KVKK Disclosure Notice
Last updated: 25.08.2026
1. Data Controller
Your personal data processed in the Koi application and on the teamkoi.tech website is handled under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") by the natural person who operates Koi, acting as the data controller. The data controller is not a company; it is the individual identified below.
- Name: Görkem AYKAÇ
- Place of residence: Türkiye
- Email: support@teamkoi.tech
- Written applications: if you wish to apply by post, the postal address for service is provided to you upon a request sent to the email address above.
- VERBİS registration: Not subject to registration. The data controller is a natural person who does not keep books on a balance-sheet basis; under the Board's decisions only the annual number of employees is assessed in that case, and it is below 50. Processing special categories of personal data is not the controller's principal activity.
2. Categories of Data Processed
| Category | Data |
|---|---|
| Identity | First name, last name, username, date of birth, gender |
| Contact | Email address |
| Social sign-in | If you sign in with Google or Apple, the account identifier, email address (including Apple's hide-my-email relay address) and name passed on by that provider |
| Profile and content | Profile photo, title, description; events you create, event images, comments, ratings and tags |
| Business and community account | For business accounts, the venue name, address and location and the venue QR code; for community accounts, the description, capacity and membership settings |
| Location | If you grant location permission, your device location while the app is open; the location of events you create. Your device location is not stored in your profile or in event records; see section 7 |
| Participation and connections | Participation requests and participant records, the time your presence at an event venue was verified, community memberships and subgroups, friendships, venues you follow, users you block |
| Security | Password hash, session and device information, device identifier, push notification token, IP address, app version, login/logout timestamps, verification and password reset codes, server access logs, app crash reports |
| Subscription and transaction | Subscription status and period, billing profile identifier, purchase and usage entitlement records. Your credit card and payment instrument details are never processed or stored on our servers; they are collected directly by Apple App Store / Google Play |
| Financial | Only for community accounts, and only if the contribution collection feature is made available and you enter it: bank account details |
| Music | Spotify track details you add to an event (track, artist, album name) and the identifier and link of the playlist created |
| Requests and complaints | Your "Contact us" messages, your reports about content or users, your objections to moderation decisions, emails you send to the support address, and the name, email, phone and message you share in the website contact form |
| Marketing | Commercial electronic message consent and its timestamp, notification preferences |
The application does not seek to collect special categories of personal data within the meaning of KVKK Article 6 (health, religious belief, biometric data, etc.). We recommend that you do not enter such data into free-text fields (event descriptions, comments, profile description).
3. Processing Purposes
- Account creation, login, authentication, and account security
- Providing event creation, participation, community, business and friendship features
- Showing events near you and the map; confirming participation by verifying, through location proximity, that you are at the event venue
- Generating event, community and venue recommendations and improving the user experience
- Reviewing user content before publication with automated tools and, where needed, human review, for compliance with the law and the Terms Of Use (moderation)
- Managing subscriptions, purchases and usage entitlements
- Sending notifications and emails (transactional notifications and, if you have consented, commercial electronic messages)
- If you consent, delivering promotional notifications from business and community accounts based on your location and interests. The accounts sending these notifications never receive your identity or contact details; they are only told how many people can be reached
- Providing business and community accounts with aggregate statistics that do not identify individuals
- Detecting and fixing application errors and crashes
- Handling requests, complaints, reports and support processes
- Preventing abuse, fraud and security breaches
- Fulfilling hosting provider obligations under Law No. 5651 and other legal obligations, and responding to requests from competent authorities
4. Collection Method and Legal Grounds
Your personal data is collected entirely electronically: directly from you when you register, log in, edit your profile, create or join events; automatically while you use the application (session, device, location, security and crash records); from Google or Apple when you sign in with them; through Apple App Store / Google Play and RevenueCat for subscription transactions; and through the contact form on our website when you fill it in.
Your data is processed under KVKK Article 5 on the following grounds:
- Necessity for the establishment or performance of a contract (Art. 5/2-c): account, profile, event, participation including location-based participation checks, community, business, recommendation, subscription and transactional notification services
- Compliance with the data controller's legal obligations (Art. 5/2-ç): traffic records under Law No. 5651, statutory retention and notification obligations, requests from competent authorities
- Establishment, exercise or protection of a right (Art. 5/2-e): dispute, complaint, objection and abuse records
- Legitimate interest (Art. 5/2-f): security, content moderation, error and crash analysis, aggregate statistics, service improvement
- Explicit consent (Art. 5/1): sending commercial electronic messages and, for that purpose, delivering promotional notifications to you based on your location and interests. You may withdraw your explicit consent at any time in the app settings; withdrawal does not affect the lawfulness of earlier processing
Your device location is processed only if you grant location permission through your device's operating system. If you do not, you can continue to use the application; only location-dependent features will be limited.
5. Sharing with Other Users and Domestic Transfers
Because of how the application works, your profile, events, comments and participation status are visible to other users according to your privacy preferences. The owner of an event you join or request to join sees your participant details and your participation confirmation; the administrator of a community you belong to sees your membership details.
In addition, your personal data may be transferred, in accordance with KVKK Article 8, to:
- Authorized public institutions and organisations and judicial authorities (upon request and as required by law),
- Contracted providers of legal, financial advisory or audit services, where such services are used.
6. International Transfers
Your personal data is transferred abroad. The application's server infrastructure is hosted in Germany, and data transfers take place through the service providers listed below:
| Recipient | Country | Purpose | Data transferred |
|---|---|---|---|
| Contabo GmbH (server and hosting provider) | Germany | Hosting the application servers and database | All data categories processed in the application |
| Google LLC (Firebase Cloud Messaging, Firebase Authentication, Firebase Crashlytics, Sign in with Google) | USA | Sending push notifications, authentication, Google sign-in, crash report analysis | Notification token, device identifier and details, notification content; if you sign in with Google, account identifier, email and name; technical crash data and user identifier |
| Google LLC (Google Places API) | USA | Searching for a venue for an event or business | Search text and the area searched |
| Apple Inc. (Sign in with Apple, App Store, Apple Push Notification Service) | USA | Apple sign-in, verifying in-app purchases, delivering notifications to iOS devices | If you sign in with Apple, account identifier, email (including relay address) and name; transaction identifier, subscription status; notification token and content |
| Google LLC (Google Play) | USA | Verifying in-app purchases | Transaction identifier, subscription status |
| RevenueCat, Inc. | USA | Managing subscription and purchase entitlements | Customer identifier that does not directly identify you, subscription and purchase status, store transaction identifiers |
| OpenAI, L.L.C. | USA | Automated review of user content before publication (moderation) | Text and images being reviewed (event, comment and profile content) |
| Mapbox, Inc. | USA | Displaying the map | IP address, device details, the area shown on the map and the map software's usage data |
| Hostinger International Ltd. | Cyprus (EU) | Sending transactional emails and hosting the support mailbox | Email address, email content (verification and password reset codes), emails sent to the support address and website contact form messages |
| Google LLC (Gmail) | USA | Forwarding website contact form messages to the support address | The name, email, phone and message you share in the form |
| Spotify AB | Sweden / USA | Adding music to events and creating a playlist on your Spotify account (only if you use this feature) | The track details you select and the playlist name. Your Spotify authorization is used only at the moment of the operation and is not stored on our servers |
These transfers are carried out under KVKK Article 9, in line with the new regime introduced by Law No. 7499, on the basis of:
- An adequacy decision of the Board, where one exists,
- Otherwise, appropriate safeguards such as standard contractual clauses, binding corporate rules or a written undertaking,
- In the absence of these, the exceptions in Article 9/6 for incidental transfers.
You may request a copy of the safeguard applied through the application channels in section 11.
7. Retention and Destruction
| Data | Retention period |
|---|---|
| Account and profile data | For as long as the account is active; deleted or anonymised within 30 days at the latest from your account deletion request |
| Event, comment and community content | Deleted or anonymised by severing the link to the user within 30 days at the latest from your account deletion request |
| Device location | Not stored in your profile or in event records; it may appear in server access logs as part of requests and is deleted together with those logs |
| Server access and traffic logs | 1 year under Law No. 5651 |
| Session, device, and security records | Up to 2 years |
| Crash reports | 90 days |
| Request, complaint, report and objection records | 2 years from their resolution |
| Subscription and purchase records | 5 years, as required by applicable legislation and evidentiary obligations |
| Commercial electronic message consent records | 3 years from withdrawal of consent |
| Verification and password reset codes | Immediately upon expiry |
| Records of destruction operations | 3 years |
At the end of the applicable period, data is deleted, destroyed, or irreversibly anonymised.
About account deletion and the 30-day period: When you delete your account, your access is closed immediately and your profile becomes invisible to other users. Permanent destruction of data may take up to 30 days, so that an accidental deletion can be reversed and abuse can be prevented. During this period you may request that your account be restored by contacting the email address given in section 1. After 30 days the operation cannot be reversed.
Data subject to statutory retention obligations (for example subscription and purchase records, commercial electronic message consent records and traffic records) continues to be stored for the periods above, in a form that does not reveal your identity.
8. Data Security
Administrative and technical measures are applied to protect your data, including irreversible hashing of passwords, transport layer encryption (TLS), authorization and role-based access control, access logging, and regular backups. If it is discovered that your personal data has been obtained by unauthorised persons, this is reported to you and to the Personal Data Protection Board as soon as possible under KVKK Article 12.
9. Automated Processing and Moderation
- Event, comment and profile content you share is checked automatically before publication against a list of prohibited expressions and with OpenAI's content moderation service. Content found to breach the rules is not published and you are notified.
- Event and community recommendations, and who receives promotional notifications, are determined by automated ranking based on location, interests and usage signals.
- You may object to the outcome of an automated check and request that a person review the decision again, using the application channels in section 11.
10. Your Rights
Under KVKK Article 11, you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether data is used in line with that purpose,
- Know the third parties to whom your data is transferred domestically or abroad,
- Request correction of incomplete or inaccurately processed data,
- Request deletion or destruction,
- Request that correction, deletion, or destruction be notified to third parties to whom the data was transferred,
- Object to a result arising against you from analysis carried out exclusively by automated systems,
- Claim compensation for damage suffered due to unlawful processing.
11. How to Apply
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:
- By email sent from the email address registered in the app to the address given in section 1,
- Through the in-app contact channel ("Contact us"),
- In writing, to the address that will be provided to you as described in section 1,
- Using registered electronic mail (KEP), a secure electronic signature, or a mobile signature.
Your application should include your name, surname, the email address registered in the app, and the subject of your request. Applications are concluded within 30 days at the latest. Applications are, as a rule, free of charge; a fee not exceeding the cost of the operation may be charged in the cases foreseen by the Communiqué. If your application is rejected, the response is insufficient, or no response is given in time, you retain the right to file a complaint with the Personal Data Protection Board.
12. Updates
This notice is updated as needed. The current version is accessible from within the app, and in the event of a material change you will be informed in the app and asked to confirm that you have read the updated notice.