KVKK Disclosure Statement

1. Identity of the Data Controller

The party acting as data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is Ceyhun Ege Aşkın, operating under the "Nesoi Network" brand. Data controller: Ceyhun Ege Aşkın (natural person) E-mail: [email protected] Website: nesoinetwork.com

2. Categories of Personal Data Processed

The following categories of data are processed in connection with your use of our services:

• Identity and contact data: name, username, e-mail address, profile picture, Discord or Google account identifier.
• Account security data: encrypted (hashed) password, two-factor authentication key, e-mail verification and password reset tokens.
• Transaction security data: IP address, last login time, browser and operating system information, approximate location derived from the IP address, session and cookie records.
• Customer transaction data: purchase and licence records, transaction number, plan information, billing details.
• Marketing data: the record of the explicit consent you have given for newsletter and campaign communications and the time at which that consent was obtained.
• Server management data: the name and description of the game server you manage, panel administrator roles and administrator action (audit) logs.
• Player data: the display name, in-game identifier (citizenid), session identifier, Discord identifier and playtime of the players connected to the server you manage. In respect of this data, the server owner is the data controller and Nesoi is the data processor.
• Request and complaint data: the message content and diagnostic reports you submit in your support requests.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Creating the membership record, authenticating identity and managing sessions.
• Providing the panel service, connecting your server to the panel and relaying commands.
• Carrying out licence and purchase processes, invoicing and fulfilling accounting obligations.
• Carrying out information security processes: preventing unauthorised access, suspicious login alerts, rate limiting and prevention of misuse.
• Troubleshooting, improving performance and enhancing service quality.
• Following up requests and complaints and providing the support service.
• Sending commercial electronic messages regarding product announcements and campaigns, where your explicit consent exists.
• Fulfilling statutory disclosure obligations towards authorised public bodies and institutions.

4. Legal Bases for Processing

Your personal data is processed on the following legal bases set out in Article 5 of the KVKK:

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c): membership, licensing and provision of the panel service.
• Fulfilment of the data controller's legal obligation (Art. 5/2-ç): invoicing, tax and statutory retention obligations.
• The data having been made public by the data subject themselves, and processing being mandatory for the establishment, exercise or protection of a right (Art. 5/2-d and 5/2-e): retaining audit logs as evidence in the event of a dispute.
• Processing being mandatory for the legitimate interests of the data controller (Art. 5/2-f): information security, fraud prevention, telemetry and service improvement.
• Explicit consent (Art. 5/1): solely in respect of sending commercial electronic messages and non-essential analytics cookies.

5. Method of Collecting Personal Data

Your personal data is collected wholly or partly by automated means, through the information you enter yourself via our website and the panel interface, the information obtained from the relevant platform when you sign in with Discord and Google, the data transmitted by the Nesoi Bridge software you install on your server, the transaction information transferred from our payment infrastructure Tebex, and cookies and similar technologies.

6. Recipients of Personal Data and Purpose of Transfer

In accordance with Articles 8 and 9 of the KVKK, your personal data may be transferred to the following parties, solely to the extent required by the relevant service:

• Hosting and database service provider (Supabase): for the purpose of storing account, server and log data.
• Payment and distribution infrastructure (Tebex): for the purposes of purchase, invoicing and licence verification.
• E-mail delivery provider (Resend): for the purpose of delivering verification, security and information e-mails.
• Authentication providers (Discord, Google): so that you can sign in securely using the method of your choice.
• Discord: for the purpose of delivering panel notifications to the channels defined by the server owner.
• IP location and currency services (ipinfo.io, ipapi.co): for the purpose of determining your approximate location in suspicious login alerts and estimating the site's currency preference.
• Analytics service provider (Google Analytics): for the purpose of measuring usage statistics for the marketing website.
• Authorised public bodies and institutions: in the event of a statutory request for information or documents, limited to the scope requested.
• TRANSFER ABROAD: Some of the providers listed above locate their servers abroad. Your personal data may therefore be transferred abroad within the scope of Article 9 of the KVKK, subject to appropriate safeguards or, where necessary, on the basis of your explicit consent.

7. Retention Periods

Your personal data is retained for the period necessary for the purpose for which it is processed and for the mandatory periods prescribed by legislation:

• Telemetry records: 14 days.
• Technical error logs and panel audit (administrator action) logs: 90 days.
• Diagnostic reports: deleted upon request.
• Online player snapshot: only the most recent state is retained; it is deleted when the server record is deleted.
• Account and profile data: for as long as your account remains open; if it is deleted, the data is deleted, without prejudice to mandatory statutory retention periods.
• Purchase and invoice records: for the period prescribed by tax legislation.

8. Rights of the Data Subject (Art. 11 KVKK)

By applying to the data controller, you may exercise the following rights:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties, in Türkiye or abroad, to whom the data is transferred.
• To request rectification where the data has been processed incompletely or inaccurately.
• To request erasure or destruction within the conditions set out in Article 7 of the KVKK.
• To request that rectification, erasure or destruction be notified to the third parties to whom the data has been transferred.
• To object to an outcome to your detriment that arises from the analysis of the data exclusively by automated systems.
• To claim compensation for damage suffered as a result of unlawful processing.

9. Application Procedure

You may submit your requests under Article 11 of the KVKK, in accordance with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller; • by sending an e-mail to [email protected] from the e-mail address registered in our system, • or in writing to the address stated above. Your application must clearly state your name and surname, your signature if the application is made in writing, your contact details and the subject of your request. Depending on its nature, your request will be concluded free of charge as soon as possible and in any event within thirty (30) days at the latest. Should the process entail an additional cost, the fee set out in the tariff determined by the Turkish Personal Data Protection Board may be charged. Should your application be rejected or should no reply be given within the applicable period, you reserve the right to lodge a complaint with the Turkish Personal Data Protection Board.