Cookie notice

When you visit Oyun Günlüğü, some cookies are placed on your device. This page explains which cookies we use, why we use them and how you can manage your preferences.

1. Introduction

This Privacy Notice has been prepared by Oyun Günlüğü ("OG", "Site" or "Data Controller") to inform data subjects about the personal data processed through the website at oyungunlugu.com and all related subpages, services and applications, in accordance with Article 10 (Obligation to Inform) of Personal Data Protection Law No. 6698 ("KVKK"), the Regulation on the Data Controllers Registry and Articles 13 and 14 of the European Union General Data Protection Regulation ("GDPR").

OG is committed to processing personal data in line with the principles of data minimization, purpose limitation, transparency, security and accountability.

In addition to the Site, this notice also applies to:

• Registered user (member) accounts and player profiles.
• The gamification system (XP, Tokens, quests, leaderboards).
• The Kodeks daily trivia game.
• Comments and user content.
• Newsletters and announcements.
• Contact forms.
• Advertising, affiliate and commercial partnerships.

2. Identity of the Data Controller

In accordance with Article 10 of KVKK and Articles 13/14 of GDPR, information about the data controller processing your personal data is as follows:

3. Definitions

4. Categories of Personal Data Processed

OG processes the following categories of personal data:

4.1. Identity Data

• First name, last name (for membership)
• Username / player name
• Date of birth (for age verification, at the user's discretion)

4.2. Contact Data

• Email address
• (If any) Social media account link

Note: OG does not routinely collect data such as phone numbers and postal addresses. These are only requested for specific communication, legal obligations or delivery to winners of prize contests, with separate explicit consent obtained for the event in question.

4.3. Transaction Security Data

• IP address
• Browser information (User-Agent)
• Device type and operating system
• Login records, failed login attempts
• Cookie and session identifiers
• Traffic data under Law No. 5651 (retention period: 2 years)

4.4. Marketing and Preference Data

• Newsletter subscription status.
• Cookie preference settings.
• Theme and language preferences.
• Content category preferences.

4.5. Behavioral and Analytics Data

• Page view statistics (aggregate/anonymous, via Google Analytics 4).
• On-site navigation flow.
• Comment and interaction data.
• Gamification actions (earning XP, spending Tokens, completing quests, leaderboard position).
• Kodeks game progress (stored on the local device; can be linked to an account at the user's request).

4.6. Customer Transaction Data (Advertising and Partnership Processes)

• First name, last name, title, email and company information received from representatives of advertisers and business partners.
• Contract and invoice information.
• Correspondence content.

5. Purposes of Processing Personal Data

In accordance with the principle of data minimization under Article 4/2 of KVKK, personal data is processed for the following purposes:

5.1. Service Delivery and Membership Processes

• Creating and maintaining member accounts and authenticating users.
• Password reset, account security and account recovery.
• Providing interactive features such as comments, player profiles, gamification and Kodeks.
• User preferences and personalization.

5.2. Content and Site Performance

• Producing and publishing content and improving the reader experience.
• Site performance, speed, error and traffic analysis.
• A/B testing (where conducted).

5.3. Legal Obligations

• The obligation to retain traffic data under Law No. 5651.
• Requests from competent authorities such as courts, prosecutors, the Information and Communication Technologies Authority (BTK) and the Personal Data Protection Authority.
• Record-keeping obligations under tax, commercial and other legislation.

5.4. Communication and Marketing

• Notifications regarding account, service and legal changes (mandatory communication that does not require consent).
• Newsletters, announcements and event information (only with explicit consent).
• Management of commercial electronic messages (in compliance with Law No. 6563 and the Message Management System, İYS).

5.5. Advertising and Affiliate Processes

• Managing ad placements and measuring their performance
• Affiliate (revenue sharing) referral and conversion tracking
• Publishing sponsored content and advertising copy
• Managing communication and contract processes with advertisers

5.6. Security and Fraud Prevention

• Site, server and account security
• Protection against bots, spam and malicious attacks (Cloudflare WAF, ASP.NET Core Antiforgery)
• Detecting account abuse (multiple accounts, gamification manipulation)

6. Legal Grounds for Processing

6.1. Under KVKK

In accordance with Articles 5 and 6 of KVKK:

OG does not collect special category personal data (health, ethnic origin, religion, etc.); if such data is submitted by mistake, it is deleted.

6.2. Under GDPR (for residents of the European Economic Area)

In accordance with Article 6 of GDPR:

• Consent (Art. 6/1-a): Newsletters, analytics and marketing cookies
• Performance of a Contract (Art. 6/1-b): Membership
• Legal Obligation (Art. 6/1-c): Requests from competent authorities
• Legitimate Interest (Art. 6/1-f): Security, fraud prevention, membership-related communication in direct marketing

7. Methods of Collecting Personal Data

Your personal data is collected through the following channels:

• Directly from you, during membership registration, writing comments, contact forms, newsletter sign-up, gamification interactions and social media connections
• By automated means, through cookies, server logs, analytics tools and security systems during your visit to the Site
• From third-party sources, through social media login integrations (if any), and aggregate data reported by advertising partners and affiliate networks

8. Transfer of Personal Data

Under Articles 8 and 9 of KVKK and Articles 44–49 of GDPR, data may be transferred to the following groups of recipients.

8.1. Domestic Transfers

8.2. International Transfers

OG's technical infrastructure includes cloud and service providers operating worldwide. The data centers used by these providers may be located abroad, particularly in European Union member states, the United States and the United Kingdom. The main data processors / recipients are:

International transfers are carried out on the basis of Standard Contractual Clauses (SCCs) under Article 46 of GDPR or transfer mechanisms to countries with an adequacy decision, and, under Article 9 of KVKK, on the basis of decisions of the Personal Data Protection Board and, where necessary, the explicit consent of the data subject.

8.3. Google Consent Mode v2

For data transfers to Google, OG implements the Google Consent Mode v2 standard. Since March 1, 2024, Consent Mode v2 has been mandatory with Google's advertising and analytics products for visitors from the EEA, the United Kingdom and Switzerland. OG has chosen to apply this approach to all of its visitors (including Türkiye).

Within this scope, the seven consent signals sent to Google (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage, security_storage) are sent as "granted" or "denied" according to the data subject's choices in the cookie banner. Unless consent is given, Google tags operate in cookieless (cookieless ping) mode and no analytics or advertising cookies are placed on the device. For detailed information, see Section 8 of the Cookie Notice.

9. Retention Periods

Data is retained for as long as required by the purpose of processing, taking into account the limitation periods set out in the relevant legislation:

Data whose retention period has expired is periodically deleted, destroyed or anonymized under the Personal Data Retention and Destruction Policy.

10. Rights of the Data Subject

10.1. Under Article 11 of KVKK

Anyone whose personal data is processed can exercise the following rights by applying to OG:

1. To learn whether your personal data is processed
2. To request information if it has been processed
3. To learn the purpose of processing and whether it is used in line with that purpose
4. To know the third parties to whom it is transferred domestically or abroad
5. To request the correction of incomplete or inaccurate data
6. To request its deletion or destruction under the conditions set out in Article 7 of KVKK
7. To request that correction, deletion or destruction be notified to third parties to whom the data has been transferred
8. To object to an outcome against you resulting from analysis carried out exclusively through automated systems
9. To claim compensation if you have suffered damage due to unlawful processing

10.2. Under Articles 15–22 of GDPR (for EU residents)

• Right of Access (Art. 15)
• Right to Rectification (Art. 16)
• Right to Erasure / Right to Be Forgotten (Art. 17)
• Right to Restriction of Processing (Art. 18)
• Right to Data Portability (Art. 20)
• Right to Object (Art. 21), particularly to direct marketing
• Right to Object to Automated Decision-Making (Art. 22)
• Right to Lodge a Complaint with a Supervisory Authority (Art. 77)

11. How to Apply

To exercise the rights above, you can apply through the following methods under the Communiqué on the Procedures and Principles of Application to the Data Controller:

Your applications are concluded free of charge within 30 (thirty) days. If the request incurs an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.

Important: For identity verification, your application must include all the information specified in Article 5 of the Communiqué (full name, Turkish ID / passport number, address, subject of the request and supporting documents, if any).

12. Data Security

In accordance with Article 12 of KVKK and Article 32 of GDPR, OG implements the following technical and administrative measures:

Technical measures:

• Mandatory SSL/TLS (HTTPS) across the entire Site.
• WAF, bot and DDoS protection through Cloudflare.
• CSRF protection with ASP.NET Core Antiforgery.
• HttpOnly, Secure and SameSite policies for cookie security.
• Storing passwords with one-way hashing (similar to PBKDF2/bcrypt).
• Regular backups and disaster recovery.
• Keeping software and dependencies up to date.

Administrative measures:

• Access and authorization control
• Data minimization and purpose limitation
• Periodic review and risk assessment
• In the event of a data breach, notification to the Personal Data Protection Board within 72 hours and to affected data subjects "as soon as possible"
• Confidentiality commitments from employees and contributors

13. Provisions Regarding Children

OG does not knowingly collect personal data from children under the age of 13. The minimum age for all features requiring membership is set at 13; in EU member states, local legislation may set different age limits between 13 and 16.

If it is discovered that data belonging to a child under 13 has been collected by mistake, the data is deleted immediately. If a parent or guardian applies via [email protected], the necessary action is taken.

14. Automated Decision-Making and Profiling

OG does not carry out decision-making processes that produce legal effects regarding data subjects based solely on automated systems. Although the gamification scoring, leaderboard and quest systems operate automatically, they do not create rights or obligations. Behavioral analysis used in serving ads takes place only where explicit consent has been obtained, and the data subject can stop this processing at any time by changing their cookie preferences.

15. Third-Party Links

The Site may contain links to other websites. OG is not responsible for the privacy practices and content of third-party sites accessed through these links. We recommend that you review the privacy policies of those sites.

16. Changes

OG reserves the right to update this Privacy Notice in line with legislative changes, technological developments and business processes. Significant changes are prominently announced on the Site, and explicit consent is requested again where necessary. The "Last updated" date is renewed with each revision.

17. Contact

You can send your applications under KVKK to [email protected], stating your full name, Turkish ID number and your request. Applications are answered within 30 days.