KVKK Disclosure Notice (Turkey)

1. Data Controller

The data controller is MATCHABIT SPOR TEKNOLOJILERI LIMITED SIRKETI. Registered office: Cevizli Mah. Zuhal Cad. A Blok No: 46 Ic Kapi No: 50 Maltepe / Istanbul, Turkiye. Phone: +372 53860665. Email: [email protected]. This notice is prepared under Article 10 of KVKK.

2. Categories of Personal Data

• Identity and profile data (name, surname, avatar, skill details)
• Contact data (email address, phone number)
• Transaction and booking data (reservations, matches, tournaments, coaching, match-video access, payment status, payment/refund provider references, and reconciliation records)
• Saved-card data if you use the feature (provider tokens/references, masked card details, last four digits, card brand/bank details, and consent records; full card number and CVC/CVV are not stored by Matchabit)
• User content (in-app messages, support requests, reports)
• Technical data (IP address, device identifiers, app version, analytics and crash logs)
• Device location data when location permissions are enabled, and venue/event location details selected in reservation, match, tournament, or coaching flows

3. Processing Purposes

• Providing and improving platform services
• Managing reservations, matches, tournaments, match-video access, and payments
• Providing group chat for matches, tournaments, leagues, coaching, and similar activities; providing direct messaging between users; and allowing authorized club/organization managers to access activity chats for organization, support, incident review, or complaint handling
• Running account security, fraud prevention, and abuse prevention controls
• Providing customer support and handling legal requests
• Fulfilling legal obligations and audit requirements

4. Legal Bases

• Explicitly provided in laws
• Necessary for the establishment or performance of a contract
• Necessary for compliance with legal obligations
• Data made public by the data subject
• Necessary for the establishment, exercise, or protection of a right
• Necessary for legitimate interests, provided fundamental rights and freedoms are not harmed
• Explicit consent where required

5. Transfers

Personal data may be transferred, to the extent necessary, to the recipient groups below for service delivery, security, and legal compliance purposes:

• Service providers: Domestic and international technical vendors for cloud/hosting infrastructure, authentication, notifications, and analytics (for example Firebase services).
• Partner clubs, venues, and organizers: User, match, and transaction data required for reservation, match, and tournament operations and for video approval, video sales, collection, support, and reconciliation (limited to necessary data).
• Contracted video infrastructure providers: Limited data needed to create and technically deliver match-video access, including an external user reference, purchase reference, club, court, match, match start/end times, and purchase time; card, email, and phone details are not shared. After redirecting to the provider site, IP, device/browser, and cookie data may be processed under the provider's own notice.
• Payment institutions: For payment processing, saved-card tokenization, refunds, fraud prevention, and reconciliation workflows.
• Authorized public bodies and institutions: When required by law or judicial order.
• Domestic transfers are made under Articles 8 and 10 of KVKK.
• Cross-border transfers are made under valid appropriate safeguard mechanisms under Article 9 of KVKK.

6. Collection Method

Your personal data is collected through mobile application and web forms, account and transaction records, payment and integration notifications, support channels, cookies, and technical logs by automated or partially automated means; and, where necessary, by manual means provided that the data forms part of a data filing system.

7. Retention and Deletion

Personal data is retained for legal retention periods and operational needs, then deleted, destroyed, or anonymized under our retention and deletion process.

8. Data Subject Rights (KVKK Article 11)

• Learn whether personal data is processed
• Request information if personal data has been processed
• Learn the purpose of processing and whether data is used in line with that purpose
• Know the third parties to whom data is transferred domestically or abroad
• Request rectification of incomplete or inaccurate data
• Request deletion or destruction where legal conditions are met
• Request notification of rectification/deletion to transferred third parties
• Object to adverse outcomes caused by automated analysis
• Request compensation for damages due to unlawful processing

9. Application Method

You can submit requests regarding your KVKK rights by confirming your identity through the channels below:

• Email: [email protected]
• Support email: [email protected]
• Phone: +372 53860665
• Written application address: Cevizli Mah. Zuhal Cad. A Blok No: 46 Ic Kapi No: 50 Maltepe / Istanbul, Turkiye
• In-app support channels available in Matchabit
• Other channels announced by the data controller (for example KEP or postal address)

Applications are concluded as soon as possible and within 30 days at the latest under applicable legislation.

10. Updates

This disclosure notice may be updated based on legal, operational, or technical changes. The current version is published on this page.