KVKK Information Notice (translation)
Version 1.0.0 · Effective {{EFFECTIVE_DATE}}
This is an English translation for convenience. The Turkish text is the binding version.
This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to visitors, members and anyone who contacts Play With Keyboard (playwithkeyboard.com, the "Service"). More detail is in our Privacy Policy and Cookie Policy.
1. Data controller
{{COMPANY_NAME}} Address: {{ADDRESS}} Email: info@playwithkeyboard.com Registered electronic mail (KEP): {{KEP_ADDRESS}} Trade registry / tax no.: {{COMPANY_REGISTRATION}} VERBİS registration no.: {{VERBIS_NO}}
2. Data processed, purposes and legal grounds
| Category | Data | Purposes | Legal ground (KVKK Art. 5) |
|---|---|---|---|
| Transaction security | IP address, browser and device data, access time, page requested, session data, password hash, rate-limit counters, Turnstile result | Providing the Service, information security, preventing abuse and bots, obligations under Law No. 5651 | Art. 5(2)(ç) legal obligation, 5(2)(f) legitimate interest, 5(2)(c) performance of contract |
| Contact | Email address; for child accounts, the parent's/guardian's email | Verification codes, deletion codes, service notices, answering requests, obtaining parental consent | Art. 5(2)(c), 5(2)(ç) |
| Customer transaction | Username, language, sign-up date, role, Google account ID (Google sign-in), recorded performances (note events, timing, instrument, tempo), duels, scores, quiz answers and timings, game history, notifications, song requests, whether the age check was passed | Creating and managing the account; recording/sharing, duels, competitions and rankings; fair play (cheat detection); handling song requests | Art. 5(2)(c) formation and performance of contract, 5(2)(f) legitimate interest (fair play, security) |
| Legal transaction | Acceptance records of the Terms and Privacy Policy (version, timestamp, IP), cookie consent records (consent ID, categories, policy version, IP, browser, timestamp, language), copyright/complaint notices, moderation decisions, deletion and data-subject request records | Proving the contract and consent, legal compliance, protecting rights in disputes, answering data-subject requests | Art. 5(2)(ç), 5(2)(e) establishment, exercise or protection of a right, 5(2)(f) |
| Marketing (only with your permission) | Email address, message permission and date | Commercial electronic messages about new songs and features | Art. 5(1) explicit consent and approval under Law No. 6563 |
| Analytics (only with your permission) | Cookieless, aggregated page-view and performance metrics | Improving the Service | Art. 5(1) explicit consent |
Preferences stored only in your browser (keyboard mode, metronome sound, the player name you type for duels) are not sent to us; only when you share a link is the shared information added to the link.
We do not process special categories of personal data (health, religion, biometrics, etc.); please do not send us such data. We do not collect microphone audio, precise location, contacts or payment data.
3. Method of collection
Personal data is collected electronically, partly or fully by automated means, through forms you fill in (sign-up, sign-in, song request, deletion form, complaints), features you use (recording, duels, competitions), your cookie-banner choice, emails you send us, and automatic records of our servers and security systems. If you sign in with Google, we receive your account ID, name and email address from Google.
4. Transfers
| Recipient | Purpose | Legal ground |
|---|---|---|
| Cloudflare, Inc. and affiliates (processor; USA-based, global network) | Hosting, database (D1), file storage, content delivery, security and bot protection (Turnstile), email routing and sending, cookieless analytics | KVKK Arts. 8 and 9; for transfers abroad, a standard contract under Art. 9(4) (notified to the Authority) or an adequacy decision for the country |
| {{SMTP_PROVIDER}} (only if configured; processor) | Sending verification and service emails | Arts. 8, 9 (standard contract) |
| Google LLC (only if you choose Google sign-in; separate controller) | Authenticating you | Art. 5(2)(c); the transfer is initiated at your request |
| Competent public authorities and courts | Responding to requests based on law | Art. 8(2)(a), 5(2)(ç) |
| Rightsholders (copyright notices, limited extent) | Handling the notice procedure | Art. 5(2)(e) |
Your personal data is not sold, rented or shared with third parties for advertising.
Transfers abroad: because the Service runs on Cloudflare's worldwide infrastructure, your data may be processed on servers outside Türkiye. These transfers are made under KVKK Art. 9 by signing the standard contract announced by the Board with the processor and notifying it to the Authority within 5 business days of signature.
5. Retention periods
| Data | Period |
|---|---|
| Account data | While the account exists; accounts unused for 36 months are deleted after an email warning 30 days in advance |
| Unverified sign-ups | 7 days |
| Verification and deletion codes | 15 minutes, single use, stored only as a hash |
| Sessions | Until sign-out, at most 30 days |
| Recordings, duels, scores, game history | Until you or your account are deleted; on deletion, duel and leaderboard scores are anonymised as "Deleted player" |
| Notifications | 90 days |
| Detailed cheat-detection timing data | 90 days |
| Song requests | 12 months after being handled |
| Consent and contract-acceptance records | 3 years from the record (for contract acceptance: account lifetime + 3 years) |
| Deletion and data-subject request records | 3 years |
| Security and traffic logs (IP, time, action) | 12 months (any minimum periods under Law No. 5651 are reserved) |
| Rate-limit counters | 24 hours |
| Complaints, copyright notices, moderation records | 3 years after closure |
| Ban records (email hash, reason) | 3 years |
| Support emails | 2 years after the last message |
| Backups | Overwritten within 30 days at the latest |
At the end of the period data is deleted, destroyed or anonymised. Longer periods required by law, or limitation periods in case of a dispute, are reserved.
6. Children
The Service can be used without an account at any age. The minimum age for an account is 13. Users below the age of digital consent in their country may only register with parental/guardian consent (where offered).
7. Your rights under KVKK Art. 11
By applying to the data controller you have the right to:
a) learn whether your personal data is processed; b) request information about it if so; c) learn the purpose of processing and whether data is used in line with that purpose; ç) know the third parties in Türkiye or abroad to whom data is transferred; d) request rectification if data is incomplete or inaccurate; e) request erasure or destruction under the conditions of KVKK Art. 7; f) request that actions under (d) and (e) be notified to third parties to whom data was transferred; g) object to a result against you arising from analysis exclusively by automated systems; ğ) claim compensation for damage caused by unlawful processing.
You can withdraw your explicit consent (cookie preferences, marketing messages) at any time via "Cookie settings" at the bottom of the site or the "unsubscribe" link in emails.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your application in Turkish, stating your name (or username), signature (for written applications), Turkish ID number (for foreigners: nationality and passport/ID number), address or email for notification, and your request:
- by email to info@playwithkeyboard.com from the email address registered in our system,
- via the "Delete my data" form and account settings on the site (username + email → 6-digit code sent to your email → confirm),
- to the KEP address {{KEP_ADDRESS}}, with a secure electronic or mobile signature,
- or in writing to {{ADDRESS}}.
We conclude your application free of charge within 30 days at the latest; if the action involves an additional cost, the fee in the Board's tariff may be charged. We may send a code to your registered email to verify your identity. If your application is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning the answer and in any case within 60 days of the application.
9. Explicit consent
For processing that requires explicit consent (analytics and marketing cookies, commercial electronic messages), your consent is obtained separately from this notice, through the cookie banner and unticked, optional checkboxes in the sign-up form. Refusing consent does not prevent you from using the Service.