NTROY
TR
Log inSign up
  1. Home
  2. Legal

KVKK Disclosure Notice

Last updated: 02.11.2026

This Disclosure Notice has been prepared to inform you about the processing of your personal data under Law No. 6698 on the Protection of Personal Data ("KVKK").

1. Data Controller

As NTROY OYUN TEKNOLOJİLERİ ANONİM ŞİRKETİ (the "Company"), we have prepared this disclosure notice to inform you about the processing of your personal data under the KVKK.

Address: Çınarlı Mah. 1572 Sk. No: 33 Konak / İzmir / Türkiye Email: [email protected] KEP: [email protected] Tax Office: Karşıyaka Vergi Dairesi Tax No: 6321515015

2. Personal Data Processed

Within the scope of our services (including Football Mates, Basketball Mates, and our other games and applications), the following personal data of yours is processed:

2.1 Identity Information

  • First and last name
  • Email address
  • Phone number (optional)
  • Country information
  • Profile photo (if uploaded)

2.2 Game Data

  • Player ID
  • In-game nickname and team name
  • Game level (main level, season level)
  • Referral ID
  • VIP tier and web points balance

Linking a game account on ntroy.com: when you link your ntroy.com account to a Basketball Mates (Support ID) or Football Mates (Referral ID) account, the code you enter and the player name, level, season level, team name and avatar read from our game servers are stored on ntroy.com and shown on your profile according to your profile setting. This data is processed by the same data controller (the Company) to provide the service to you; you can remove the link from your account at any time.

2.3 Payment Information

  • In-app purchases in our mobile games are processed by Apple (App Store) and Google (Google Play). Card details are not received or stored by us; refunds for in-app purchases are handled by Apple or Google under their own policies.
  • Data stored about in-app purchases: the store's transaction identifiers, the product, the price, the date and the purchase status
  • Purchases made on our websites are described separately in Section 11.

2.4 Technical Data

  • IP address
  • Browser type and version
  • Login times
  • Device information and, in mobile apps, in-app events
  • Advertising identifier (IDFA on iOS, Google Advertising ID on Android) — only with your explicit consent; on iOS also only with your Apple tracking permission
  • Cookies (see our Cookie Policy for details)

2.5 Communication Data

  • In-app chat messages
  • Support request contents
  • Marketplace listings and offers

2.6 Social Login Data

If you choose to sign in using a third-party login provider, the following data is received from that provider:

  • Facebook Login (Meta) — Facebook user ID (app-scoped), first and last name, profile picture, and — only if the email permission is granted — email address.
  • Sign in with Google — Google account ID and, only if the email permission is granted, email address.
  • Sign in with Apple — Apple user ID and, if shared, email address (which may be an Apple "Hide My Email" relay address).

This data is processed solely for authentication and account sign-in purposes. No password, friend list, post, or message data is received from the provider, and nothing is posted to your account on your behalf.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • Account creation and management
  • Account verification and secure sign-in (including sign-in via third-party social login providers)
  • Carrying out in-game purchases and marketplace transactions
  • Synchronizing your game data with the web portal
  • Sending transactional emails (verification, password reset, purchase confirmation)
  • Providing customer support
  • Detecting and preventing fraud, abuse, and security threats
  • Displaying leaderboards, statistics, and publicly available game data
  • Operating the referral and VIP reward system
  • Carrying out analytics in mobile apps and measuring the effectiveness of advertising campaigns (subject to your explicit consent)
  • Translating chat messages and creating an AI avatar or team logo at your request
  • Verifying in-app purchases with the relevant app store
  • Fulfilling legal obligations

4. Legal Bases for Processing Personal Data

Pursuant to Articles 5 and 6 of the KVKK, your personal data is processed on the following legal bases:

  • Establishment or performance of a contract (KVKK Art. 5/2-c): Account creation, authentication and sign-in via social login providers, payment transactions, service provision
  • Legitimate interest of the data controller: Security measures, service improvement, fraud prevention
  • Legal obligation: Compliance with tax and financial regulations
  • Explicit consent (KVKK Art. 5(1)): Analytics and advertising measurement in mobile apps (Google Firebase / Google Analytics, Meta, Tenjin; including advertising identifiers) and marketing communications (if any). Your explicit consent is requested when you first launch the game and can be withdrawn at any time in the game under Settings → Ad Privacy Settings. Details are in Section 6 of our Privacy Policy.

5. Transfer of Personal Data

Your personal data may be shared with the following third parties for the purpose of providing the service:

  • Apple (App Store) and Google (Google Play) — In-app purchase verification — Data transferred: the purchase/transaction information issued by the store
  • SendGrid (Twilio) — Transactional emails — Data transferred: email address, name
  • Hetzner Online GmbH (Germany) — Server and database hosting (Basketball Mates game servers and our web services) — Data transferred: the data processed in these services
  • Microsoft Azure — Football Mates cloud hosting and database — Data transferred: Football Mates data (encrypted)
  • Cloudflare — Security and performance — Data transferred: IP address, request metadata
  • Meta Platforms Ireland Ltd. (Ireland) — Facebook Login authentication and advertising measurement — Data transferred: for login, the access token issued by Facebook (solely for verification); for advertising measurement, with your explicit consent, in-app events, device information and advertising identifier
  • Google Ireland Ltd. (Ireland) (Google Firebase / Google Analytics) — Mobile app analytics and advertising measurement — Data transferred: with your explicit consent, in-app events, device and app information
  • Tenjin, Inc. — Advertising attribution (determining which ad network, campaign or ad an install came from) — Data transferred: with your explicit consent, player ID, advertising identifier, device information, IP address, in-app events and purchase information
  • OpenAI — Chat message translation and AI avatar/logo creation at your request — Data transferred: the message text to be translated, the photo you upload for an avatar, and your logo preferences
  • Payment processing for purchases made on our websites — see Section 11

Some of the service providers listed above are established abroad (including in the European Union and the United States), and your personal data may therefore be transferred abroad. In such cases, the necessary security measures are taken under Article 9 of the KVKK. Your personal data is never sold to third parties.

6. Retention Period of Personal Data

  • Account and game data: Retained as long as your account is active. Account deletion is carried out by deactivating the account; because match history, teams, leagues and the in-game economy are linked to other players' records, gameplay records continue to be retained for as long as the game service is operated, to preserve the integrity of the game. When a Basketball Mates account is deleted, its advertising measurement data is erased; if no other active game profile remains linked to the account, the contact email address received from the login provider (Facebook, Google or Apple) is erased as well.
  • Payment, purchase and invoice records: Retained for as long as required by applicable tax and commercial laws, up to 10 years.
  • Security, anti-cheat and fraud-prevention records (including login attempts, security events and IP logs): Retained for 2 years.
  • Chat messages: Retained for 6 months after the last activity.
  • Social login identifiers (for example, the Facebook user ID): Retained in connection with your account; when the account is deactivated, they remain part of the closed game account for as long as the game service is operated. You can request their erasure under your rights in Section 7.
  • Advertising measurement records: Retained on our game servers for 30 days after delivery to the measurement services (at most 180 days if they cannot be delivered); Google Analytics event data is retained for 14 months.

7. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights:

  • To learn whether your personal data is being processed
  • If your personal data has been processed, to request information about it
  • To learn the purpose of processing your personal data and whether it is used in accordance with that purpose
  • To know the third parties, domestically or abroad, to whom your personal data has been transferred
  • To request the correction of your personal data if it has been processed incompletely or inaccurately
  • To request the deletion or destruction of your personal data under Article 7 of the KVKK
  • To request that the correction, deletion, or destruction be reported to third parties to whom your personal data has been transferred
  • To object to a result that arises against you due to the analysis of your processed data exclusively through automated systems
  • To request compensation for damages if you suffer harm due to the unlawful processing of your personal data

To exercise your rights, you may submit a written request to [email protected]. Your request will be finalized within 30 days at the latest.

8. Data Security

The following technical and administrative measures are applied to ensure the security of your personal data:

  • All data transmission is carried out over HTTPS (TLS encryption)
  • Passwords are hashed with the bcrypt algorithm (cost factor 12)
  • Authentication tokens are stored in HttpOnly secure cookies
  • Rate limiting and brute-force attack protection are applied
  • Parameterized queries are used to prevent SQL injection attacks
  • Regular security audits are performed

9. Changes

This disclosure notice may be updated from time to time. Updates are indicated by the "Last updated" date at the top of the page.

10. Contact and Requests

For questions and requests regarding the processing of your personal data:

Email: [email protected] KEP: [email protected] Website: www.ntroy.net

Identity verification may be required when handling requests. If your request is rejected or you find the response insufficient, you have the right to lodge a complaint with the Personal Data Protection Board.

11. Purchases Made on Our Websites

This section applies only to purchases made on our websites (for example, the Basketball Mates web shop on basketballmates.net, when available). It does not apply to purchases inside our mobile apps; those are processed by Apple or Google as described in Section 2.3.

  • Payment transactions on our websites are processed through Stripe, Inc.
  • Credit card number, CVV, or full card details are not stored by us
  • Data stored: transaction amounts, purchase history, payment status
  • Stripe, Inc. — Payment processing — Data transferred: email, name, transaction amount
  • Stripe, Inc. is established abroad (United States); the explanations on transfer abroad in Section 5 (KVKK Article 9) also apply to this transfer.