KVKK Information Notice

1. Identity of the data controller

Data controller: [Name of the data controller]. Address: [Postal address]. Email: destek@bostreak.com.

2. Categories of personal data processed

• Identity: display name, age range (if given in the intro survey).
• Contact: email address.
• Customer transaction: lesson and exam records, answer accuracy, XP, streak, quest, badge, league and Horn records; friend code, friend list, nudge and congratulation records; portfolio period archive; virtual balance, virtual capital, virtual trade and pending order records; trade journal notes; usage measurement records (days the app was opened, screens opened, intro question step); intro survey answers (experience, markets of interest, goal, area of interest, daily time, how they heard about the app); language, time zone, daily goal and avatar preference; support requests.
• Transaction security: password hash, hashes of session keys and verification codes, Google/Apple user ID, IP address and request information.
• Request data (only if a KVKK request is made): full name, Turkish ID or passport number, address, phone, signature.

No special categories of personal data (health, biometric, religion, ethnic origin, etc.) are processed.

3. Purposes of processing

• Running membership and contract processes, creating and managing accounts,
• Providing the education and simulation service (lessons, virtual portfolio, leagues, quests, badges),
• Personalising the service (daily goal and starting plan based on survey answers),
• Running information security processes and preventing cheating and abuse,
• Communications (verification, sign-in and password reset emails, support replies),
• Handling requests, complaints and data subject applications,
• Carrying out activities in compliance with the law, following legal matters and informing authorised bodies.

4. Collection method and legal bases

Your personal data is collected electronically, by automated and partly automated means, through the mobile app, the website, Google and Apple sign-in services and email.

Your data is processed on the following legal bases listed in KVKK Art. 5/2:

• (c) Necessary for entering into or performing a contract: account, learning, virtual portfolio, survey and contact data.
• (ç) Necessary for the controller to fulfil a legal obligation: answering data subject requests, informing authorised bodies.
• (e) Necessary to establish, exercise or protect a right: using records in possible disputes.
• (f) Our legitimate interests, provided they do not harm your fundamental rights and freedoms: service security, preventing cheating and abuse, improving the service through usage measurement.

Your explicit consent is not relied on for these processing activities.

5. Transfers

• To our service providers (as suppliers): server and database hosting, email delivery (Resend), website and email forwarding (Cloudflare), storage of support emails (Google) — to provide the service and communicate with you.
• To Google and Apple: for identity verification if you sign in with them.
• To the logo service (Brandfetch): your device’s IP address and basic technical information when asset logos load on your device.
• To other users: display name, avatar, league points, weekly XP and portfolio score in leagues — to provide the league feature; to people you add as friends, also total XP, streak, badge tiers and weekly portfolio return percentage — to provide the friends feature.
• To authorised public bodies: when requested, under a legal obligation.

Some of our service providers’ servers are located abroad (for example, in the EU and the US), so your data may be transferred abroad. These transfers are made under KVKK Art. 9 on the basis of standard contracts signed with the recipient and notified to the Personal Data Protection Authority (or an adequacy decision, where one has been announced).

6. Retention

Account data is kept for as long as your account exists and is deleted immediately when the account is deleted (and from any backups within 30 days). Support and request correspondence is kept for up to 2 years. Detailed periods are in the “How long we keep it” section of the Privacy Policy.

7. Your rights under KVKK Art. 11

• (a) To learn whether your personal data is processed,
• (b) To request information if it has been processed,
• (c) To learn the purpose of processing and whether data is used for that purpose,
• (ç) To know the third parties in Türkiye or abroad to whom your data is transferred,
• (d) To request correction of incomplete or incorrect data,
• (e) To request deletion or destruction of your data under the conditions in KVKK Art. 7,
• (f) To request that actions under (d) and (e) be notified to third parties who received your data,
• (g) To object to an outcome against you resulting solely from automated analysis of your data,
• (ğ) To claim compensation for damage caused by unlawful processing.

8. How to apply

To exercise your rights, in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, send your request from the email address registered to your account to destek@bostreak.com, in writing (by hand, post or through a notary) to [Postal address], or signed with a secure electronic or mobile signature to destek@bostreak.com. You can use the Data Subject Request Form.

Your request will be answered free of charge within 30 days at the latest. If the action involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. You can also delete your account instantly in the app.