Notice under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data Controller

Your personal data is processed by [Company name] (“Keci”) as data controller, to the extent described below. Address: [Company address] · MERSIS: [MERSIS number] · Email: [Data protection email] · KEP: [KEP address].

2. Personal Data Processed

Identity: full name; optionally username, gender and date of birth.

Contact: email address, phone number.

Customer transactions: plan and order details, payment status and amount, country found from the IP address, broadcast titles and descriptions, broadcast history, channel names and IDs of connected platform accounts, support requests.

Transaction security: password digest, sign-in verification codes, session and trusted device details (browser and operating system name), IP address, platform access tokens, administrator action logs.

Visual and audio data: camera video and audio transmitted during a live broadcast and images the user uploads (video and audio are not recorded, only transmitted).

Card details are not processed by Keci; they are taken directly by the payment institution.

3. Purposes and Legal Grounds

For setting up membership, managing the account, delivering broadcasts to the chosen platforms, establishing guest connections, selling plans and taking payment, sending service emails and answering support requests; on the legal ground in KVKK Art. 5/2(c), “being directly related to the formation or performance of a contract”.

For keeping invoice and payment records and meeting requests from competent authorities and institutions; on the legal ground in KVKK Art. 5/2(ç), “being necessary for the data controller to fulfil its legal obligation”.

For ensuring account and information security, preventing abuse and unauthorised access and improving the service; on the legal ground in KVKK Art. 5/2(f), “the data controller’s legitimate interest, provided that it does not harm the fundamental rights and freedoms of the data subject”.

For establishing, exercising or protecting rights in a legal dispute; on the legal ground in KVKK Art. 5/2(e).

4. Method of Collection

Your personal data is collected electronically, by partly or fully automated means, through the forms on the website and panel, the broadcast studio, the platform account connection screens, the payment institution’s notifications and email correspondence.

5. Transfers

It may be transferred to PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. for payments; to the suppliers we use for hosting, sending email and relay (TURN) services, to the extent needed to provide the service; and, on request, to competent public authorities and institutions and judicial authorities.

Your broadcast and its title and description are sent, at your request and choice, to the platforms you connect (Google LLC / YouTube, Twitch Interactive Inc., Kick Streaming Pty Ltd, Meta Platforms Inc. and other services whose RTMP address you enter). As these platforms’ servers are located abroad, this transfer is an incidental transfer necessary for the performance of the contract under KVKK Art. 9/6(b). Where service suppliers are located abroad, the transfer is made with the appropriate safeguards (standard contract) provided for in KVKK Art. 9.

6. Retention Period

Account data is kept for as long as the membership lasts and deleted when the account is closed. Payment and invoice records are kept for the period required by the relevant tax and commercial legislation (10 years). Trusted device records are kept for 90 days, sign-in verification codes for 10 minutes and attempt counters for at most 1 hour. Data whose period has expired is deleted, destroyed or anonymised.

7. Your Rights

Under KVKK Art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions in KVKK Art. 7; to request that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

In line with the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can send your requests from your registered email address to [Data protection email], by KEP to [KEP address] or in writing to [Company address]. Requests are concluded free of charge within 30 days at the latest.