FutMind Privacy Policy and KVKK Information Notice
Effective date: [DOLDURULACAK: yürürlük tarihi] Version: [DOLDURULACAK: doküman sürüm numarası]
This document fulfils the disclosure duty under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and explains how we process your personal data.
1. Data controller
- Legal name: [DOLDURULACAK: şirket ticari unvanı]
- Address: [DOLDURULACAK: şirket merkez adresi]
- Tax office and tax number: [DOLDURULACAK: vergi dairesi adı ve vergi kimlik numarası]
- MERSIS number: [DOLDURULACAK: MERSİS numarası]
- VERBIS registration number: [DOLDURULACAK: VERBİS kayıt numarası]
- Contact person for the data controller: [DOLDURULACAK: irtibat kişisi adı ve unvanı]
- Application e-mail address: [DOLDURULACAK: KVKK başvuruları için e-posta adresi]
- Registered electronic mail (KEP): [DOLDURULACAK: KEP adresi]
2. Categories of personal data processed
| Category | Contents |
|---|---|
| Identity | First name, surname (where required for invoicing) |
| Contact | E-mail address, phone number if provided |
| Customer transaction | Subscription plan, start and renewal dates, cancellation record, invoice records, refund requests |
| Financial | Transaction reference returned by the payment institution, amount, last four digits of the card and card brand. The full card number, expiry date and CVV are never transmitted to us and are never stored by us. |
| Transaction security | Account creation and login records, IP address, session and device information, password hash |
| Usage | Which match analyses you viewed, in-app click and page-view records |
| Marketing | Your consent to commercial electronic messages and consent history (IYS record), e-mail open and click records |
| Requests and complaints | Support correspondence, your KVKK applications and our responses |
We do not collect special categories of personal data (health, religion, biometrics, etc.). Please do not send such data to us in support correspondence.
We do not serve persons under 18 and do not knowingly process children's data. If we determine that an account belongs to a person under 18, we close the account and delete the data.
3. Purposes and legal bases
| Purpose | Data processed | Legal basis (KVKK Art. 5) |
|---|---|---|
| Account creation, authentication, session management | Identity, contact, transaction security | Art. 5/2-c: necessary for conclusion and performance of the contract |
| Providing the subscription and analysis content | Customer transaction, usage | Art. 5/2-c: performance of the contract |
| Collecting payment and issuing invoices | Financial, identity, customer transaction | Art. 5/2-c: performance of the contract; Art. 5/2-a: expressly provided for by law (Tax Procedure Law, Commercial Code) |
| Statutory books and document retention, tax duties | Financial, identity, customer transaction | Art. 5/2-ç: compliance with a legal obligation |
| Handling support requests | Contact, requests and complaints | Art. 5/2-c and Art. 5/2-f: legitimate interest |
| Preventing fraud, account sharing and abuse | Transaction security, usage | Art. 5/2-f: legitimate interest |
| Improving the Service and debugging | Usage, transaction security | Art. 5/2-f: legitimate interest |
| Non-essential cookies and marketing analytics | Usage, cookie data | Art. 5/1: explicit consent |
| Sending commercial electronic messages | Contact, marketing | Art. 5/1: explicit consent (with Law No. 6563 and IYS registration) |
| Pursuing disputes and legal defence | All relevant categories | Art. 5/2-e: establishment, exercise or protection of a right |
Where processing relies on explicit consent, you may withdraw your consent at any time. Withdrawal does not make processing before that point unlawful.
4. Method of collection
We collect data through the registration form, account settings, the payment flow, support correspondence, cookies and similar technologies, and the application's own server logs — electronically, by automated and partly automated means.
5. Retention periods
| Data | Retention period | Basis |
|---|---|---|
| Account and profile data | For the subscription term and 2 years after the account closes | Legitimate interest, potential disputes |
| Invoice and accounting records | 10 years | Commercial Code Art. 82 (for tax purposes, also 5 years under Tax Procedure Law Art. 253) |
| Payment transaction records | 10 years | Commercial Code Art. 82 |
| Login and transaction security logs | [DOLDURULACAK: log saklama süresi] | Legitimate interest and applicable legislation |
| Support correspondence | 3 years from the record date | Legitimate interest |
| Commercial message consent records | 3 years from withdrawal of consent | Secondary legislation under Law No. 6563 |
| KVKK application records | 3 years from the date of response | Proof of compliance with a legal obligation |
| Non-essential cookie data | Periods stated in the Cookie Policy | Explicit consent |
When a period expires, data is deleted, destroyed or irreversibly anonymised. Deletion runs on our periodic destruction schedule: [DOLDURULACAK: periyodik imha aralığı].
6. Transfers
We do not sell your data.
Domestic transfers (KVKK Art. 8). To provide the Service, your data may be transferred to the following groups of recipients:
- Payment institution: [DOLDURULACAK: ödeme kuruluşu ticari unvanı] — for collecting payments and processing refunds.
- Hosting and infrastructure provider: [DOLDURULACAK: barındırma sağlayıcısı ve sunucu lokasyonu].
- E-mail delivery provider: [DOLDURULACAK: e-posta gönderim sağlayıcısı].
- Accounting and financial advisory provider: [DOLDURULACAK: mali müşavir / muhasebe firması].
- Authorised public authorities and judicial bodies: where required by law, limited to the scope of the request.
International transfers (KVKK Art. 9). Some of the service providers we use may host servers outside Türkiye. The providers involved and the legal basis for each transfer: [DOLDURULACAK: yurt dışına aktarım yapılan sağlayıcıların listesi, ülkeleri ve dayanak]. Where standard contractual clauses are used, the notification duty to the Board is fulfilled.
7. Data security
The main technical and organisational measures we apply:
- All traffic encrypted in transit (HTTPS/TLS).
- Passwords stored as irreversible hashes.
- Access to data limited to what a role requires, with access logging.
- Card data never enters our systems; payment completes at a licensed payment institution.
- Backups and regular security updates.
- Confidentiality undertakings with staff and suppliers.
If a data breach occurs, we notify the Personal Data Protection Board and the affected data subjects as soon as possible under KVKK Art. 12/5.
8. Your rights as a data subject (KVKK Art. 11)
You have the right to request:
- To learn whether your personal data is processed.
- To request information if it has been processed.
- To learn the purpose of processing and whether the data is used in accordance with that purpose.
- To know the third parties in Türkiye or abroad to whom the data has been transferred.
- To have incomplete or inaccurate data corrected.
- To have the data erased or destroyed under the conditions in KVKK Art. 7.
- To have corrections, erasures and destructions notified to third parties to whom the data was transferred.
- To object to a result adverse to you produced solely by automated analysis of the data.
- To claim compensation for damage suffered as a result of unlawful processing.
In addition:
- Receiving a copy of your data. On request, we provide the data associated with your account as a machine-readable file (JSON or CSV).
- Deleting your account and data. On your deletion request, your account is closed and your data is deleted. Records we are legally required to keep (in particular invoice and accounting records) are retained for their statutory period; access to them is restricted and they are not used for any other purpose. We tell you in writing which data was deleted and which was retained under a legal obligation. Logging out is not deletion; deletion happens only on your explicit request — and when you request it, it genuinely happens.
- Withdrawing consent. You may withdraw at any time the consent you gave for marketing messages and for non-essential cookies.
9. How to exercise your rights
You may submit your application, in line with the Communiqué on Procedures and Principles of Application to the Data Controller, by one of the following routes:
- E-mail from the address registered to your account to [DOLDURULACAK: KVKK başvuruları için e-posta adresi].
- Registered electronic mail with secure electronic signature or mobile signature to [DOLDURULACAK: KEP adresi].
- A wet-signed petition delivered in person to [DOLDURULACAK: şirket merkez adresi] or served through a notary.
Your application should state your name, contact details, the subject of your request and any supporting documents.
We conclude the application within 30 days at the latest. Responses are free of charge as a rule; where the process incurs a cost, the fee set in the Board's tariff may be charged.
If your application is rejected, the response is insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.
10. Changes
If we update this policy, we publish the current version on our website and notify material changes by e-mail before they take effect.