GDPR Information Notice

This GDPR Information Notice is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the corresponding provisions of the United Kingdom GDPR. It supplements our Privacy Policy and our Cookie Policy.

This Notice applies primarily to data subjects who are located in the European Economic Area ("EEA") or the United Kingdom and whose personal data we process through the Games from Türkiye website (the "Site"). If you are located in Türkiye, please also read our KVKK Aydınlatma Metni.

1. Controller and operator

Controller

• Türkiye Oyun Geliştiricileri Derneği (TOGED)
• Address: Teknoloji Geliştirme Bölgesi, Üniversiteler Mahallesi, Bilkent Cyberpark, Çankaya / Ankara, Türkiye
• Email: privacy@gamesfromturkiye.com

Processor (Site Operator)

• Seti Medya İletişim Ltd. Şti.
• Address: Göksu Otağtepe Caddesi, Onur Sitesi, Beykoz / İstanbul, Türkiye

Seti Medya processes personal data only on the documented instructions of TOGED, under a written agreement that meets the requirements of Article 28 GDPR.

TOGED has not appointed an EU representative under Article 27 GDPR because its processing activities directed at data subjects in the EEA fall within the limited scope set out in Article 27(2) GDPR. We will reconsider this position if our processing scope changes. For all data-protection inquiries, please contact privacy@gamesfromturkiye.com.

2. Categories of personal data and source

The categories of personal data we process are described in section 2 of our Privacy Policy. All personal data we process about you is collected directly from you when you fill in a form, subscribe to the newsletter, sign in to the studio-owner edit area, interact with the incentives chatbot, or otherwise use the Site.

Where we publish a studio listing on the Site at the request of a studio representative, we may also process limited public information about the studio's principals and team that is provided to us in the submission. Article 14 GDPR therefore applies to those individuals; we ask the submitting studio to inform such individuals of this Notice and to provide our contact details.

3. Purposes and legal bases (Art. 6 GDPR)

We process personal data on the following legal bases:

• Article 6(1)(a) — consent: for newsletter subscriptions, publication of approved studio listings, use of the incentives chatbot, analytics cookies, and any cross-border transfer that requires explicit consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Article 6(1)(b) — contract: for operating the studio-owner edit area and responding to pre-contractual requests.
• Article 6(1)(c) — legal obligation: for retention of records required by applicable law, including audit-trail retention.
• Article 6(1)(f) — legitimate interests: for the security of the Site, for handling and triaging inquiries, for editorial review of submissions, and for maintaining a curated industry directory. We have weighed these legitimate interests against your rights and freedoms; you may obtain further information about this balancing test by writing to privacy@gamesfromturkiye.com.

We do not process special categories of personal data (Art. 9 GDPR) through the Site. Please do not include such data in any free-text field.

4. Recipients and categories of recipients

We disclose personal data only to:

• the authorised editorial team within TOGED;
• our processor Seti Medya İletişim Ltd. Şti., acting on TOGED's documented instructions;
• sub-processors providing infrastructure, including hosting and database providers located in the European Union, and third-party email-delivery providers, in each case bound by a written agreement compliant with Article 28 GDPR;
• the large-language-model providers OpenAI and Anthropic for the operation of the incentives chatbot — the prompt text you submit to the chatbot is transmitted to one or more of these providers solely for the purpose of generating a reply;
• competent authorities and judicial bodies, where we are required to disclose by law, court order, or a binding official request.

We do not sell personal data and we do not disclose it to third parties for those parties' own marketing purposes.

5. International transfers (Art. 44–49 GDPR)

The Site is hosted within the European Union and your personal data is primarily stored in the EU. The following categories of recipients are based outside the EEA:

• the language-model providers (OpenAI and Anthropic), which are based in the United States;
• TOGED itself, as the controller, which is established in Türkiye.

Where personal data is transferred outside the EEA, we rely on the following Article 46 GDPR safeguards:

• the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, where applicable, supplemented by additional technical and organisational measures to address the risks identified in our transfer impact assessment; and
• the European Commission's adequacy decision for any country recognised as offering an adequate level of protection (where applicable);
• in limited cases, your explicit consent to the proposed transfer after being informed of the possible risks under Article 49(1)(a) GDPR.

You may request a copy of the relevant safeguards by writing to privacy@gamesfromturkiye.com.

6. Retention

We retain personal data only as long as necessary for the purposes described above and in our Privacy Policy. The headline retention periods are:

• form submissions and inquiries — 24 months;
• consent records — 24 months;
• newsletter subscription records — until unsubscribe, plus a suppression record;
• studio-owner account records — for as long as the listing is published and 12 months after removal;
• chatbot interaction records — short-term operational retention only;
• cookie and analytics data — as described in the Cookie Policy;
• records required by law — for the statutory retention period.

7. Your rights as a data subject

Under the GDPR (and the equivalent provisions of the United Kingdom GDPR) you have the right to:

• Access (Art. 15) — obtain confirmation of processing and a copy of your personal data;
• Rectification (Art. 16) — have inaccurate or incomplete data corrected;
• Erasure (Art. 17) — have your data deleted in the circumstances specified in the GDPR;
• Restriction (Art. 18) — restrict processing in the circumstances specified in the GDPR;
• Portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller, where technically feasible;
• Objection (Art. 21) — object at any time to processing carried out under Article 6(1)(f); we will stop processing unless we can demonstrate compelling legitimate grounds that override your rights, or that the processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct-marketing purposes;
• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of pre-withdrawal processing;
• Not be subject to a decision based solely on automated processing (Art. 22) — we do not carry out such processing through the Site;
• Lodge a complaint with a supervisory authority (Art. 77), in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please write to privacy@gamesfromturkiye.com. We will respond within one (1) month under Article 12(3) GDPR. We may need to verify your identity before acting on your request.

8. Statutory or contractual requirement to provide data

You are not under any statutory obligation to provide personal data through the Site. Where personal data is required to fulfil a request you make (for example, your email address to receive a reply to your contact message), failure to provide that data may mean that we cannot process the request. We will indicate clearly on the relevant form which fields are required and which are optional.

9. Automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. The incentives chatbot generates answers using a language model, but its output is informational only and does not make any decision about you.

10. Children

The Site is not directed at children. We do not knowingly collect personal data from children under the age of thirteen (13), and we do not rely on Article 6(1)(a) consent for the processing of personal data of children under the digital-age-of-consent threshold applicable in your country (typically 13 to 16 years old in the EEA). The Families page provides information for parents and guardians.

11. Changes to this Notice

We may update this Notice to reflect changes to our processing activities or to applicable law. Each version is identified by the version number and effective date displayed at the top of this page. Material changes will be highlighted on the Site, and where required your fresh consent will be requested.

12. Contact

For all questions concerning this Notice or the way we process your personal data:

• Email: privacy@gamesfromturkiye.com
• Postal address (controller): Türkiye Oyun Geliştiricileri Derneği, Teknoloji Geliştirme Bölgesi, Üniversiteler Mahallesi, Bilkent Cyberpark, Çankaya / Ankara, Türkiye