KVKK Privacy Notice

1. Data Controller

This Privacy Notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, published in Official Gazette No. 30356 of 10.03.2018.

Data Controller: Ümraniyespor Kulübü Derneği (the "Club").

Address: Hekimbaşı, Küçüksu Cd., 34768 Ümraniye / İstanbul · Telephone: (0216) 630 20 08

2. Categories of Personal Data Processed

Through this website, the Club processes the following personal data:

• Identity and contact data: the name, e-mail address and, where given, telephone number you submit in the contact form.
• Transaction security data: server records generated automatically when you access the site, such as IP address, browser and device information and time of access.
• Content of your request: the message you write in the contact form and any documents you choose to attach (JPEG, PNG, PDF).
• Usage data: page view and navigation statistics collected through analytics cookies, which run only where you have given explicit consent.

The Club does not intend to collect special categories of personal data (health data, biometric data and the like) through this site. Please do not write such data into the free-text field of the form.

3. Purposes of Processing

• Forwarding your enquiry to the relevant department and responding to it.
• Assessing sponsorship, accreditation, accounting and youth academy applications.
• Keeping the site secure and preventing misuse and automated attacks.
• Measuring site performance and improving content (only where explicit consent has been given).
• Meeting retention and disclosure obligations arising from legislation.

4. Legal Basis

Your personal data is processed on the following legal bases under Article 5/2 of the KVKK:

• Art. 5/2-c — directly related to the conclusion or performance of a contract (application and enquiry processes).
• Art. 5/2-ç — necessary for the Club to fulfil its legal obligations.
• Art. 5/2-f — processing necessary for the legitimate interests of the Club (site security, record keeping).
• For analytics cookies and the related transfer abroad: your explicit consent under Articles 5/1 and 9 of the KVKK.

5. Parties to Whom Data May Be Transferred

Domestic transfers: your enquiry may be shared with the relevant Club department and, where necessary, with service providers such as legal counsel and financial advisers; and, upon lawful request, with authorised public institutions and bodies.

International transfers: because of hosting (Vercel Inc., USA), protection against bot attacks (Cloudflare, Inc., USA) and — where you give explicit consent — analytics measurement (Google Ireland Ltd. / Google LLC), your data may be transferred to servers outside Türkiye. These transfers are carried out under Article 9 of the KVKK on the basis of your explicit consent or the other conditions provided for in the Law.

6. Method of Collection

Your personal data is collected wholly or partly by automated means: when you complete the contact form, when you reach us by e-mail or telephone, and through cookies and server records while you browse the site.

7. Retention Periods

• Contact form records and attached documents: 2 years from conclusion of the enquiry.
• Server access logs: 1 year (obligations under Law No. 5651 are reserved).
• Analytics data: at most 14 months, in line with the measurement provider's retention policy.

At the end of the period, data is deleted, destroyed or anonymised.

8. Data Security Measures

• Site traffic is encrypted end to end (HTTPS/TLS).
• Documents uploaded through the form are not stored on the server; they are delivered straight to the mailbox of the relevant department.
• Uploaded files are verified by type signature; only JPEG, PNG and PDF are accepted and executable files are rejected.
• Verification against automated (bot) submissions is applied.
• Access rights are role-based and reviewed regularly.

9. Your Rights as a Data Subject (KVKK Art. 11)

As a data subject, under Article 11 of the Law you have the right to:

• Learn whether your personal data is being processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used in accordance with that purpose.
• Know the third parties to whom the data is transferred, at home or abroad.
• Request correction where the data is incomplete or incorrect.
• Request erasure or destruction within the conditions laid down in the Law.
• Request that correction, erasure and destruction be notified to the third parties to whom the data was transferred.
• Object to a result against you arising from analysis carried out exclusively by automated systems.
• Claim compensation where you suffer loss because of unlawful processing.

10. How to Apply

You may submit requests concerning your rights in writing to the Club's address, or from the e-mail address registered in our systems, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application is concluded within thirty days at the latest. If the request entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected or is not answered within the time limit, your right to lodge a complaint with the Personal Data Protection Board is reserved.

11. Effect and Updates

This notice may be updated because of changes in legislation or in our data processing activities. The current version is always published on this page.