to one of the appropriate safeguards — including the execution of the standard contract published by the Turkish Personal Data Protection Authority (KVKK Board) and its notification to the KVKK Board within five business days of signature — or (c) on the basis of the incidental circumstances listed in Article 9/6. Information on the basis relied upon for a specific transfer is provided upon application.

ARTICLE 10 — RETENTION PERIODS

Data whose retention period has expired is deleted, destroyed or anonymised during the periodic destruction cycles.

ARTICLE 11 — DATA SECURITY MEASURES

11.1. The Company implements the reasonable administrative and technical measures required under Article 12 of the KVKK, including access authorisation, encryption and secure communication protocols, logging, network and application security controls, account security verifications, and staff confidentiality obligations. Contracts are concluded with data processors that limit the processing activity to the Company's instructions and contain security obligations.

ARTICLE 12 — AUTOMATED DECISION-MAKING

12.1. For the purpose of preventing fraud, transactions may be passed through automated risk controls. As a result of automated controls, a transaction may be held or declined; decisions producing permanent adverse consequences for the data subject are, as a rule, made subject to human review. The data subject has the right to object to any result arising against them from analysis carried out exclusively by automated systems.

ARTICLE 13 — MINORS

13.1. The Platform is not directed at persons under the age of 18; membership requires having reached 18 years of age. If it is established that data belonging to a person under 18 has been processed, the relevant account is closed and the data is destroyed in accordance with legislation. The Company may, where it deems necessary, request age confirmation and parental/guardian consent.

ARTICLE 14 — COOKIES

14.1. Detailed information on the use of cookies is provided in the Cookie Policy. Non-essential cookies are subject to explicit consent.

ARTICLE 15 — ACCOUNT DELETION AND DESTRUCTION REQUESTS

15.1. Members may close their accounts at any time via their account settings. Upon account closure, records whose retention is legally mandatory are kept for the applicable periods; all other data is deleted, destroyed or anonymised. Deletion/destruction requests may also be submitted through the channels set out in the KVKK Application Form.

ARTICLE 16 — RIGHTS OF THE DATA SUBJECT AND APPLICATIONS

16.1. You may exercise the rights listed in Article 11 of the KVKK (including requesting information, rectification, erasure, information on transfers, objection and compensation) through the channels set out on the KVKK Application Form page. Applications are concluded free of charge within 30 days at the latest; in the event of a refusal or an inadequate response, your right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Board) remains reserved.

ARTICLE 17 — THIRD-PARTY LINKS

17.1. Services accessed via links on the Platform to third-party sites (game platforms, social login providers, streaming platforms) are governed by the privacy policies of the relevant provider.

ARTICLE 18 — AMENDMENTS AND ENTRY INTO FORCE

18.1. The Company may update this Policy in line with developments in legislation and in its business processes. The current version is published on the Platform together with its version number and effective date; material changes are additionally announced to members.