Data Protection Notice (KVKK)

Legal name

[Legal name — to be filled in]

Address

[Address — to be filled in]

Tax office / number

[Tax details — to be filled in]

Email

[Email — to be filled in]

Website

pinoras.com

• Identity and contact: name or company name, authorised person, email, phone, billing address, tax office and number.
• Customer activity: order records, wallet movements, refunds and cancellations, support tickets and their correspondence.
• Financial: deposit notifications, crypto transaction hash and sending address, withdrawal requests. We do not store card details.
• Transaction security: sign-in records, session data, IP address, failed sign-in attempts, audit records of administrative actions.
• Game details needed for an order: the game id, server or character name — only the fields required to perform the order.

• Taking the order, delivering the product and performing the sales contract.
• Running your wallet balance, deposits and refunds.
• Issuing invoices and meeting statutory retention obligations.
• Answering support requests and resolving disputes.
• Detecting fraud and unauthorised access; account security.
• With your explicit consent, sending campaign and announcement emails.

Your data is processed on the following grounds under Article 5 of the KVKK:

• 5/2-c — necessary for forming and performing a contract (orders, delivery, wallet).
• 5/2-ç — compliance with a legal obligation (invoices, financial records).
• 5/2-e — establishing, exercising or protecting a right (dispute records).
• 5/2-f — legitimate interest (security logs, fraud prevention).
• 5/1 — explicit consent (marketing emails and non-essential cookies only).

Data is not sold or rented for marketing. Transfers happen only in the following cases and are limited to the purpose:

• Suppliers: for top-up orders, only the game id needed to perform the top-up. Name, email and billing details are not transferred.
• Payment and blockchain networks: to carry out deposits and withdrawals.
• Hosting and infrastructure providers: the server service on which the data is stored.
• Telegram: only if you use the service through the bot, by the nature of messaging.
• Competent public authorities: where the law requires it.

Some providers' servers may be located abroad; in those cases the transfer is made in accordance with Article 9 of the KVKK.

Data is collected electronically through the registration and order forms on the site, wallet transactions, support tickets, the Telegram bot, and automatically kept security logs.

• Orders, invoices and financial records: 10 years, under the Tax Procedure Law and the Turkish Commercial Code.
• Account and contact details: for as long as the account is open, and after it closes for the applicable limitation periods.
• Support correspondence: 3 years.
• Security and audit logs: 2 years.

Once the period ends, data is deleted, destroyed or anonymised.

As a data subject you have the right to:

• Learn whether your personal data is processed, and request information if it is,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom it is transferred, in Türkiye or abroad,
• Request correction if it is incomplete or inaccurate,
• Request erasure or destruction where the conditions are met,
• Request that correction and erasure be notified to those third parties,
• Object to a result reached against you solely through automated analysis,
• Claim compensation for loss caused by unlawful processing.

You can send your requests, together with information identifying you, to the email address above or to the registered email address if there is one. Requests are resolved within 30 days. If a request is refused, you keep the right to complain to the Turkish Personal Data Protection Board.