DESTAN GAME
KVKK Information Notice
Draft · legal review pending This text describes how the product works today. Its legal review has not been completed yet, so it is not the final version.
Data controller
Your personal data is processed by HAIYUE INTERACTIVE, the publisher of Destan Game (the “Service Provider”), acting as data controller. This notice has been prepared under the obligation to inform set out in Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK, the “Law”). The data controller's name and contact e-mail address are given below.
- Data controller
- HAIYUE INTERACTIVE
- Contact e-mail
- haiyueinteractive@proton.me
This notice covers the Destan Game website and your web account. The game, the rankings, the Store, payments and the Support Center are not open yet; the parts of this notice about these services apply once they open. Broader explanations of how your data is processed are in the Privacy Policy, and the entries stored in your browser are described in the Cookie Policy.
Personal data processed
The categories below show the records the system actually keeps; data that is not collected is not on this list.
- Identity and contact data
- Username, display name, e-mail address and the time the e-mail address was verified.
- Account data
- Account status, your preferred language, when you registered and last signed in, and your notification and communication preferences (including whether you agreed to news and offer e-mails).
- Authentication data
- An irreversible hash of your password made with Argon2id (your password itself is not stored); the two-step verification method you chose; if you use an authenticator app, the key needed to generate codes, which is stored encrypted; and hashes of your recovery codes and of one-time codes.
- Session and device data
- Your open sessions; a device name derived from your browser's identification string (the string itself is not stored); when a device was first and last seen, and whether it is marked as trusted; IP address. The full IP address is kept on the session record only while the session is open and is deleted when the session ends; in other records, IP addresses are kept only in masked or irreversibly hashed form.
- Sign-in and security records
- Successful and failed sign-in attempts, sign-outs, new-device confirmations, account lockouts, e-mail verification and password reset actions, password and e-mail changes, changes to two-step verification settings and security alerts; the time, outcome, device and masked IP address of each.
- Legal acceptance records
- The name and version of the legal texts you accepted at registration, the time of acceptance and your language preference at registration.
- E-mail delivery records
- The type, time and delivery result of the transactional e-mails sent to you. The recipient and content of an e-mail are kept encrypted until delivery is complete, and are deleted from the delivery record once delivery is complete.
- Notification records
- The notifications sent to your account and whether they were read or hidden.
- Account administration records
- Changes that the Service Provider's staff make to your account's status (for example a suspension or lifting it), with the date and the reason recorded; the log of staff actions concerning your account.
- Request and correspondence records
- The e-mails you send to the contact e-mail address and the replies to them. Because the Support Center and the appeal page are not open yet, no support ticket, live support or appeal records are kept at present.
- Game data
- Game data such as character name, class, level, guild, PK and death counts. Because the game account integration is not open yet, this data is not processed at present.
- Payment and order records
- Order, amount, payment reference and refund records, and Store purchase records. Because payments and the Store are not open yet, these records are not kept at present; once payments open, your card number, expiry date and security code will not reach the Service Provider's systems either.
The Services do not ask for special categories of personal data. Please do not share special categories of data, such as health information, in your correspondence.
Purposes of processing
Your personal data is processed for the following purposes:
- Setting up membership: creating your account and verifying your e-mail address.
- Managing the account: keeping your session open, applying your settings and preferences, and sending notifications about your account.
- Authentication and account security: two-step verification, new-device confirmation, limits on sign-in attempts, detection of suspicious activity and security alerts.
- Preventing fraud and abuse.
- Keeping transaction records: recording the version and time of acceptance of the legal texts you accepted, your account activity and staff actions.
- Answering the requests and applications you send to the contact e-mail address; once the Support Center opens, answering your support tickets and appeals.
- Once the game services open: matching your characters to your account, calculating and publishing the rankings, and delivering Store purchases.
- Once payments open: processing payments and settling refund requests.
- Applying the rules of the Services: reviewing reports of rule violations and appeals, and suspending accounts or lifting suspensions.
- Fulfilling the legal obligations the Service Provider is subject to and meeting the lawful requests of competent authorities.
- Receiving and concluding your applications under the Law.
- Only if you have separately agreed: sending news and offer e-mails.
Your personal data is not sold and is not used to build advertising profiles.
Method of collection and legal grounds
Method of collection
Your personal data is collected electronically, in the following ways:
- Directly from you: the registration form, account settings and the e-mails you send to the contact e-mail address.
- Automatically, while you use the Services: sign-ins, sessions, devices, the actions you take on your account and the site's strictly necessary cookies.
- Once the game services and payments open, from the game service and the payment institution: character and ranking data, and the result and reference of a payment.
Legal grounds
Personal data is processed only when one of the processing conditions listed in Article 5 of the Law is met. These conditions include explicit consent; being expressly provided for by law; being directly related to the conclusion or performance of a contract; the data controller fulfilling its legal obligation; the establishment, exercise or protection of a right; and the legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
- Processing needed to open, manage and protect your account is not based on your explicit consent; for this reason, you are not asked for a blanket explicit consent covering every processing activity.
- Where processing requires explicit consent, your consent is asked for separately from the acceptance of the agreements and only for that processing; having read this notice does not count as explicit consent.
- News and offer e-mails rely only on a permission you give separately. This permission is not a condition of membership and can be withdrawn at any time in Account Settings.
Transfers of data
Your personal data is transferred only to the following recipients, and only for the purposes stated:
- Hosting service
- The Services are hosted on a virtual server in Turkey, provided by Eva Bilişim on behalf of the Service Provider.
- E-mail delivery service
- To send e-mail verification links, password resets, verification codes and security e-mails, your e-mail address and the content of the e-mail are passed on, on behalf of the Service Provider, to Resend, a US-based service. This is a transfer abroad.
- Payment institution
- Once payments open, the order reference and amount are passed on to the payment institution to take the payment; you enter your card details directly on the payment institution's page.
- Game service
- Once the Store opens, the purchase and the character it is to be delivered to are passed on to the game service to deliver purchases.
- Competent authorities and institutions
- Only when there is a lawful request that the Service Provider is obliged to comply with.
Transfer abroad
The transfer of personal data abroad is subject to the conditions set out in Article 9 of the Law; the transfer made to send e-mails is also subject to these conditions.
The data transferred abroad is limited to your e-mail address and the content of the e-mail sent to you, and is used only to deliver that e-mail.
Retention and destruction
Your personal data is kept for as long as is necessary for the purpose for which it is processed and for the periods set out in the relevant legislation. When these periods end, the data is erased, destroyed or anonymized.
The technical and organizational measures necessary for the security of your personal data are taken; they are described in the “How the data is protected” section of the Privacy Policy.
- One-time verification codes and links expire after a short time.
- Registrations whose e-mail address has not been verified are deleted after a short time.
- When a session ends, the full IP address on the session record is deleted at that moment.
- The recipient and content of an e-mail are deleted from the delivery record once delivery is complete.
- The lifetimes of the cookies in your browser are listed in a table in the Cookie Policy.
Account activity and your correspondence, and the payment and Cash records kept once payments have opened, may be kept after your account is closed for as long as is necessary for legal obligations, disputes and fraud investigations.
Your rights under Article 11 of the Law
Under Article 11 of the Law, by applying to the data controller you have the following rights concerning yourself:
- To learn whether your personal data is processed.
- To request information about it if your personal data has been processed.
- To learn the purpose for which your personal data is processed and whether it is used in line with that purpose.
- To know the third parties, in Turkey or abroad, to whom your personal data is transferred.
- To request the rectification of your personal data if it is incomplete or inaccurately processed.
- To request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law.
- To request that rectification, erasure and destruction be notified to the third parties to whom your personal data has been transferred.
- To object to a result to your detriment that arises from the analysis of the processed data exclusively through automated systems.
- To claim compensation for the damage if you suffer damage because your personal data has been processed unlawfully.
Account sanctions (suspension, closure) are not decided by automated systems alone; these decisions are made by authorized staff. Security measures, however, such as temporarily locking sign-in after repeated failed sign-in attempts, are applied automatically.
How to apply
To exercise your rights, you can send your application from the e-mail address registered to your account to the contact e-mail address below.
- Data controller
- HAIYUE INTERACTIVE
- Contact e-mail
- haiyueinteractive@proton.me
- In your application, state your name, your username and the subject of your request clearly.
- Additional information may be requested to confirm that the application is yours; this information is used only to verify your identity.
- Your application is concluded free of charge as soon as possible according to the nature of the request, and within thirty days at the latest; if the action also involves a cost, the fee in the tariff set by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may be charged.
- If your application is rejected, if you find the reply insufficient, or if no reply is given in time, you can file a complaint with the Personal Data Protection Board within the periods set out in Article 14 of the Law.
Changes to this notice
This notice is updated when the data processed, the purposes or the recipients change. The current text is published on this page with its version number and date; changes that extend the data processed or the purposes are also announced on the site.