Legal

TEAMWARS Privacy Notice

10.11.2026

1. Summary

  • We process the minimum data needed to run the service.
  • We do not sell your personal data.
  • For non-essential tracking (analytics/marketing cookies), we offer an explicit opt-in choice.
  • Data is shared with public authorities only upon legally required and duly made requests.

2. Data controller (based on residence)

For users residing in Türkiye, the data controller is: TEAMWARS E-SPOR TEKNOLOJİ A.Ş. (Türkiye Office). Address: Esentepe Mah. Büyükdere Cad. Onur İş Merkezi Blok No: 118 İç Kapı No: 2, Şişli / Istanbul, Türkiye

For users residing outside Türkiye, the data controller is: Revora Labs L.L.C-FZ (Head Office). Revora Labs L.L.C-FZ is a subsidiary of Pinula Teknoloji A.Ş., incorporated in the United Arab Emirates. Contact address: Esentepe Mah. Büyükdere Cad. No:118 Onur İşhanı Kat:2, Şişli / Istanbul, Türkiye

This Privacy Notice is published in Turkish and English. The Turkish text prevails for users residing in Türkiye, and the English text prevails for users residing outside Türkiye.

3. What data do we process?

  • Account data: e-mail, username, password hash, account settings.
  • Tournament/competition data: participation, team information, match results, reports.
  • Verification/prize/payment data (where needed): phone, name-surname, address, transaction records and invoice details (tax identification number and tax office for corporate buyers).
  • Age data: date of birth or age information.
  • Technical data: IP, device/browser, security logs, cookie data.
  • Integration data: Data received from third-party game services is processed only to the extent necessary and within the applicable rules/permissions. Some integrations may require account linking/opt-in; no data linked to an individual is processed unless the user gives permission.
  • Riot account data (only for users who link their Riot account): Riot ID, Riot account information, VALORANT rank and data from tournament matches played on TEAMWARS. Matches the player plays outside TEAMWARS are not stored. The Riot ID is not shown on the Platform; the statistics and match history of players who have linked their Riot account may be viewed by Platform members, and tournament results may be viewed by everyone.
  • Sanction and registration block data: sanction records; the phone number and the identification numbers of linked game accounts of a sanctioned user, stored in encrypted form even if the account is deleted.
  • Trust factor data: the trust factor of the player and the team and the match attendance records affecting it (completion of matches, not showing up for a match, losing a match by forfeit, registering for a tournament and not showing up).

Providing account data is necessary to conclude the membership agreement; if this data is not provided, membership cannot be created. Riot account data is required only to participate in VALORANT tournaments, and verification, prize and payment data only for the relevant processes. Data relating to processing for marketing purposes is optional.

4. Purposes and Legal Bases

Your personal data may be processed and shared within the scope below and within the personal data processing conditions set out in Articles 5 and 6 of the Law. For users residing in the European Union, the relevant legal basis under Article 6(1) GDPR is also stated:

  • Enabling the data controller to inform and assist website users in the best possible way and fully carrying out the various transactions relating to the requested services (KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR)
  • Providing the requested services reliably and without interruption (KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR)
  • Carrying out promotion, marketing, advertising and campaign activities for existing products and services or other products and services (only where you have given explicit consent, KVKK Art. 5/1; Article 6(1)(a) GDPR)
  • Fully performing the requirements of the agreements concluded with members (KVKK Art. 5/2-c; Article 6(1)(b) GDPR)
  • Linking the Riot account and verifying account ownership; providing tournament and Trials services; showing tournament results and statistics on the site; complying with the developer rules of game developers (KVKK Art. 5/2-c; Article 6(1)(b) GDPR)
  • Detecting cheating and preventing new accounts from being opened to evade sanctions (KVKK Art. 5/2-f; Article 6(1)(f) GDPR)
  • Calculating the trust factor, displaying it publicly on the player's profile and using it in the conditions for creating and joining teams (KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR)
  • Carrying out package sales, payment, invoicing and refund processes (KVKK Art. 5/2-c and Art. 5/2-ç; Article 6(1)(b) and Article 6(1)(c) GDPR)
  • Applying age limits, requiring the authorisation of a parent or guardian for package purchases by minors and limiting the visibility of data relating to minor players (KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR)
  • Fulfilling obligations arising from tax, commercial, consumer and internet legislation; retaining invoices and commercial records, keeping traffic records under Law No. 5651 and complying with requests and decisions of competent authorities (KVKK Art. 5/2-ç; Article 6(1)(c) GDPR; Article 6(1)(f) GDPR for obligations not arising from the law of the European Union or a Member State)

For these purposes, in accordance with the general principles set out in Article 4 of the KVKK (Personal Data Protection Law No. 6698), your data may be obtained, recorded, securely stored in physical or electronic form for a period appropriate to the purpose of processing, retained, modified and reorganised.

Processed personal data is retained in accordance with the principle of retention for the period prescribed by legislation or necessary for the purpose for which it is processed.

Retention periods

  • Account data and age data: kept for as long as the account exists; deleted within 30 days at the latest from the account deletion request.
  • Tournament/competition data: kept for as long as the account exists; deleted or anonymised within 30 days at the latest from the account deletion request. Only anonymous game data, the team name and the result remain in the result tables of completed tournaments.
  • Verification, prize, payment and invoice records: kept for the period required by the relevant legislation (as a rule, 10 years under the Turkish Commercial Code and the Tax Procedure Law).
  • Technical data and security logs: kept for at least 1 and at most 2 years under Law No. 5651 and the related legislation.
  • Marketing permissions: processed until consent is withdrawn; consent records for commercial electronic messages are kept for 3 years after the consent ends, for evidentiary purposes.
  • Support requests and application correspondence: kept for 2 years after the request is concluded.
  • Riot account data, registration block records and trust factor data are explained below; cookie data in the Cookie Policy; and TEAMWARS MCP records in Section 10. Data whose period has expired is deleted, destroyed or anonymised.

When the account is deleted, Riot account data is deleted within 30 days at the latest from the account deletion request; data relating to tournament matches is anonymised so that it contains no information that could identify you. If the user requests the deletion of their data directly from the relevant game developer, the relevant data is deleted or anonymised without the need for a separate application.

Information stored in encrypted form for the registration block is kept for the sanction period plus 365 days in the case of temporary sanctions, and for as long as the sanction remains in force in the case of permanent sanctions. Permanent sanctions are reviewed once a year, and the user may request the lifting of the sanction at any time through the contact address in Section 8. If it is decided during the review that the sanction will continue, this information continues to be retained; if the sanction is lifted, it is deleted 365 days after the date on which it is lifted, in line with the standard period applicable to temporary sanctions. This information is used only to prevent the sanction from being circumvented with a new account and, where a new violation is committed within 365 days after a temporary sanction ends or a permanent sanction is lifted, to take the repetition of the violation into account. If a deletion request is received from the relevant game developer, the relevant Riot account information is deleted from this record even if the retention period has not expired.

The trust factor is calculated according to the rules in the Terms of Use. The trust factor is displayed publicly on the player's profile. If a player believes that a record affecting their trust factor is incorrect, they may request its correction through the contact address in Section 8 and may object to a result to their detriment arising exclusively from automated processing. As a trust factor below 50 prevents a player from creating a team, it may constitute an automated decision within the meaning of Article 22 GDPR for users residing in the European Union. This decision is necessary for the performance of the contract concluded with the User (Article 22(2)(a) GDPR); these users have the right, through the contact address in Section 8, to obtain review of the decision by a staff member, to express their point of view and to contest the decision. The trust factor and related records are kept for as long as the account exists and are deleted when the account is deleted.

Where we process personal data for more than one purpose, the data is deleted, destroyed or anonymised once the processing purposes cease to exist or upon the Data Subject's request, provided there is no legal obstacle to deletion.

5. Who do we share data with? (Recipient categories)

  • Infrastructure and security providers (hosting/CDN, bot protection, e-mail).
  • Phone verification/identity verification providers (if any).
  • Payment providers.
  • Tournament organizers/sponsors (only if necessary for the tournament/prize).
  • Competent public authorities/judiciary (only for legal obligations or the protection of rights).
  • Game developers (only for linking the Riot account and for tournament services; Riot ID and Riot account information).
  • Group companies: TEAMWARS E-SPOR TEKNOLOJİ A.Ş. and Revora Labs L.L.C-FZ, to the extent necessary for running the service (e.g. support, finance, compliance and technical operations) (KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR).

Transfers abroad: Platform data is hosted on servers located in Germany. Website traffic passes through the network of a security and traffic service provider located in the USA. The service of a bot protection service provider located in the USA is used for bot protection. If you consent to analytical cookies, cookie data is transferred to Google LLC under Google Analytics, and if you consent to marketing cookies, under Google Ads. Linking your Riot account takes place on the game developer's own page and is subject to its privacy policy. To the extent necessary for running the service, data may be shared between TEAMWARS E-SPOR TEKNOLOJİ A.Ş. in Türkiye and Revora Labs L.L.C-FZ in the United Arab Emirates. Transfers relating to TEAMWARS MCP are explained in Section 10. Transfers abroad of the data of users residing in Türkiye are made in accordance with the mechanisms provided for in KVKK Article 9. Transfers of the data of users residing in the European Union to countries outside the European Union are made in accordance with Articles 44–46 GDPR, on the basis of an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.

6. Corporate reporting / analytics

Data in corporate reports and insights is anonymised. Personal data is not sold. Data obtained from game developers is not transferred to third parties other than through the TEAMWARS MCP connection explained in Section 10.

In cases such as talent discovery/contact requests, requests are forwarded to the player through the Platform; private contact details are not shared unless the player accepts.

7. Communication Preferences and Notification Channels

Communication with users may be necessary for performing the service, security and tournament operations. In this context, your e-mail, phone number and preferred notification channels (in-app, SMS, WhatsApp) may be processed.

  • Mandatory service-related notifications (performance of contract / legitimate interest; KVKK Art. 5/2-c and Art. 5/2-f; Article 6(1)(b) and Article 6(1)(f) GDPR): account security, verification, tournament operations and support processes.
  • Promotional and general content (explicit consent/permission; KVKK Art. 5/1; Article 6(1)(a) GDPR): marketing and promotional content is sent only through the channels you have permitted; you can withdraw your permissions at any time. You may object at any time to the processing of your personal data for direct marketing purposes; if you object, your data will no longer be processed for such purposes (Article 21(2)–(3) GDPR).
  • WhatsApp critical tournament communication (channel use): WhatsApp may be used only for critical operational information about tournaments you participate in/are registered for or have chosen to follow. WhatsApp is not used for promotion/general marketing. Notification permissions manage automatic announcements; where necessary for tournament operations, manual messages may be sent to team captains.
  • Communication service providers (SMS/e-mail/WhatsApp/push) provide transmission services only; data is protected by contractual and technical measures against use for other purposes.

8. Right to Apply and Contact

Contact and requests: [email protected] (Subject: "Privacy Request"). You may also submit your request in writing to the address in Section 2 or by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Your requests are answered within 30 days at the latest in accordance with KVKK Article 13. If your application is rejected, the reasons for rejection are sent to the address stated in your application, primarily by e-mail or post.

For users residing in Türkiye, under the Communiqué on the Procedures and Principles of Application to the Data Controller, the Data Subject's application must include their name, surname, signature if the application is in writing, Turkish ID number (passport number if the applicant is a foreign national), place of residence or workplace address for notification, e-mail address for notification if any, phone and fax number, and information on the subject of the request.

In order to eliminate legal risks that may arise from unlawful and unfair data sharing and, in particular, to ensure the security of your personal data, our company reserves the right to request additional documents (such as a copy of an identity card or driving licence) to verify identity and authority.

The data controller may request information from the applicant to determine whether they are the data subject, and may ask the data subject questions about the application to clarify the matters stated in it.

Your Rights as a Data Subject

  • To learn whether their personal data is processed
  • To request information if their personal data has been processed
  • To learn the purpose of processing their personal data and whether it is used in line with that purpose
  • To know the third parties in Türkiye or abroad to whom their personal data is transferred
  • To request the correction of their personal data if it is incomplete or incorrectly processed, and to request that this be notified to third parties to whom the personal data has been transferred
  • To request the deletion, destruction or anonymisation of their personal data if the reasons requiring its processing cease to exist, and to request that this be notified to third parties to whom the personal data has been transferred
  • To object to a result to the detriment of the data subject arising from the analysis of the processed data exclusively by automated systems
  • To request compensation for damages if they suffer damage due to the unlawful processing of their personal data

Rights of users residing in the European Union under the GDPR

  • To access their personal data and obtain a copy of it (Art. 15)
  • To request the rectification of their personal data (Art. 16)
  • To request the erasure of their personal data (Art. 17)
  • To request the restriction of the processing of their personal data (Art. 18)
  • To receive their personal data processed by automated means on the basis of a contract or consent in a structured, commonly used and machine-readable format, and to request its transmission to another controller (data portability, Art. 20)
  • To object, on grounds relating to their particular situation, to processing based on legitimate interest (Art. 21(1)) and to object at any time to processing for direct marketing purposes (Art. 21(2)–(3))
  • In relation to decisions based solely on automated processing which produce legal effects concerning them or similarly significantly affect them, to obtain human intervention, to express their point of view and to contest the decision (Art. 22)
  • Where processing is based on consent, to withdraw consent at any time; withdrawal does not affect the lawfulness of processing before the withdrawal (Art. 7(3))
  • To lodge a complaint with the supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement (Art. 77)

These rights can be exercised through the contact address in Section 8. Requests are answered within one month at the latest; this period may be extended by two further months taking into account the complexity and number of requests, in which case the extension is notified together with its reasons (Article 12(3) GDPR). Additional information or documents to verify identity are requested only where there are reasonable doubts concerning the identity of the applicant (Article 12(6) GDPR).

9. Data Security

TEAMWARS protects your personal data within the framework of information security standards and procedures, in full compliance with all necessary technical and administrative security measures. These security measures are continuously updated in light of technological developments and kept at an appropriate level against potential risks. TEAMWARS attaches importance to the confidentiality of all information and information assets within its organisation, including personal data.

10. TEAMWARS mcp

This section explains the data processed when you connect your TEAMWARS account via TEAMWARS MCP to third-party AI applications. The data controller and the application channel are the same as in Sections 2 and 8 of this text.

What can the application see? Only game data that TEAMWARS members can view on the Platform: player profiles, match statistics, teams, tournaments played on TEAMWARS, matches, rankings and organizers. The connection is read-only; the application cannot change anything on your behalf.

What can the application never see? E-mail, phone, password, payment information, IP address, real name, date of birth. Players under 16 and players whose age is unknown are not shown at all; players under 18 appear only as "under 18" and are not listed in player search.

What do we record when you connect? Which account connected which application; the times of granting permission, connecting and disconnecting; connection and usage records. We do not record the question you ask, your conversation with the application or the application's answer; these do not reach us. Search values the application sends (e.g. a player name) are used only to prepare the answer and are not stored. In security logs, the IP address is kept only as an irreversible hash. Your password is not shared with the application; login takes place on TEAMWARS.

Why, and on what legal basis? To provide the service (KVKK Art. 5/2-c; Article 6(1)(b) GDPR), to prevent abuse and ensure the security of the service (KVKK Art. 5/2-f; Article 6(1)(f) GDPR) and to fulfil our legal obligations (KVKK Art. 5/2-ç; Article 6(1)(c) or 6(1)(f) GDPR). Providing game data of other players that TEAMWARS members can view on the Platform to the application is based on the legitimate interest in making this data accessible through third-party applications as well (KVKK Art. 5/2-f; Article 6(1)(f) GDPR).

Anonymous statistics: To improve the service, we keep usage counts that are not linked to individuals. Who used the service, search values and the player/team names viewed are not included in these counts.

How long do we keep it? 365 days; records are deleted automatically when this period expires. The connection record is kept as long as your connection remains active.

Who do we share it with? We do not share or sell these records. Game data received by the application is transmitted, upon the user's query, to the systems of the company providing the AI application you connected, which are located abroad, mainly in the USA, and is subject to that company's own privacy policy. The principles on transfers abroad in Section 5 apply to this transmission.

How do you remove the connection? From the application's connector settings. When you change your password, all your MCP connections are closed automatically.

Contact: [email protected] (Subject: "Privacy Request"). Your rights are set out in the "Your Rights as a Data Subject" section above.

Last updated: 10.11.2026