This Disclosure Notice has been prepared to inform you about the processing of your personal data under Law No. 6698 on the Protection of Personal Data ("KVKK").
1. Data Controller
As NTROY OYUN TEKNOLOJİLERİ ANONİM ŞİRKETİ (the "Company"), we have prepared this disclosure notice to inform you about the processing of your personal data under the KVKK.
Address: Çınarlı Mah. 1572 Sk. No: 33 Konak / İzmir / Türkiye Email: [email protected] KEP: [email protected] Tax Office: Karşıyaka Vergi Dairesi Tax No: 6321515015
2. Personal Data Processed
Within the scope of our services (including Football Mates, Basketball Mates, and our other games and applications), the following personal data of yours is processed:
2.1 Identity Information
- First and last name
- Email address
- Phone number (optional)
- Country information
- Profile photo (if uploaded)
2.2 Game Data
- Player ID
- In-game nickname and team name
- Game level (main level, season level)
- Referral ID
- VIP tier and web points balance
Linking a game account on ntroy.com: when you link your ntroy.com account to a Basketball Mates (Support ID) or Football Mates (Referral ID) account, the code you enter and the player name, level, season level, team name and avatar read from our game servers are stored on ntroy.com and shown on your profile according to your profile setting. This data is processed by the same data controller (the Company) to provide the service to you; you can remove the link from your account at any time.
Moving Football Mates / Basketball Mates website accounts to ntroy.com: we move accounts from the footballmates.net and basketballmates.net websites to ntroy.com. Only accounts with a verified email address are moved; accounts opened with the same email on both websites are merged into a single ntroy.com account. The data moved: email address, display name (in-game nickname; surnames are not moved), country, an irreversible digest of your old website password (bcrypt; the plain password is never received), your game account link (Referral ID / Support ID and player ID), purchase history on the websites, support requests and their correspondence (with link information for attachments), Web Points / Mates Coins transactions and balance, and VIP tier. Phone numbers, social media addresses, two-factor secrets, sessions and security logs are not moved. Accounts without a verified email are not moved; for those, only the game account ID and balance are kept so that the owner can claim them through support. The move takes place within the same data controller (the Company) to keep providing the service to you (performance of the contract) and to meet our obligation to retain financial records.
2.3 Payment Information
- In-app purchases in our mobile games are processed by Apple (App Store) and Google (Google Play). Card details are not received or stored by us; refunds for in-app purchases are handled by Apple or Google under their own policies.
- Data stored about in-app purchases: the store's transaction identifiers, the product, the price, the date and the purchase status
- Purchases made on our websites are described separately in Section 11.
2.4 Technical Data
- IP address
- Browser type and version
- Login times
- Device information and, in mobile apps, in-app events
- Advertising identifier (IDFA on iOS, Google Advertising ID on Android) — only with your explicit consent; on iOS also only with your Apple tracking permission
- Cookies (see our Cookie Policy for details)
Beta sign-up on ntroy.com: when you sign up on ntroy.com for the closed-beta list of one of our games in development (for example Mafia Manager), your email address, your name (if you entered one), the page language, the time of your consent and a hashed value of your IP address (for security) are stored; if you are logged in, the sign-up is linked to your ntroy.com account. This data is processed solely to deliver the beta invite and run the beta programme, at your request (KVKK Art. 5/2-c), and is retained until the beta programme ends or you ask to be removed from the list. The permission you give to receive emails about Ntroy's other games and campaigns is separate, optional and can be withdrawn at any time. To leave the list or have your sign-up deleted, write to [email protected].
2.5 Communication Data
- In-app chat messages
- Support request contents
- Marketplace listings and offers
2.6 Social Login Data
If you choose to sign in using a third-party login provider, the following data is received from that provider:
- Facebook Login (Meta) — Facebook user ID (app-scoped), first and last name, profile picture, and — only if the email permission is granted — email address.
- Sign in with Google — Google account ID and, only if the email permission is granted, email address.
- Sign in with Apple — Apple user ID and, if shared, email address (which may be an Apple "Hide My Email" relay address).
This data is processed solely for authentication and account sign-in purposes. No password, friend list, post, or message data is received from the provider, and nothing is posted to your account on your behalf.
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Account creation and management
- Account verification and secure sign-in (including sign-in via third-party social login providers)
- Carrying out in-game purchases and marketplace transactions
- Synchronizing your game data with the web portal
- Sending transactional emails (verification, password reset, purchase confirmation)
- Providing customer support
- Detecting and preventing fraud, abuse, and security threats
- Displaying leaderboards, statistics, and publicly available game data
- Operating the referral and VIP reward system
- Carrying out analytics in mobile apps and measuring the effectiveness of advertising campaigns (subject to your explicit consent)
- Translating chat messages and creating an AI avatar or team logo at your request
- Verifying in-app purchases with the relevant app store
- Fulfilling legal obligations
4. Legal Bases for Processing Personal Data
Pursuant to Articles 5 and 6 of the KVKK, your personal data is processed on the following legal bases:
- Establishment or performance of a contract (KVKK Art. 5/2-c): Account creation, authentication and sign-in via social login providers, payment transactions, service provision
- Legitimate interest of the data controller: Security measures, service improvement, fraud prevention
- Legal obligation: Compliance with tax and financial regulations
- Explicit consent (KVKK Art. 5(1)): Analytics and advertising measurement in mobile apps (Google Firebase / Google Analytics, Meta, Tenjin; including advertising identifiers) and marketing communications (if any). Your explicit consent is requested when you first launch the game and can be withdrawn at any time in the game under Settings → Ad Privacy Settings. Details are in Section 6 of our Privacy Policy.
5. Transfer of Personal Data
Your personal data may be shared with the following third parties for the purpose of providing the service:
- Apple (App Store) and Google (Google Play) — In-app purchase verification — Data transferred: the purchase/transaction information issued by the store
- SendGrid (Twilio) — Transactional emails — Data transferred: email address, name
- Hetzner Online GmbH (Germany) — Server and database hosting (Basketball Mates game servers and our web services) — Data transferred: the data processed in these services
- Microsoft Azure — Football Mates cloud hosting and database — Data transferred: Football Mates data (encrypted)
- Cloudflare — Security and performance — Data transferred: IP address, request metadata
- Meta Platforms Ireland Ltd. (Ireland) — Facebook Login authentication and advertising measurement — Data transferred: for login, the access token issued by Facebook (solely for verification); for advertising measurement, with your explicit consent, in-app events, device information and advertising identifier
- Google Ireland Ltd. (Ireland) (Google Firebase / Google Analytics) — Mobile app analytics and advertising measurement — Data transferred: with your explicit consent, in-app events, device and app information
- Tenjin, Inc. — Advertising attribution (determining which ad network, campaign or ad an install came from) — Data transferred: with your explicit consent, player ID, advertising identifier, device information, IP address, in-app events and purchase information
- OpenAI — Chat message translation and AI avatar/logo creation at your request — Data transferred: the message text to be translated, the photo you upload for an avatar, and your logo preferences
- Payment processing for purchases made on our websites — see Section 11
Some of the service providers listed above are established abroad (including in the European Union and the United States), and your personal data may therefore be transferred abroad. In such cases, the necessary security measures are taken under Article 9 of the KVKK. Your personal data is never sold to third parties.
6. Retention Period of Personal Data
- Account and game data: Retained as long as your account is active. Account deletion is carried out by deactivating the account; because match history, teams, leagues and the in-game economy are linked to other players' records, gameplay records continue to be retained for as long as the game service is operated, to preserve the integrity of the game. When a Basketball Mates account is deleted, its advertising measurement data is erased; if no other active game profile remains linked to the account, the contact email address received from the login provider (Facebook, Google or Apple) is erased as well.
- Payment, purchase and invoice records: Retained for as long as required by applicable tax and commercial laws, up to 10 years.
- Deleting your account on ntroy.com: you can delete your account yourself from My account → "Delete my account", confirming with your password or a code sent to your email. Deletion removes your profile, posts, friendships, team memberships, game account links and NT Points. Purchase and payment records (including those moved from the Football Mates / Basketball Mates websites) are not deleted; they are kept without your identity (anonymised) for the legal period above. Your support requests are detached from you. Moved records of your old website accounts will not be imported into ntroy.com again.
- Security, anti-cheat and fraud-prevention records (including login attempts, security events and IP logs): Retained for 2 years.
- Chat messages: Retained for 6 months after the last activity.
- Social login identifiers (for example, the Facebook user ID): Retained in connection with your account; when the account is deactivated, they remain part of the closed game account for as long as the game service is operated. You can request their erasure under your rights in Section 7.
- Advertising measurement records: Retained on our game servers for 30 days after delivery to the measurement services (at most 180 days if they cannot be delivered); Google Analytics event data is retained for 14 months.
7. Your Rights as a Data Subject
Pursuant to Article 11 of the KVKK, you have the following rights:
- To learn whether your personal data is being processed
- If your personal data has been processed, to request information about it
- To learn the purpose of processing your personal data and whether it is used in accordance with that purpose
- To know the third parties, domestically or abroad, to whom your personal data has been transferred
- To request the correction of your personal data if it has been processed incompletely or inaccurately
- To request the deletion or destruction of your personal data under Article 7 of the KVKK
- To request that the correction, deletion, or destruction be reported to third parties to whom your personal data has been transferred
- To object to a result that arises against you due to the analysis of your processed data exclusively through automated systems
- To request compensation for damages if you suffer harm due to the unlawful processing of your personal data
To exercise your rights, you may submit a written request to [email protected]. Your request will be finalized within 30 days at the latest.
8. Data Security
The following technical and administrative measures are applied to ensure the security of your personal data:
- All data transmission is carried out over HTTPS (TLS encryption)
- Passwords are hashed with the bcrypt algorithm (cost factor 12)
- Authentication tokens are stored in HttpOnly secure cookies
- Rate limiting and brute-force attack protection are applied
- Parameterized queries are used to prevent SQL injection attacks
- Regular security audits are performed
9. Changes
This disclosure notice may be updated from time to time. Updates are indicated by the "Last updated" date at the top of the page.
10. Contact and Requests
For questions and requests regarding the processing of your personal data:
Email: [email protected] KEP: [email protected] Website: www.ntroy.net
Identity verification may be required when handling requests. If your request is rejected or you find the response insufficient, you have the right to lodge a complaint with the Personal Data Protection Board.
11. Purchases Made on Our Websites
This section applies only to purchases made on our websites (for example, the Basketball Mates web shop on basketballmates.net, when available). It does not apply to purchases inside our mobile apps; those are processed by Apple or Google as described in Section 2.3.
- Payment transactions on our websites are processed through Stripe, Inc.
- Credit card number, CVV, or full card details are not stored by us
- Data stored: transaction amounts, purchase history, payment status
- Stripe, Inc. — Payment processing — Data transferred: email, name, transaction amount
- Stripe, Inc. is established abroad (United States); the explanations on transfer abroad in Section 5 (KVKK Article 9) also apply to this transfer.