KVKK Privacy Notice (Türkiye)
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Data controller
Under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform, your personal data in connection with Essah is processed by the following data controller.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| hasan@pingel.dev | |
| Web | pingel.dev |
2. Controller and processor roles
The organising institution is the controller for data it enters about contestants and teams (names, photos, scores); Pingel is a processor acting on its behalf. For the organiser's account and payment data, Pingel is the controller.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Organiser's name, e-mail, profile photo (with Google sign-in), password (hashed by Firebase) | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Competition content Competition name, logo, questions, halls, jury and admin passwords, settings, videos | Setting up and running the competition live | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Team and contestant data (on the organiser's behalf) Team name, contestant names, team photo/avatar, scores | Running the competition and showing the scoreboard on screen (as processor) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Until the organiser deletes it; within 30 days after account closure |
| AI jury assistant inputs The competition question and the answer text | Suggesting to the jury whether an answer is correct (Google Gemini; fallback Cloudflare Workers AI) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | At the time of the request; not stored |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Compliance with a legal obligation (KVKK Art. 5(2)(ç)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
4. Method of collection
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
5. Recipients and purposes of transfer
Your personal data is transferred, limited to the purposes above and in line with KVKK Arts. 8 and 9, to the following suppliers that provide the technical infrastructure (some located abroad):
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Cloudflare, Inc. | Hosting, content delivery, DNS, attack protection | Global network (US-based) |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
Transfers abroad rely on appropriate safeguards under KVKK Art. 9 (standard contracts, providers' data protection commitments) and, for occasional transfers without them, the exceptions in Art. 9(6). Data may also be disclosed to authorised public bodies and courts on request and as required by law. Your data is never sold.
6. Your rights under KVKK Art. 11
- to learn whether your personal data is processed;
- to request information if it is processed;
- to learn the purpose and whether it is used accordingly;
- to know the third parties in Türkiye or abroad to whom it is transferred;
- to request correction if incomplete or inaccurate;
- to request deletion or destruction under Art. 7;
- to request that corrections and deletions be notified to recipients;
- to object to an adverse outcome resulting solely from automated analysis;
- to claim compensation for damage caused by unlawful processing.
7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request with your name, (for written requests) signature, address or e-mail for notification and the subject of your request from the e-mail address registered with us to hasan@pingel.dev, with a secure electronic or mobile signature, or in writing. We conclude requests free of charge within 30 days; if the action involves an additional cost, the fee set by the Board may apply. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.