3.1. Short Summary

• We process the minimum data required to operate the service.
• We do not sell your personal data.
• We offer an explicit opt-in for non-essential tracking (analytics/marketing cookies).
• Sharing with public authorities occurs only when legally required and in accordance with due process.

3.2. Data Controller (location-based)

• For users residing in Turkey: TEAMWARS E-SPOR TEKNOLOJİ A.Ş. (Turkey Office).
• For users residing outside Turkey: Revora Labs L.L.C-FZ (Head Office).

3.3. What data do we process?

• Account data: email, username, password hash, account settings.
• Tournament/competition data: participation, team information, match results, reports.
• Verification/reward/payment data (when necessary): phone, first and last name, address, transaction records.
• Technical data: IP, device/browser, security logs, cookie identifiers.
• Integration data: Data coming from third-party game services/APIs is processed only to the extent necessary and within applicable rules/consents. Some integrations may require account linking/consent (opt-in); personal data is not processed unless the user consents.

3.4. Purposes and Legal Basis

Your personal data may be processed and shared by the data controller and/or those authorized to obtain appropriate security measures in order to:

• Enable the data controller to inform and assist web site users in the best possible way and to perform various operations related to requested services;
• Ensure the reliable and uninterrupted provision of the requested services;
• Promote existing products and services or different products and services through marketing, advertising, and campaigns;
• Fully fulfill the obligations of contracts entered into with members;

In line with the general principles set out in Article 4 of KVKK (6698), it may be obtained, recorded, stored securely in physical or electronic environments for the purpose of processing for an appropriate period, preserved, modified, reorganized, disclosed in accordance with the legislation, transferred, classified, processed, or prevented from being used.

Processed personal data are retained under the principle of retaining them for as long as stipulated by law or for the period necessary for the purposes for which they are processed.

When we process personal data for more than one purpose, the data are deleted, destroyed, or anonymized when the processing purposes have expired or when there is no legal obstacle to deleting the data upon request by the relevant person.

3.5. With whom do we share? (Recipients categories)

• Infrastructure and security providers (hosting/CDN, bot protection, email).
• Phone verification/identity verification providers (if any).
• Payment providers (if any).
• Tournament organizers/sponsors (only where necessary for tournaments/prizes).
• Public authorities/judiciary (only for legal obligation or to protect rights).

3.6. Communication Preferences and Notification Channels

Communication with users may be necessary in the context of service delivery, security, and tournament operations. In this scope, email, phone number, and preferred notification channels (in-app, SMS, WhatsApp) may be processed.

• Mandatory notifications related to the service (contract performance / legitimate interest): account security, verification, tournament operation, and support processes.
• Promotions and general content (explicit consent/permission): marketing and promotional content is sent only through channels you have authorized; you may withdraw your permissions at any time.
• WhatsApp for critical tournament communications (channel usage): WhatsApp may be used only for critical operational updates for tournaments you have joined/registered for or chosen to follow. WhatsApp is not used for promotions/general marketing. Notification permissions manage automatic announcements; manual messages to team captains may be sent when necessary for tournament operations.

Communication service providers (SMS/email/WhatsApp/push) provide only transmission services; data is protected by contractual and technical safeguards to prevent misuse.

Group companies: as necessary to carry out the service (e.g., support/finance/compliance).

3.7. Corporate Reporting / Analytics

• Corporate reports and insights are as anonymous and aggregated as possible. Personal data is not sold.
• Public profiles and statistics may be visible to third parties depending on the user's choice.
• In cases like talent discovery/contact requests, requests are conveyed to the player via the Platform; private contact information is not shared without the player's consent.

3.8. Right to Access and Contact

Contact and requests: [email protected] (Subject: "Privacy Request")
Requests will be answered within 30 days per KVKK Article 13. If your application is rejected, the reasons will be provided to you at the address you provided, by email or by mail.

Pursuant to the Data Controller's Notice on Application Procedure and Principles, the interested person must provide their name, surname, if the application is in writing, the signature, Turkish ID number, (if the applicant is foreign, passport number), the residence or work place address of notification, if applicable the electronic address for notification, the telephone number and fax number, and information about the subject of the request.

To prevent legal risks that could arise from unlawful and unfair data sharing and to ensure the security of your personal data, our company reserves the right to request additional documents (e.g., identity card or driver's license copy).

The data subject may request information from the relevant person to determine whether the applicant is a data subject, and may ask questions related to the applicant's inquiry to clarify the matter.

Your Rights as a Data Subject

• Learn whether your personal data is processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether it is used in accordance with its purpose
• Learn the third parties to whom your personal data are transferred domestically or abroad
• Request correction if personal data are incomplete or incorrectly processed and require that the corresponding action be notified to third parties
• Request deletion, destruction, or anonymization of personal data when the grounds requiring processing have ceased, and require that this action be notified to third parties
• Object to results arising from solely automated processing of your data
• Claim damages for injuries due to unlawful processing of your personal data.

3.9. Data Security

TEAMWARS protects your personal data in accordance with information security standards and procedures, with all necessary technical and administrative safeguards in place. These security measures are continuously updated in light of technological developments and kept at an appropriate level against potential risks. TEAMWARS emphasizes the confidentiality of all information and information assets within its own structure, including personal data.

Last updated: 09.03.2026