KVKK notice
Last updated: 10 November 2026 · version 2026-11-10
Draft: this text is awaiting legal review. This note will be removed when the final version is published.
Informational translation. This is an English translation of our Turkish "KVKK Aydınlatma Metni", provided for convenience. In case of any difference, the Turkish version governs.
This Information Notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform users of the wunderstrike.com website (including the beta sign-up form) and the Wunderstrike game app.
1. Data controller
- Company: Karga Yazılım Ticaret Ltd. Şti.
- Address: [ADRES — sonra eklenecek]
- MERSİS No: [MERSİS — sonra eklenecek]
- E-mail: hello@wunderstrike.com
- Web: kar.ga
2. Categories of personal data processed
| Category | Data |
|---|---|
| Identity | Optional in-game display name; birth year; age bracket / age declaration (under 13, 13–17, 18+) |
| Contact | E-mail address (beta sign-up; optional in-game account protection); parent's e-mail address for under-13s (beta) |
| Customer transaction | Beta platform (Android / iPhone), "where did you hear about us" answer, sign-up status, site language; save game, team name, short code, city, shirt names, avatar, stars ledger, friends list, match invites, preset messages |
| Transaction security | Randomly generated device ID (UUID), server user ID, username, profile ID, device model name, first/last-seen times, verification codes, session tokens, rate-limit timestamps, Turnstile bot-protection signals, deletion record (user ID and time) |
| Legal transaction / consent records | KVKK notice acknowledgement and notice version, parental consent / parental awareness confirmation, parent link (parent's user ID, consent and withdrawal time), timestamps |
| Location (coarse region) | Country and province for users aged 13+ (from Cloudflare region headers). Not stored for under-13s. IP address, coordinates and postcode are not processed by the game server. |
| Visual | Photo-to-player feature: cropped face area (max 128×128, held only in server memory and deleted immediately after processing) and the generated 64×64 pixel portrait |
| Marketing | Consent for news and launch e-mails (optional) |
No special categories of personal data are processed, so there is no processing under Article 6 KVKK. The image used in the photo feature is not processed to recognise or verify a person's identity (i.e. not as biometric data); it is only used to create a pixel-art portrait and is not stored.
3. Purposes of processing
- Receiving beta sign-ups, verifying e-mail addresses and delivering Android or iPhone test invitations;
- Creating the game account, enabling login, storing progress in the cloud and optionally restoring it on another device;
- Providing adding friends, preset messages, online matches and co-op with friends;
- Generating pixel portraits from photos;
- Obtaining, recording and allowing withdrawal of parental consent for children under 13;
- Selecting child-appropriate, region-based sponsors for in-game billboards and counting impressions in aggregate without linking them to a person;
- Ensuring service security, preventing abuse and bots, and fixing errors;
- Responding to data subject applications and fulfilling legal obligations;
- Sending news and launch e-mails, if explicit consent is given.
4. Legal bases
| Legal basis (Art. 5 KVKK) | For which processing |
|---|---|
| Art. 5/2-(c): necessary for the conclusion or performance of a contract | Beta sign-up, verification and invitation; game account, login, cloud save, account restore, friends and match features, photo-to-portrait generation |
| Art. 5/2-(ç): compliance with a legal obligation | Keeping notice and consent records, responding to applications, deletion records, requests from competent authorities |
| Art. 5/2-(f): legitimate interest, provided fundamental rights and freedoms are not harmed | Bot protection, security and rate limits, troubleshooting with device model name, backups, coarse-region sponsor selection and aggregate impression counts, "where did you hear about us" information |
| Art. 5/1: explicit consent | Marketing e-mails; parental consent for under-13s' online/social features and beta sign-up; transfers abroad to the extent required [hukukçu doğrulayacak: ebeveyn onayının ve fotoğraf özelliğinin hukuki sebebi] |
You can withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of earlier processing.
5. Method of collection
Personal data is collected electronically and by automated means through the beta sign-up form on the website, the e-mail verification link, the information you enter in the game app, and the app's communication with our server. Region information is taken from the country/province headers that Cloudflare adds to the connection.
6. Transfers
6.1 Within Türkiye
Personal data may be transferred to legally authorised public institutions upon request, within the framework of Art. 8 KVKK. The game server is hosted by Markahost [doğrulanacak: Markahost veri merkezi ülkesi, muhtemelen Türkiye].
6.2 Abroad
To run the service, data may be transferred abroad to the following service providers (data processors):
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Web hosting, form and database, bot protection, cookieless statistics, game server connection, backups | US company, global network |
| Amazon Web Services (SES) | Verification e-mails | Germany (EU); US company |
| PixelLab | Pixel portrait generation | [doğrulanacak: ülke] |
| Google LLC (Firebase App Distribution) | Android beta invitation | USA |
| Apple Inc. (TestFlight) | iPhone beta distribution | USA |
Transfers abroad are made under Article 9 KVKK as amended by Law No. 7499: primarily on the basis of appropriate safeguards such as the standard contracts announced by the Board, and, in exceptional cases where these are not possible, on the basis of your explicit consent [hukukçu doğrulayacak: her alıcı için aktarım mekanizması ve standart sözleşmenin Kurum'a bildirimi].
7. Retention
Unverified beta sign-ups are deleted within 30 days; beta records when the beta programme ends or on your request; game data when your account is deleted. Deleted data disappears from backups within 30 days at the latest. See the Privacy Policy for details.
8. Your rights under Article 11 KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction if data is incomplete or inaccurate,
- request deletion or destruction under the conditions in Art. 7 KVKK,
- request that correction, deletion or destruction be notified to third parties to whom data was transferred,
- object to a result against you arising from analysis of your data exclusively by automated systems,
- claim compensation for damage caused by unlawful processing.
9. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, please include your name and surname, your signature if the application is written, your Turkish ID number (or, for foreigners, nationality and passport/ID number), your address for notifications, your e-mail address if any, and your request. You can send it:
- by e-mail to hello@wunderstrike.com, preferably from the e-mail address registered with us, or
- in writing (wet-signed) to [ADRES — sonra eklenecek].
You can also delete your game account directly in the game (PROFILE → delete account) or send a deletion request to destek@wunderstrike.com. For children under 13, the parent or legal guardian applies on their behalf.
Your application will be concluded free of charge within 30 days at the latest. If the action requires an additional cost, a fee under the tariff set by the Board may be charged. If your application is rejected, you find the answer insufficient, or no answer is given in time, you can complain to the Personal Data Protection Board.