This Data Protection (KVKK) Policy (the “Policy”) sets out the core principles governing how Noma Teknoloji ve Bilişim Hizmetleri Ltd. Şti. (the “Company”) processes, protects, transfers, retains and destroys personal data under Türkiye’s Personal Data Protection Law No. 6698 and related legislation.

1. Purpose and Scope

The Policy applies to all personal data processed by the Company and to the natural persons whose data is processed (members, visitors, business-partner staff, etc.).

2. Definitions

Personal Data: any information relating to an identified or identifiable natural person.
Data Subject: the natural person whose personal data is processed.
Data Controller: the Company, which determines the purposes and means of processing and is responsible for the data filing system.
Data Processor: a natural/legal person who processes data on behalf of the controller under its authority.
Explicit Consent: consent on a specific matter, based on information and expressed by free will.
Board / Authority: the Personal Data Protection Board / Authority.

3. Identity of the Data Controller

Legal name: Noma Teknoloji ve Bilişim Hizmetleri Ltd. Şti.
Address: Kurtköy Mah. Ankara Cd. No:289 D:21 Pendik / İstanbul, Türkiye
MERSIS No: 0631067868500001 · Trade Registry No: 942818-0
Tax Office / No: Pendik · 6310678685
E-mail: [email protected] · [email protected]

4. Principles of Processing

Pursuant to Article 4 of the KVKK, the Company processes personal data:

lawfully and fairly;
accurately and, where necessary, kept up to date;
for specified, explicit and legitimate purposes;
relevantly, limitedly and proportionately to the purposes;
retained only for the period prescribed by law or required by the purpose.

5. Conditions of Processing (Legal Grounds)

Personal data is processed based on explicit consent as a rule; and, in the cases listed in Articles 5/2 and 6/3 of the KVKK (express provision in law, establishment/performance of a contract, legal obligation, establishment/exercise/protection of a right, legitimate interest of the controller, etc.), without seeking explicit consent.

6. Categories of Data Processed

Identity (first name, last name, date of birth, gender).
Contact (e-mail, phone, city).
Customer Transaction (membership, matches, scores, standings, participation records).
Audio-Visual Records (live-stream image/audio, profile photo).
Transaction Security (IP, logs, session/cookie, password hash, push token).
Marketing (referral codes, notification preferences).

7. Purposes of Processing

Membership and account management, identity verification.
League/tournament organization, pairing, scoring and standings services.
Live-streaming and archiving of matches.
Sending notifications and providing user support.
Security, fraud and abuse prevention.
Service improvement, analysis and reporting.
Fulfilment of legal obligations.

8. Transfer of Personal Data

For the purposes above and in accordance with Articles 8-9 of the KVKK, your personal data may be transferred to authorized public bodies, our business partners and suppliers in Türkiye; and, based on your explicit consent, to our providers abroad for push notification, e-mail, error monitoring and live-streaming services (OneSignal, Resend, Sentry, YouTube/Google).

9. Retention and Destruction

Personal data is retained for the periods required by the purpose of processing and prescribed by law. Upon expiry, it is deleted, destroyed or anonymized in accordance with the Company’s retention and destruction rules.

10. Administrative and Technical Security Measures

Access authorization and authority matrices.
Encryption in transit and at rest.
Network and application security, firewalls.
Logging and monitoring.
Backups at the İstanbul (primary) and Ankara (disaster recovery) data centers.
Confidentiality undertakings and awareness training.

11. Rights of the Data Subject (KVKK Art. 11)

learn whether your personal data is processed;
request information if it has been processed;
learn the purpose of processing and whether the data is used accordingly;
know the third parties to whom the data is transferred, in Türkiye or abroad;
request correction if the data is incomplete or inaccurate;
request erasure or destruction within the conditions set out in the KVKK;
request that corrections/erasures be notified to third parties to whom the data was transferred;
object to a result against you produced solely by automated analysis of your data;
claim compensation if you suffer damage due to unlawful processing.

12. Applications

Data subjects may submit their requests under Article 13 of the KVKK to [email protected] or to the Company’s postal address above. Requests are concluded free of charge within 30 days at the latest depending on their nature; where the process entails a cost, a fee under the Board’s tariff may apply.

13. Effectiveness

This Policy takes effect on its publication date. The Company reserves the right to update it; the current version is published on this page.