Privacy Notice

Version 7 · 1 November 2026

This notice explains how your personal data is processed when you use the KickOffer app, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Data controller

Buluter GmbH

• Address: Rheinstr. 113-115, 47798 Krefeld Germany
• Email: [email protected]

2. Personal data we process

Account and identity data

• Email address and sign-in method (email, Google or Apple); authentication is handled by Firebase Authentication. We never store your password on our servers.
• Your username and chosen avatar.

Gameplay data

• Match records, bids, placements, scores, level, badges and statistics.
• Bonservis transactions, rewards and purchase records (your payment details stay with the App Store / Google Play and never reach us).

Device and technical data

• Push notification token, platform and language preference, used to send notifications.
• Crash reports when the app fails (Sentry): device model, OS version, app version and error details.

Analytics data (only with your consent)

• Usage data such as screen views and in-game events (Firebase Analytics). It is off by default and collected only if you opt in.
• We do not collect advertising identifiers (IDFA/AAID); ad personalisation is disabled.

3. Purposes and legal bases

• Creating your account and providing the Service: performance of a contract (KVKK Art. 5/2-c).
• Running matches, ensuring fair play and security, preventing cheating: performance of a contract and legitimate interest (Art. 5/2-c, 5/2-f).
• Detecting and fixing errors: legitimate interest (Art. 5/2-f).
• Sending notifications: the notification permission you grant on your device and performance of a contract; you can turn it off at any time.
• Improving the game through usage analytics: explicit consent (Art. 5/1).
• Complying with legal obligations (e.g. tax and financial records): legal obligation (Art. 5/2-ç).

4. Transfers

We share personal data with our service providers only for the purposes above:

• Google (Firebase Authentication, Cloud Messaging, Analytics),
• Functional Software Inc. (Sentry error monitoring),
• Our hosting and infrastructure provider netcup GmbH,
• Apple and Google (app store purchase validation),
• Competent public authorities where required by law.

Some of these providers store data outside Türkiye; such transfers are made under the conditions and safeguards set out in Article 9 of the KVKK.

5. Retention

• Account and gameplay data are kept for as long as your account is open.
• When you delete your account, your personal data is deleted or anonymised within 30 days. Records that remain in other players' match history are anonymised so that they no longer identify you.
• Purchase and financial records are kept for the period required by law.
• Crash reports are kept for at most 90 days.

6. Your rights (KVKK Art. 11)

By contacting the data controller you have the right to:

• Learn whether your personal data is processed,
• Request information about such processing,
• Learn the purpose of processing and whether data is used accordingly,
• Know the third parties to whom data is transferred in Türkiye or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of data under Article 7 of the KVKK,
• Request that corrections and deletions be notified to third parties to whom data was transferred,
• Object to an outcome against you resulting exclusively from automated analysis,
• Claim compensation for damage caused by unlawful processing.

7. Managing consent and deleting your account

• You can withdraw analytics consent at any time via Settings → Analytics.
• You can turn off notifications via Settings → Notifications or your device settings.
• You can delete your account and associated data in the app via Settings → Delete my account.

8. Contact

Send requests about your rights to [email protected] from the email address registered to your account, or in writing to Rheinstr. 113-115, 47798 Krefeld Germany. Requests are answered free of charge within 30 days at the latest.

9. Children's privacy

Users under 18 use the Service with the consent of a parent or legal guardian. We process only the data children need to use the Service, and no ad personalisation takes place. Parents or guardians can request deletion of their child's data at [email protected].