Personal Data Protection Notice (KVKK)

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the "Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform".

1. Data controller

Alpysky Oyun Yazılım ve Teknoloji A.Ş. (the "Company" / "knightpin.com")
Address: ASMALIEVLER MAH. 6655 SOK. NO:14 İÇ KAPI NO:10 PAMUKKALE / DENİZLİ / TÜRKİYE
Email: [email protected]
MERSİS: 0058073559400001

2. Categories of personal data processed

• Identity Data: Name and surname, Turkish ID number or, for foreign nationals, passport/ID document details and nationality (during identity verification), date of birth.
• Visual and Biometric Data: Identity document images, a selfie and liveness check, and face matching (only during identity verification, with your explicit consent).
• Contact Data: Email address, phone number, full address.
• Customer Transaction Data: Order details, invoice details, payment method, purchase history, balance movements.
• Transaction Security: IP address, session information, cookie records, login/logout logs, password hashes, device fingerprint.
• Marketing: Survey answers, habits, campaign preferences and which ad or campaign brought you to the site (with explicit consent and cookie consent).
• Message Content: Marketplace messages, support requests.
• Financial Data: Bank IBAN details for withdrawals (for verified users).

3. Purposes of processing personal data

• Creating and managing the membership registration,
• Taking orders, carrying out payment and delivering the product/service,
• Providing customer support services and managing complaints and requests,
• Conducting activities in compliance with legislation, carrying out finance and accounting work and fulfilling legal obligations,
• Running information security processes and preventing fraud and irregularities,
• Marketing activities and campaign/promotion notifications, where explicit consent has been given.

4. Legal grounds for processing personal data (KVKK Articles 5-6)

• Processing is directly related to the conclusion or performance of a contract (KVKK Art. 5(2)(c)),
• Processing is necessary for us to fulfill our legal obligation (KVKK Art. 5(2)(ç)),
• Processing is necessary for our legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5(2)(f)),
• Processing is necessary for the establishment, exercise or protection of a right (KVKK Art. 5(2)(e)),
• Processing is expressly provided for by law (KVKK Art. 5(2)(a)), for example keeping invoices and commercial records under tax legislation,
• Explicit consent for processing for marketing purposes and for non-essential cookies (KVKK Art. 5(1)); explicit consent for biometric data in identity verification (KVKK Art. 6).

5. Transfer of personal data

Your data may be transferred to the following parties, only to the extent required by the purposes above:

• Payment service providers (PayTR, GPay, iyzico, etc.) — collecting payment,
• Cloud, hosting, content delivery and security service providers (servers, CDN, Cloudflare) — providing and protecting the service,
• SMS, email, instant messaging (WhatsApp, Telegram) and push notification (OneSignal) providers — notifications and verification,
• Identity verification service provider (Didit) — identity verification,
• Live support service provider (Tawk.to) — support conversations; if you are logged in, your name and email address,
• Analytics and advertising service providers (Google, Microsoft, Yandex) — only with your cookie consent, for measuring site use and ad performance,
• Product suppliers — the information needed to deliver the order (for example an in-game character name),
• The other Member you trade with on the Player Marketplace — limited to the information needed for delivery,
• The streamer you support and their streaming tools (Streamlabs) — your display name, the amount and your message in a donation,
• Contracted accounting and law firms — legal obligations,
• Authorized public institutions and organizations — on request, within the legal framework.
• Google LLC (Google Customer Reviews program) — sending a satisfaction survey after a purchase. Only the order number, email address and delivery date of members who have given marketing permission are transferred; if permission has not been given, no data is sent.

Some of our service providers are located abroad (for example in the USA, European Union countries and Russia), so your data may be transferred abroad. Under KVKK Article 9, such transfers are made to countries for which the Personal Data Protection Board has issued an adequacy decision; where there is no adequacy decision, by providing one of the appropriate safeguards, such as signing the standard contract published by the Board and notifying it to the Board; and, where none of these is available and the transfer is incidental, with your explicit consent.

6. Methods of collecting personal data

Your data is collected electronically through membership registration forms, identity verification processes, order processes, support requests, cookies and similar automated or semi-automated means.

7. Retention periods

• Membership record: for as long as the membership is active + 10 years (limitation period under Article 146 of the Turkish Code of Obligations).
• Payment/invoice records: 5 years under Article 253 of the Tax Procedure Law, 10 years under the Turkish Commercial Code.
• Identity verification documents and transaction records: the period set out in the KYC Policy (at least 8 years).
• Transaction logs: at least 2 years for information security.
• Marketing data: until explicit consent is withdrawn.

8. Rights of the data subject (KVKK Article 11)

As a data subject, you can exercise the following rights by applying to our Company:

1. To learn whether your personal data is processed,
2. To request information about it if your personal data has been processed,
3. To learn the purpose of processing and whether it is used in line with that purpose,
4. To know the third parties in Türkiye or abroad to whom it has been transferred,
5. To request its correction if it has been processed incompletely or incorrectly,
6. To request its erasure or destruction under the conditions of KVKK Article 7,
7. To request that the operations carried out under items 5 and 6 be notified to the third parties to whom it has been transferred,
8. To object to a result against you that arises from analysis exclusively by automated systems,
9. To request compensation for the damage if you have suffered damage due to unlawful processing.

You can submit your applications using the method on the "Data Subject Request Form (KVKK)" page or to [email protected]. Applications are concluded within 30 days at the latest.