KVKK Privacy Notice · Lokaltenis

This is an informational translation. If it conflicts with the Turkish text, the Turkish text prevails. Read the Turkish text

1. Data controller

Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is Mnasoft Yazılım ve İnovasyon Hizmetleri. Address: Etiler Mah. Akgören Sk. No:7 Beşiktaş/İstanbul. KVKK contact: gizlilik@lokaltenis.com. Phone: +90 537 465 65 97.

This notice is provided for information when personal data is collected on the Lokaltenis website, app and club panel; it is not an explicit consent text. For independent activities in which clubs determine their own purposes and means, the club concerned is a separate data controller and provides its own notice.

2. How data is collected

Data is collected electronically from registration and verification forms, profile/playing preferences and user content, match and tournament transactions, bookings and payments, support/complaint requests, device permissions and app/server security logs. In a club invitation, contact details may come from an authorised club employee. Payment and subscription verification results are received from the relevant provider.

A phone number or an e-mail address is required, depending on the registration method chosen. Non-mandatory fields such as biography, city, playing hand and photo are optional. Not giving location permission or a marketing preference does not prevent basic membership.

3. Purposes and legal grounds

Data and activity	Purpose	Legal ground and scope
Name, account ID, verified phone/e-mail, password hash	Opening the account, sign-in, verification, recovery and membership communication	KVKK art. 5/2-c to the extent necessary to conclude/perform the membership contract; for security activities, proportionate legitimate interest under art. 5/2-f.
Level, playing hand, match/score, LRS, tournament and activity history	Matching, rating, entry, fixtures, match analysis requested by the user and Premium filters	Art. 5/2-c to the extent necessary for the requested service. Unnecessary profile fields are not made mandatory; no automatic authority arises for use for other purposes.
Profile/post images, biography and content	Providing the sharing feature chosen by the user	Art. 5/2-c to the extent necessary to perform the requested service; separate explicit consent for optional publication on the open internet.
Messages, invitations, moderation/complaint records	Communication, invitations and the review of abuse	Art. 5/2-c to perform the service; art. 5/2-e to protect a right; art. 5/2-f for proportionate security/prevention of violations.
Booking, tournament payment, invoice and transaction references	Performance, collection, refunds, accounting and statutory records	Art. 5/2-c, ç and, where necessary, e. The full card number and security code are not stored by Lokaltenis.
Approximate location	Showing nearby players/courts and the distance band	Explicit consent; manual region selection as an alternative. The precise location is made approximate before it is sent to the server.
Device/session ID, IP, access and error logs	Preventing unauthorised access, cheating and technical problems	Art. 5/2-f within a documented legitimate interest; art. 5/2-ç where a specific obligation applies. Records proportionate to the purpose are kept.
Notification token and service notifications	Match, payment, booking and security information	Art. 5/2-c or f to the extent necessary for performance/security. Operating-system access permission is managed separately.
Marketing preference and related channel information	Optional sending of campaigns and promotions	Explicit consent and applicable commercial electronic message approval; not a condition of membership.
Club staff identity, role and transaction records	Invitation, authorisation and security of the club account	Art. 5/2-c, ç or f as the specific relationship requires; no access outside the role is given.

A processing activity necessary for membership is not made conditional on explicit consent. Where legitimate interest is relied on, a balance with the user’s fundamental rights and freedoms is observed. No data is collected on the basis of this notice for health, biometric identification or other special categories of data without a suitable separate process.

4. Location, images and messages

Location permission is optional. The stored coordinate is made approximate; other users are shown a distance band instead of the precise location. Approximate location is also personal data. The last location is kept for at most 30 days; when a new value arrives, the previous value is replaced. When consent is withdrawn, if there is no other legal ground, location processing stops and the data is put into the deletion process.

Images are hosted on our own servers and made available to other users or the open internet within the visibility you choose. Location/device metadata in the image file is removed during reprocessing. This does not mean that the image itself is anonymous. Service providers’ access to images and content is subject to the transfer rules below.

Messages are not end-to-end encrypted. In the case of a complaint or a specific security need, a review limited to the purpose and logged is carried out only by authorised persons. Server and account-related error logs may contain personal data; unnecessary content and access keys are filtered out. No unnecessary personal details are added to notification content.

HTTPS in transit, role-based access limits and logs of administrative actions are applied. Passwords are stored as irreversible hashes. Technical and administrative measures appropriate to the processing risk are reviewed; access rights are limited to the needs of the service. Suspected breaches can be reported to gizlilik@lokaltenis.com; notifications to the Board/data subjects required by law are assessed separately.

5. Transfer of data

Data may be transferred only to the extent necessary: to the club or organiser concerned for bookings/tournaments, to iyzico for transactions and payments, to the Apple/Google store providers for subscription verification, to the SMS provider for phone verification/invitations, to e-mail delivery, hosting and technical support providers, to users within the chosen visibility, and to legally authorised authorities. Clubs are not given the whole user database; the transaction concerned and the scope of authority are decisive. User data is not sold for advertising.

The application and database servers are in Türkiye. The Firebase notification service and Apple/Google subscription verification may involve transfers of data abroad. Foreign remote access and sub-service providers are also part of the transfer inventory. The table of recipients and transfers is an integral part of this notice:

Service and recipient	Data and purpose
iyzico	Name/contact details necessary for payment, transaction information; payment/refund
Google Firebase	Notification token and limited notification content
Apple / Google	Subscription transaction ID and verification information
Hosting, e-mail, SMS (İleti Merkezi) and technical support	Data necessary for the infrastructure service concerned

Transfers abroad are made under the conditions of KVKK art. 9. Where standard contractual clauses are used as an appropriate safeguard, a contract suited to the actual parties and roles is signed and notified to the Authority within the period set by the legislation. A general notice or a vague consent box is not used as the sole basis for continuous transfers abroad.

6. Visibility and retention

Profile publication on the open internet is off by default. The user can turn it on and off with a separate preference. Limited visibility necessary to run an event the user takes part in is explained separately. Publication on the open internet may lead to access by third parties and to search-engine caches. When the preference is turned off, publication under our control stops; the necessary removal processes are carried out.

Category	Retention rule
Account, profile and ordinary content	For the duration of the account relationship; on a deletion request, data for which the conditions are met is removed within 30 days at the latest. Legal retention is kept separate.
Approximate location	At most 30 days for the last value; deleted earlier if the purpose or consent ends.
Error report	At most 30 days from creation.
Ordinary security/access log	At most 180 days from creation; a special statutory period or evidence retention needed in a specific incident applies separately.
Complaint and moderation evidence	At most 2 years from resolution; if a specific legal claim is ongoing, only the necessary evidence is kept for that process. This period is not presented as a general statutory requirement.
Transaction, pre-information and contract proof records	The period of at least 3 years provided for in the relevant legislation; documents within an applicable longer mandatory retention are kept only for that period.
Tax/commercial documents	Documents under the Tax Procedure Law (VUK): 5 years according to the relevant starting rule; documents under art. 82 of the Turkish Commercial Code (TTK): 10 years. If a document falls under both, the longer necessary period applies.
Marketing consent/refusal and message records	For the period in the applicable commercial message legislation; for consent records the end of validity, for other message records the date of the record, is decisive.
Record of deletion/destruction/anonymisation	At least 3 years from the operation; another mandatory period if there is one.
Backups	A cycle of at most 90 days; deleted data is not used in normal operation and deletion instructions are applied again on restore.

Data whose processing conditions have ended is deleted, destroyed or genuinely anonymised. Removing the name from a match record does not by itself amount to anonymity. If records that can be linked to a person must be kept, an appropriate legal ground, access limit and a defined retention period apply; no indefinite personal records are kept merely by calling them “statistics”.

7. Rights and requests

Under KVKK art. 11 you have the right to learn about the processing; to learn its purpose and recipients; to request the correction of inaccurate/incomplete data, deletion/destruction where the conditions are met, and notification of these operations to third parties to whom the data was transferred; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

Requests can be made in writing to the postal address above, with a secure electronic signature/mobile signature, from the e-mail address previously notified and registered in our system to gizlilik@lokaltenis.com, or through the in-app area for requests.

The request must include your name and surname, the subject of the request, your Turkish ID number (for foreigners: nationality, passport number or ID number if any), your residential or business address for notices and, if any, your e-mail, phone or fax for notification. A signature is required for written requests; a power of attorney for requests through a representative. No unnecessary copies of documents are collected for identity verification.

Requests are concluded as soon as possible according to their nature and within 30 days at the latest; the reasons for a refusal are given. If the operation requires an additional cost, only a fee in line with the Board’s tariff may be charged. The right to complain to the Board and its time limits are subject to KVKK art. 14.

If the notice is updated, the new version is published and material changes are announced separately; before an activity requiring new explicit consent starts, a separate choice is offered.