KVKK Notice

This is the English reference version of the disclosure required under Türkiye's Personal Data Protection Law No. 6698 ("KVKK") Art. 10. In case of conflict, the Turkish version prevails for KVKK purposes. It applies to Beni Tanı - Get to Know Me (the "App") and benitaniapp.com.

---

1. Data Controller

The App is operated jointly by:

• Ramazan Sancar
• Batınay Ünsel

Requests/contact: <[email protected]> (all requests are handled via email).

When the project is operated under a company, controller status will transfer to that legal entity and this notice will be updated.

2. Categories of Personal Data Processed

• Identity/account: username, name/display name, date of birth, gender.
• Contact: email address, phone number.
• Customer transaction: subscription/purchase history, preferences, language.
• Transaction security: password (irreversibly hashed), session/access tokens, IP address, device info, logs.
• Location (country level): country/region derived from IP.
• Visual: profile photo and uploaded media.
• User content: messages, game/room interactions, report records.
• Marketing/notifications: push notification tokens and preferences.

3. Purposes

• Account creation, authentication, session management.
• Providing App services (question cards, game rooms, friendships, chat).
• Age verification and content suitability (SAFE/TEEN/MATURE/ADULT).
• Subscription/purchase and regional pricing.
• Information security, fraud and abuse prevention, moderation.
• Handling requests/complaints and meeting legal obligations.
• Service improvement, diagnostics, and analytics.

4. Legal Grounds (KVKK Arts. 5–6)

• Necessity for the establishment/performance of a contract (account and service).
• Compliance with the controller's legal obligations (financial/legal records).
• Legitimate interest without harming your fundamental rights (security, abuse prevention).
• Explicit consent (adult content access, marketing, optional analytics/cookies, international transfer where required).

5. Method of Collection

Data is collected via the mobile app, website, API requests (device information, IP), social login providers (Google/Apple), and payment/subscription providers (Apple App Store / Google Play, RevenueCat), by automated and partially automated means.

6. Transfers (KVKK Arts. 8–9)

Our servers are hosted in Germany (Hetzner Online GmbH, Nuremberg — EU), so data is primarily processed in the EU; for users in Türkiye this is an international transfer under KVKK. Data may also be transferred, as needed, to domestic/overseas service providers (hosting, Firebase/Google, Apple, RevenueCat, Sentry, email provider, analytics providers) and to legally authorized public authorities.

International transfers follow KVKK Art. 9 as amended by Law No. 7499, applying the following tiered order:

1. Adequacy decision: where the Board has issued an adequacy decision for the relevant country, sector, or international organization, the transfer relies on that decision.
2. Appropriate safeguards: absent an adequacy decision, the transfer requires one of the appropriate safeguards — a standard contract in the form published by the Board, binding corporate rules, an undertaking, or an international agreement — provided the data subject can exercise their rights and access effective legal remedies in the destination country. Where a standard contract is used, it must be notified to the Board within 5 business days of signature.
3. Incidental cases: where neither of the above is available, the transfer may rely on the exceptional and incidental grounds in KVKK Art. 9(6) (the data subject's explicit consent after being informed of the transfer; necessity for performance of a contract; etc.).

Payment instrument data such as card details is processed only by Apple and Google and not stored by us.

7. Retention

Data is retained for the periods required by the processing purpose and applicable law. When the purpose ends or you delete your account, data is deleted, destroyed, or anonymized, subject to legal retention obligations (Regulation on the Deletion, Destruction or Anonymization of Personal Data).

What happens when you request account deletion:

On anonymization, email address, username, name, phone number, avatar, and social login identifiers are irreversibly removed, and the date of birth is reduced to the birth year only (a full date of birth, combined with gender and region, is an indirect identifier that could allow re-identification). Content and messages you created remain for system integrity but are attributed to "Anonymous User". See Privacy Policy §8 for details.

8. Your Rights (KVKK Art. 11)

You may learn whether your data is processed, request information, learn the purpose and third parties to whom it is transferred (domestic/overseas), request correction of inaccurate data, request erasure/destruction under Art. 7, request notification of these actions to third parties, object to results arising solely from automated analysis, and claim compensation for damages.

How to Apply (Communiqué on Application Procedures to the Data Controller)

Send your request to <[email protected]> from the email address registered on your account. Under Art. 5 of the Communiqué, an application must be made in Turkish and include:

• Name, surname, and — if the application is in writing — a signature
• Turkish ID number for Turkish citizens; nationality, passport number, or ID number (if any) for foreign nationals
• Residential or business address for service of notice
• If available, an email address, telephone, and fax number for notification
• The subject of the request

Attaching relevant information and documents speeds up our assessment. For requests arriving from an address other than the one on record, we may ask for additional information to verify your identity, so that your data is never disclosed to an unauthorized person.

Response and Complaint

We conclude requests as soon as possible and within 30 days at the latest, free of charge. Where the process entails an additional cost, a fee set out in the Board's tariff may apply.

If your request is refused, our response is inadequate, or we fail to respond in time, you may file a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of your application (KVKK Art. 14).

9. Children

The App is not directed to persons under 13, and we do not knowingly collect data from this group. See Privacy Policy §7.