INFORMATION NOTICE UNDER THE PERSONAL DATA PROTECTION LAW NO. 6698
This notice has been prepared to inform data subjects pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”). This notice does not constitute a declaration of explicit consent.
1. Data controller
ENES GÜNEY (sole proprietorship; business name: UcuzGames)
Address: Güneştepe Mah., Osmangazi / Bursa
Phone: 0850 307 7805
E-mail: [email protected]
VKN: 4350811042 — Tax Office: Osmangazi
2. Categories of personal data processed
- Identity information (first name, surname; where necessary, Turkish ID number and date of birth),
- Contact information (e-mail, phone),
- Membership and account information (user registration, session, password hash, linked login identities),
- Order and transaction information (product, amount, delivery / access records),
- Invoice and address information,
- Payment and collection transaction records (payment method, transaction reference; full card numbers are not stored on the website’s servers),
- IP address, device / browser and security logs,
- Support conversations and request content (live support, ticket, e-mail),
- Fraud prevention and transaction security records,
- Cookie and marketing preferences,
- UcuzPass membership records (pack, start / end date, renewal and cancellation status, registered computer identifier, desktop application login and game access records, use of membership benefits),
- Records of consent relating to the right of withdrawal for UcuzPass purchases (consent text version, date and time, IP address, device / browser information),
- Where necessary, information regarding parental or guardian consent for users under the age of 18.
3. Methods of collection
Personal data may be collected automatically or partly automatically through membership and login forms, order / payment processes, the UcuzGames desktop application, support channels, cookies and similar technologies, security logs, and linked login methods such as Google / Steam.
4. Purposes and legal grounds for processing
Depending on the category and activity, data may be processed for the purposes set out below and on the legal grounds under KVKK Article 5/2:
- Creating and managing a membership account — entering into / performing a contract,
- Receiving and fulfilling orders, delivery and invoicing — performance of a contract and legal obligation,
- Payment collection and reconciliation — performance of a contract and legal obligation,
- Managing customer support processes — performance of a contract / legitimate interest,
- Transaction security and prevention of fraud and misuse — legitimate interest / legal obligation,
- Fulfilment of legal obligations (tax, e-commerce, consumer protection, etc.) — legal obligation,
- Measuring and improving website performance — legitimate interest; separate preference / consent for non-essential cookies,
- Marketing communications (only in accordance with the relevant preferences) — explicit consent or other legal grounds provided for under the applicable legislation,
- Establishment, administration, automatic renewal and cancellation of UcuzPass memberships; provision of game access through the desktop application; enforcement of the single-computer rule; and provision of membership benefits (including birthday benefits) — performance of a contract,
- Protection of the security of shared accounts and detection of violations of the UcuzPass terms of use — legitimate interests,
- Recording and proof of explicit consent concerning the right of withdrawal for UcuzPass purchases, and management of payment disputes (chargebacks) and dispute resolution processes — legal obligation and necessity for the establishment, exercise or protection of a right.
5. Categories of recipients to whom personal data may be transferred
For the purposes stated above and in compliance with the KVKK, personal data may be transferred to the following categories of recipients:
- Authorized public institutions and organizations,
- Banks and payment institutions / payment service providers,
- Accounting and e-invoice / e-archive service providers,
- Hosting, server, CDN and technical infrastructure providers,
- Email and communications infrastructure providers,
- Live support and customer service tools / notification channels,
- Analytics and advertising service providers (subject to your cookie preferences),
- Legal and financial advisors,
- AI / cloud service providers used in live support processes.
6. Transfers abroad
Where the technical infrastructure and service providers used are located abroad, personal data may be transferred abroad in compliance with the conditions set out in Article 9 of Law No. 6698 and the applicable safeguard mechanisms.
In this context, transfers abroad may take place through the Cloudflare content delivery network and site security / performance infrastructure, Google Tag Manager and associated analytics / advertising tags, Meta Pixel and Meta Conversions API advertising measurement tools (for server-side notifications, event type, order number, amount and product information, an irreversibly hashed version of the email address and phone number, IP address and browser information; these are not sent for visitors who reject advertising / marketing cookies), Google and Steam connected login services, and AI / cloud service providers used in live support processes. Depending on the nature of the relevant service, the categories of data that may be transferred may include IP addresses, device / browser information, cookie identifiers, membership / contact information and support conversation content.
UcuzPass card subscription payments are collected through Stripe, a payment infrastructure provider established abroad. In this context, name, email, payment and subscription transaction records, IP address and device / browser information are transferred to Stripe'a; card details are processed directly by Stripe and are not stored on the site servers. To the extent necessary to process the payment, these payment data are transferred to Stripe'a under the exception for transfers necessary for the performance of a contract, as set out in paragraph six of Article 9 of the KVKK. The purpose of the transfer is to collect and renew subscription payments, issue refunds and ensure payment security.
7. Retention period
Data shall be retained for the period required by the purpose of processing and for the mandatory retention periods prescribed by tax, commercial, consumer and other legislation; upon expiry of these periods, the data shall be deleted, destroyed or anonymized. Records of withdrawal consent relating to UcuzPass purchases (consent text version, date and time, IP address, device information) shall be retained for 10 years from the date of purchase, being the general limitation period, for evidentiary purposes in the event of potential disputes, and shall be deleted or anonymized upon expiry of this period.
8. Rights of the data subject
Under Article 11 of the KVKK, you have the right to learn whether your personal data is being processed; to request information if it is being processed; to learn the purpose of processing and whether the data is being used in accordance with that purpose; to know the third parties to whom it is transferred domestically or abroad; to request the rectification of incomplete or inaccurate data; to request its deletion or destruction under the conditions set out in the KVKK; to request notification of such rectification, deletion or destruction to the third parties to whom the data has been transferred; to object to any outcome to your detriment arising from the analysis of your data exclusively by automated systems; and, where you suffer damage as a result of unlawful processing, to request compensation for such damage.
9. Method of application
You may submit your applications by e-mail to [email protected], in writing to Güneştepe Mah., Osmangazi / Bursa, or by other methods specified in the Communiqué on the Procedures and Principles for Application to the Data Controller. Information necessary for identity verification may be requested in applications. Requests shall be concluded as soon as possible and no later than thirty days, pursuant to Article 13 of the KVKK.
You can access the current version of this text on the KVKK Privacy Notice page at www.ucuzgames.com. Material changes to the purposes of data processing, recipients of transfers or transfers abroad shall be announced on the website before they take effect.
