Privacy Policy

In plain language (this box is a summary only and is not legally binding). We collect what we need to run a free game portal: your account details if you sign up, what you play and your scores, cloud saves for games that support them, and technical data from your browser. Ads pay for the service. Our ad partners (AppLovin and Google) use identifiers to show and measure ads; where the law requires it, personalised ads only happen if you say yes, and never for players we know are under 16. Game makers (Publishers) only ever see aggregated statistics about their games, never your personal data. We do not sell your personal data for money. You can see, download, correct and delete your data, and you can delete your account in your settings at any time. If you are in Türkiye, section 17 is our KVKK information notice.

1. Introduction and controller

1.1 This Privacy Policy explains how [BENERITS LEGAL ENTITY NAME], registered address [REGISTERED ADDRESS], trade registry / MERSIS number [TRADE REGISTRY / MERSIS NO.], tax office and tax number [TAX OFFICE / TAX NO.] ("Benerits", "we", "us"), processes personal data in connection with the Benerits game portal, its websites, game player, SDK, Studio (the developer console) and related services (the "Service").

1.2 Benerits is the controller (in Turkish law, the veri sorumlusu) of the personal data described in this Privacy Policy, except where section 3 states otherwise.

1.3 Contact and data protection officer. You can contact our data protection officer and KVKK contact point at [DPO / KVKK CONTACT: [email protected]], or by post at [REGISTERED ADDRESS], marked "Data Protection". Our representative in the European Union under Article 27 GDPR is [EU REPRESENTATIVE, if appointed]. Our representative in the United Kingdom under Article 27 UK GDPR is [UK REPRESENTATIVE, if appointed].

1.4 This Privacy Policy is designed to meet the transparency requirements of Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in UK law and the Data Protection Act 2018 ("UK GDPR"), Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other applicable data protection laws. Our use of cookies and similar technologies is explained in more detail in our Cookie Policy.

2. Definitions

2.1 Capitalised terms not defined here have the meaning given in the Player Terms of Service. In addition:

• "Advertising Partners" means the advertising networks and mediation platforms through which advertising is served on the Service, currently AppLovin Corporation and its affiliates ("AppLovin") and Google Ireland Limited / Google LLC ("Google").
• "Anonymous ID" means the random identifier stored in the lonca_anon cookie that allows the Service to recognise a browser without an Account.
• "CMP" means our consent management platform, through which we collect and record your choices about cookies, similar technologies and advertising.
• "Personal data" means any information relating to an identified or identifiable natural person, and includes "personal information" as defined in the CCPA.
• "Processor" means a service provider that processes personal data on our behalf and under our instructions (in Turkish law, veri işleyen).
• "Publisher" means a developer or studio that makes Games available on the Service; "Publisher Personnel" means the individuals who act for a Publisher (including sole traders).
• "Creator" means a participant in our creator and streamer programme.

3. Scope and roles

3.1 Players and visitors. Benerits is the controller of personal data relating to Players (including Guests) and visitors to our websites.

3.2 Publishers and Creators. Benerits is the controller of personal data relating to Publisher Personnel and Creators that we process to operate Studio, review Games, administer our agreements and make payments.

3.3 Publishers never receive Players' personal data. Publishers receive only aggregated and de-identified statistics about their Games (for example, numbers of plays, average play time, retention, ratings, advertising revenue per format and per day, and breakdowns by country or device type at a level that does not identify individuals). We do not give Publishers access to Players' email addresses, account identifiers, Anonymous IDs, IP addresses, Cloud Save contents linked to identifiable Players, or any other personal data. Publishers are contractually prohibited from placing their own advertising, trackers or third-party analytics in Games. The same applies to Creators, who receive only aggregated referral statistics.

3.4 Externally hosted Games. A small number of Games may be loaded from servers operated by the Publisher or its hosting provider rather than by us. When you play such a Game, your browser connects directly to those servers, which necessarily receive the technical data your browser transmits (such as your IP address, user agent and the time of the request). The Publisher is responsible, as an independent controller, for that limited processing, and is contractually required to use such data only to the extent strictly necessary to deliver the Game and to protect its servers. Games run in a sandboxed environment and cannot access our cookies or your Account.

3.5 Advertising Partners. Our Advertising Partners process personal data (such as advertising identifiers, IP addresses and device information) for their own purposes, such as delivering, personalising, measuring and protecting advertising, as independent controllers, subject to their own privacy policies and, where applicable, to your choices recorded through our CMP. Where an Advertising Partner acts as our processor or service provider for a specific function (for example, reporting), it does so under our instructions and a data processing agreement. See section 7.

3.6 Other websites. This Privacy Policy does not apply to third-party websites or services linked from the Service, which have their own privacy policies.

4. Personal data we process

4.1 Account data. If you create an Account: email address; username; display name; password (stored only as a salted hash using a memory-hard algorithm, never in readable form); language preference; date of account creation; email verification status; and, where we ask you to confirm your age or where parental consent is required, your age confirmation or year of birth and the record of parental consent. Optional profile information you choose to add: profile bio, website link and avatar (where available).

4.2 Gameplay data. The Games you open and play; the date, time and duration of play sessions (including periodic "heartbeat" signals while a Game is open); the Game version; the referring page; your likes, votes and favourites; recently played Games; your best scores and Leaderboard positions; achievements and other gameplay events reported by a Game through the SDK; and the country and device category derived from technical data. For Guests, this data is linked to the Anonymous ID; for Account holders, to the Account.

4.3 Cloud Saves. For Games approved for Cloud Save, the progress data that the Game stores through the SDK (typically keys and values such as level reached, settings or in-game inventory), together with the Game, the size of the data and the time of the last update. The content of a Cloud Save is determined by the Game. Guest Cloud Saves are linked to the Anonymous ID and are transferred to your Account if you sign in on the same browser.

4.4 Device and log data. IP address; browser type and version; operating system; device type (desktop, mobile, tablet); screen size; language settings; approximate location (country and region, derived from IP address; we do not collect precise geolocation); referring URL; pages and resources requested; date and time of requests; HTTP status and error codes; and session identifiers. Our servers record this data in logs automatically.

4.5 Cookies and identifiers. The session cookie (lonca_session), the Anonymous ID (lonca_anon), the language cookie (lonca_locale), CMP consent records, and, where you consent, analytics and advertising cookies and similar technologies. See the Cookie Policy for the full list.

4.6 Advertising data. When advertising is requested on the Service, data is sent to our Advertising Partners, including: IP address (which may be truncated for non-personalised requests); user agent and device information; the page and Game in which the advertisement appears; advertising identifiers and cookie IDs set by the Advertising Partner (and, in native app wrappers, mobile advertising identifiers such as IDFA or GAID, subject to operating system permissions such as Apple's App Tracking Transparency); your TCF consent string and other consent signals (including Global Privacy Control); and data about advertising impressions, clicks, Rewarded Ad completions and invalid-traffic signals. We also receive revenue and performance reports from Advertising Partners, generally in aggregated form.

4.7 Consent records. Your choices made through the CMP, the version of the consent notice shown, the date and time, and a pseudonymous identifier used to record them.

4.8 Acceptance records. When you accept the Player Terms of Service, the Publisher Distribution Agreement, a Game Distribution Addendum, the Creator Programme Terms or another agreement, we record the user, the document and version accepted, the date and time, the IP address and the browser user agent.

4.9 Communications. The content of messages you send us (including support requests, reports, notices, appeals and data protection requests), your contact details, and our responses. We also record whether transactional emails we send you were delivered.

4.10 User content and moderation data. Your public User Content (username, display name, bio, website link), reports you submit or that concern you, moderation decisions, statements of reasons, appeals and their outcomes.

4.11 Security and anti-fraud data. Signals used to detect cheating, invalid advertising traffic, account compromise and abuse, such as request rates, score submission patterns, inconsistencies between gameplay events, device and browser characteristics, IP reputation and the results of automated checks.

4.12 Publisher and Studio data. For Publisher Personnel: name, email address, username, role, legal name and form of the Publisher, business address, tax residence and tax identification numbers, tax forms (such as W-8BEN, W-8BEN-E or W-9 or equivalents), invoicing details (including e-arşiv or e-fatura information for Turkish Publishers), bank account, Wise or PayPal payout details, payment and statement history, identity and sanctions screening results where required, Game submissions and metadata, review events and messages exchanged with our review team (including reviewer notes), Game Distribution Addendum records, audit logs of actions taken in Studio, and support correspondence.

4.13 Creator data. For Creators: name, email address, channel names and links, audience and content information you provide, referral codes and links, aggregated referral statistics, disclosure compliance records, payout and tax information of the kind described in section 4.12.

4.14 Data we do not seek to collect. We do not ask for, and ask you not to provide, special categories of personal data (such as data about health, religion, ethnicity, political opinions or sexual life) or criminal record data. We do not collect payment card data from Players, as the Service offers no purchases. We do not collect precise geolocation.

5. Sources of personal data

5.1 We collect personal data: (a) directly from you, when you create an Account, fill in your profile, use Studio, contact us or submit a report or appeal; (b) automatically, from your browser or device when you use the Service, through our servers, the SDK and cookies and similar technologies; (c) from Games, through the SDK (scores, gameplay events and Cloud Saves); (d) from our Advertising Partners (performance, revenue and invalid-traffic reports); (e) from other users (for example, a report that concerns you); (f) from payment and identity verification providers (for Publishers and Creators); and (g) from public authorities and courts, where they send us orders or requests.

6. Purposes and legal bases

6.1 The table below sets out the purposes for which we process personal data and the legal bases on which we rely under the GDPR and UK GDPR and under Article 5 of the KVKK. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you can ask us for more information about this balancing test.

#	Purpose	Main data categories	Legal basis (GDPR / UK GDPR)	Legal basis (KVKK Art. 5)
a	Creating and administering Accounts, authenticating you and keeping you signed in	Account data, cookies, device data	Contract (Art. 6(1)(b))	Necessary for the establishment or performance of a contract (Art. 5(2)(c))
b	Providing guest play and remembering Guest activity	Anonymous ID, gameplay data, Cloud Saves	Legitimate interests in providing the Service without requiring registration (Art. 6(1)(f)); the cookie itself is strictly necessary	Performance of a contract (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f))
c	Delivering Games, the game player and the SDK; storing and syncing Cloud Saves	Gameplay data, Cloud Saves, device data	Contract (Art. 6(1)(b))	Performance of a contract (Art. 5(2)(c))
d	Displaying public profiles, scores and Leaderboards	Username, display name, bio, scores	Contract (Art. 6(1)(b))	Performance of a contract (Art. 5(2)(c))
e	Serving non-personalised and contextual advertising, frequency capping, ad measurement and ad-fraud prevention	Device and log data, advertising data, consent records	Legitimate interests in funding the free Service and preventing fraud (Art. 6(1)(f)); consent where storage of or access to information on your device requires it (ePrivacy Directive Art. 5(3) as implemented; PECR)	Legitimate interests (Art. 5(2)(f)); explicit consent for non-essential cookies (Art. 5(1))
f	Serving personalised advertising and allowing Advertising Partners to build or use advertising profiles	Advertising data, cookies and identifiers	Consent (Art. 6(1)(a))	Explicit consent (Art. 5(1))
g	First-party analytics to understand how the Service is used and to improve it	Gameplay data, device and log data, analytics cookies	Legitimate interests (Art. 6(1)(f)); consent for analytics cookies where required	Legitimate interests (Art. 5(2)(f)); explicit consent for analytics cookies (Art. 5(1))
h	Providing aggregated statistics to Publishers and Creators, calculating revenue shares and referral rewards	Gameplay data, advertising data (aggregated), referral attribution	Legitimate interests in operating the platform economy (Art. 6(1)(f)); contract, for Publishers and Creators (Art. 6(1)(b))	Legitimate interests (Art. 5(2)(f)); performance of a contract (Art. 5(2)(c))
i	Security, preventing and detecting cheating, invalid traffic, fraud and abuse, and protecting the integrity of Leaderboards	Security and anti-fraud data, device and log data, gameplay data	Legitimate interests (Art. 6(1)(f))	Legitimate interests (Art. 5(2)(f)); legal obligation where applicable (Art. 5(2)(ç))
j	Moderation, handling notices, statements of reasons, appeals and complaints	User content and moderation data, communications	Legal obligation under EU law, including Regulation (EU) 2022/2065 (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))	Legal obligation, including Law No. 5651 (Art. 5(2)(ç)); legitimate interests (Art. 5(2)(f))
k	Sending transactional and service messages (account verification, password reset, security alerts, changes to terms, moderation notices)	Account data, communications	Contract (Art. 6(1)(b)); legal obligation where notice is legally required (Art. 6(1)(c))	Performance of a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç))
l	Responding to support requests and data protection requests	Communications, account data	Contract (Art. 6(1)(b)); legal obligation for data protection requests (Art. 6(1)(c))	Performance of a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç))
m	Sending marketing messages (only if you opt in)	Email address, preferences	Consent (Art. 6(1)(a))	Explicit consent (Art. 5(1)) and approval under Law No. 6563
n	Reviewing Games, operating Studio, administering Publisher and Creator agreements, making payments	Publisher and Studio data, Creator data	Contract (Art. 6(1)(b)); legitimate interests in ensuring the quality and safety of Games (Art. 6(1)(f))	Performance of a contract (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f))
o	Tax, accounting, sanctions and record-keeping obligations	Publisher and Creator payout and tax data, acceptance records	Legal obligation where imposed by EU or Member State law (Art. 6(1)(c)); otherwise legitimate interests in complying with Turkish and other applicable law (Art. 6(1)(f))	Legal obligation, including the Tax Procedure Law No. 213 and the Turkish Commercial Code No. 6102 (Art. 5(2)(ç))
p	Retaining traffic data as a hosting provider under Turkish law	Device and log data	Legitimate interests in complying with Turkish Law No. 5651 (Art. 6(1)(f))	Legal obligation (Art. 5(2)(ç))
q	Recording acceptance of terms and consents; establishing, exercising or defending legal claims; responding to lawful requests from authorities	Acceptance records, consent records, relevant data	Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))	Establishment, exercise or protection of a right (Art. 5(2)(e)); legal obligation (Art. 5(2)(ç))
r	Business transfers (merger, acquisition, reorganisation)	Relevant data	Legitimate interests (Art. 6(1)(f))	Legitimate interests (Art. 5(2)(f))

6.2 Contractual necessity. Some data is necessary to provide the Service. If you do not provide your email address and a password, you cannot create an Account; if you block strictly necessary cookies, parts of the Service will not work.

6.3 Withdrawing consent. Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal, through the "Privacy choices" link in the footer of every page (for cookies and advertising) or by using the unsubscribe link in marketing emails.

7. Advertising, consent and your choices

7.1 How advertising works on the Service. The Service is free because it shows advertising. Advertising is requested only by Benerits' own advertising manager, never by Games directly, and is served through our Advertising Partners, currently AppLovin (including MAX mediation) and Google (including AdMob, Google Ad Manager and H5 Games Ads). We may add or replace Advertising Partners; we will update this Privacy Policy and our CMP vendor list when we do.

7.2 Consent management. In the EEA, the UK and Switzerland, and wherever else the law requires it, we ask for your consent before we or our Advertising Partners store or access information on your device for advertising purposes, or use your data for personalised advertising. Our CMP is certified by Google and implements the IAB Europe Transparency & Consent Framework ("TCF"), which lets you give or refuse consent (and object to processing based on legitimate interests) for each purpose and each vendor. We pass your choices to Advertising Partners through the TCF consent string and other industry signals. In Türkiye, we ask for your explicit consent before using non-essential cookies and before personalised advertising.

7.3 If you do not consent. If you refuse consent, or if we know or have reason to believe that you are under 16, we request only non-personalised or "limited" advertising. Non-personalised advertising is selected using contextual information (such as the Game being played and your approximate location) and may still involve the processing of limited data such as IP address and device information for purposes such as delivering the advertisement, frequency capping, aggregated measurement and fraud prevention. In limited-ads mode, Advertising Partners do not use cookies or identifiers to store or access information on your device where consent for this has not been given.

7.4 Age. We do not serve personalised advertising to Players who we know or have reason to believe are under 16. Where required, our consent dialog asks you to confirm that you are 16 or over before personalised advertising can be enabled, and Account holders who indicate that they are under 16 are treated as having refused personalised advertising. We also flag requests from such Players to Advertising Partners as child-directed or under the age of consent, where their systems support this.

7.5 Global Privacy Control and opt-outs. Where the CCPA or other US state laws apply, we treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the "sale" or "sharing" of your personal information and of targeted advertising for that browser, and we offer a "Your Privacy Choices / Do Not Sell or Share My Personal Information" link. See section 16.

7.6 Native wrappers. If we make Games available through a native iOS or Android application, the application will request any operating-system permission required for tracking (such as Apple's App Tracking Transparency prompt) before accessing a device advertising identifier for tracking purposes, and you can reset or limit that identifier in your device settings.

7.7 Advertising Partners' own policies. For more information about how AppLovin and Google process personal data, see AppLovin's privacy policy (https://www.applovin.com/privacy/) and Google's explanation of how it uses information from sites that use its services (https://policies.google.com/technologies/partner-sites). You can also manage Google's ad personalisation at https://adssettings.google.com.

8. Recipients of personal data

8.1 We share personal data only as described in this section.

8.2 Processors. We use Processors who process personal data on our behalf, under written contracts that meet the requirements of Article 28 GDPR, Article 12 KVKK and other applicable law, including:

Category	Provider	Location of processing	Function
Hosting and databases	[HOSTING PROVIDER]	[HOSTING LOCATION]	Servers, databases, backups
Object storage	[OBJECT STORAGE PROVIDER]	[HOSTING LOCATION]	Storage of Game builds, images and Cloud Saves
Transactional email	Resend, Inc.	United States	Sending account, security and service emails
Consent management	[CMP PROVIDER]	[CMP LOCATION]	Collecting and storing consent choices
Content delivery and network security	[CDN PROVIDER, if used]	[CDN LOCATION]	Delivering static content, protecting against attacks
Payment services (Publishers and Creators only)	Our banks, Wise and PayPal	Various	Making payouts

8.3 Advertising Partners (independent controllers, or processors where applicable): AppLovin and Google, and any other Advertising Partner listed in our CMP, as described in section 7.

8.4 Other users and the public. Your username, display name, profile bio, website link, avatar, scores and Leaderboard positions are public and visible to anyone using the Service.

8.5 Publishers and Creators receive aggregated statistics only (section 3.3). Publishers also receive the review messages we send them about their own Games.

8.6 Professional advisers and auditors (lawyers, accountants, auditors, insurers) under duties of confidentiality.

8.7 Authorities. Courts, law enforcement agencies, regulators (including the Information and Communication Technologies Authority (BTK), the Personal Data Protection Authority, data protection supervisory authorities and Digital Services Coordinators), tax authorities and other public bodies, where we are legally required to do so or where disclosure is necessary to protect the rights, property or safety of Benerits, our users or others. Where we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we inform the competent law enforcement or judicial authorities. We report child sexual abuse material to the competent authorities and organisations as described in the Content Policy.

8.8 Corporate transactions. A buyer, investor or successor (and their advisers) in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business, subject to confidentiality obligations and to this Privacy Policy.

8.9 Affiliates. Companies in the Benerits group that help us provide the Service, subject to this Privacy Policy.

8.10 We do not sell personal data for money. See section 16 for how the CCPA characterises advertising disclosures.

9. International transfers

9.1 Where we process data. We are established in Türkiye and our main hosting is located in [HOSTING LOCATION]. Some Processors and Advertising Partners are located in, or access data from, other countries, including the United States.

9.2 Transfers under the GDPR and UK GDPR. Where personal data subject to the GDPR or UK GDPR is transferred to a country that has not been recognised as providing an adequate level of protection, we ensure that appropriate safeguards are in place, namely: (a) the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 ("SCCs"), and, for UK data, the UK International Data Transfer Addendum or International Data Transfer Agreement; (b) for recipients in the United States certified under the EU-U.S. Data Privacy Framework (and its UK Extension), that framework; and (c) supplementary measures where needed following a transfer impact assessment (such as encryption in transit and at rest and access controls). You can obtain a copy of the relevant safeguards (with commercially sensitive information redacted) by contacting us at [DPO / KVKK CONTACT: [email protected]].

9.3 Transfers under the KVKK. Under Article 9 of the KVKK, as amended by Law No. 7499 with effect from 1 June 2024, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, we transfer personal data abroad: (a) where a condition in Article 5 or 6 of the KVKK exists and the recipient country, sector or international organisation is the subject of an adequacy decision by the Personal Data Protection Board; or (b) absent an adequacy decision, where appropriate safeguards are in place, primarily by executing the standard contracts announced by the Personal Data Protection Board, which we notify to the Personal Data Protection Authority within five business days of their signature; or (c) only where neither (a) nor (b) is possible and the transfer is incidental (arızi), on one of the grounds in Article 9(6) of the KVKK, including your explicit consent after being informed of the possible risks. The recipients to whom we transfer data abroad and the purposes of those transfers are described in sections 7, 8 and 17.

10. Retention

10.1 We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements, and then delete, destroy or anonymise it in accordance with our retention and destruction policy (prepared, where required, in accordance with the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data). Aggregated or anonymised data that no longer identifies anyone may be kept indefinitely.

Data	Retention period
Account data	For the life of the Account. After you delete your Account, deleted within 30 days, save for the data listed below that we must or may keep for longer
Public profile, scores, Leaderboard entries, likes, favourites	For the life of the Account; removed from public view without undue delay after Account deletion
Gameplay data linked to an Account	For the life of the Account, then deleted or irreversibly anonymised within 30 days
Gameplay data linked only to an Anonymous ID	13 months from the last activity of that Anonymous ID, then anonymised
Cloud Saves (Account)	For the life of the Account; if the Game is withdrawn, 12 months after withdrawal; deleted with the Account
Cloud Saves (Guest)	13 months from the last activity of the Anonymous ID
Session records (lonca_session)	30 days, or until you sign out
Password reset and sign-in or verification tokens	Until used or expired (password reset tokens expire after 1 hour), then deleted
Server and traffic logs	1 year, as required of hosting providers under Law No. 5651 and its implementing regulation, unless needed for longer for a specific investigation or legal claim
Security and anti-fraud signals	13 months, or longer where needed for a specific investigation or to enforce a ban
Identifiers needed to enforce a ban (stored in hashed form where possible)	For the duration of the ban
Moderation records, notices, statements of reasons, appeals	3 years from the final decision
Acceptance records for terms and agreements	For the life of the Account or agreement and 10 years thereafter (the general limitation period under Article 146 of the Turkish Code of Obligations)
Consent records	For as long as the consent is valid and 3 years thereafter; CMP cookies are renewed at the latest every 13 months
Marketing approvals (Law No. 6563)	For as long as the approval is valid and 3 years after withdrawal
Support and data protection correspondence	3 years from the closure of the request
Publisher and Creator account, review and Studio records	For the term of the relevant agreement and 10 years thereafter
Accounting, tax and payout records	10 years from the end of the relevant financial year (Turkish Commercial Code Art. 82; Tax Procedure Law Art. 253), or longer if required
Backups	Rolling backups are overwritten within 35 days

10.2 Where a legal hold, investigation, dispute or request from an authority requires us to keep data for longer, we keep it until the matter is resolved.

11. Security

11.1 We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, having regard to the state of the art, the costs of implementation and the risks involved, including: encryption in transit (TLS); password hashing with a memory-hard algorithm; serving Games from a separate, sandboxed origin that cannot access portal cookies; role-based access controls and least-privilege access for staff; logging and audit trails of administrative actions; separation of review previews from production data; regular backups; vulnerability management; and confidentiality obligations for staff and Processors.

11.2 No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority, generally within 72 hours of becoming aware of it (including the Personal Data Protection Board within 72 hours, in accordance with its decision on data breach notification), and we will notify you without undue delay where the breach is likely to result in a high risk to you.

12. Your rights

12.1 Rights under the GDPR and UK GDPR. Subject to the conditions and exceptions in the law, you have the right to: (a) access your personal data and receive a copy; (b) have inaccurate data rectified and incomplete data completed; (c) have your data erased; (d) restrict processing; (e) data portability, meaning to receive the data you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller; (f) object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and to object at any time to direct marketing; (g) withdraw consent at any time; (h) not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (see section 13); and (i) lodge a complaint with a supervisory authority. As we do not have a main establishment in the EU, you can lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement. In the UK, the supervisory authority is the Information Commissioner's Office.

12.2 Rights under the KVKK. Your rights under Article 11 of the KVKK are set out in section 17.6.

12.3 Rights under US state laws. See section 16.

12.4 Self-service tools. You can: (a) view and edit your profile and account details in your account settings; (b) delete your Account at any time in your account settings, which deletes your personal data in accordance with section 10; (c) change your cookie and advertising choices at any time through the "Privacy choices" link; and (d) unsubscribe from marketing emails using the link in each email.

12.5 How to exercise your rights. You can also exercise your rights by emailing [DPO / KVKK CONTACT: [email protected]] (for Account holders, preferably from the email address associated with your Account) or by post to [REGISTERED ADDRESS]. Applications under the KVKK may be made using the methods described in section 17.7.

12.6 Verification. To protect your data, we may need to verify your identity before responding, for example by asking you to confirm the request from your Account email address. For Guest data linked only to an Anonymous ID, we may ask you to submit the request from the browser that holds the Anonymous ID, as we have no other way of linking the data to you. We will not ask for more information than necessary.

12.7 Timing and cost. We respond without undue delay and in any event within one month under the GDPR and UK GDPR (which may be extended by two further months for complex or numerous requests, in which case we will tell you), and within 30 days under the KVKK. Requests are free of charge, except that we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, or, under the KVKK, charge the fee set by the Personal Data Protection Board where the response entails an additional cost.

13. Automated decision-making and profiling

13.1 Fraud, cheating and invalid-traffic detection. We use automated systems to analyse gameplay events, score submissions, advertising interactions and technical signals to detect patterns indicating cheating, bot activity, invalid advertising traffic, account compromise or other abuse. These systems assign risk indicators based on factors such as implausible scores or play speeds, inconsistencies between reported events, abnormal request rates, known malicious IP addresses and automation signatures.

13.2 Consequences. Based on these indicators, the systems may take temporary protective measures, such as withholding a score from a Leaderboard pending review, rate-limiting requests, or excluding traffic from advertising revenue calculations. Decisions that produce legal effects or similarly significantly affect you, such as suspending or banning an Account or withholding a Publisher's or Creator's revenue, are not taken solely by automated means: they are reviewed by a member of our team before they are taken, or, where an immediate protective measure is necessary, promptly after.

13.3 Your rights. You can ask for an explanation of a decision affecting you, express your point of view, contest the decision and obtain human review by writing to [CONTACT EMAIL: [email protected]] (for moderation decisions, using the appeal procedure in the Player Terms of Service) or [DPO / KVKK CONTACT: [email protected]]. Under Article 11(1)(g) of the KVKK, you may object to a result that is to your detriment arising from the analysis of your data exclusively through automated systems.

13.4 Advertising profiling. Where you consent to personalised advertising, Advertising Partners may build or use profiles about your interests to select advertising. This does not produce legal effects concerning you. You can withdraw your consent at any time.

13.5 Content moderation filters. We use automated filters to flag usernames, bios and other User Content that may breach the Content Policy. Flagged content may be held for review or temporarily hidden; final decisions on restrictions are subject to human review and appeal.

14. Children

14.1 The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13 or, without the required parental consent, from children below the digital age of consent in their country. Where parental consent is required, we make reasonable efforts to verify that consent is given or authorised by the holder of parental responsibility, taking into account available technology.

14.2 We do not serve personalised advertising to Players we know or have reason to believe are under 16 (section 7.4), and we do not knowingly "sell" or "share" (within the meaning of the CCPA) the personal information of consumers under 16.

14.3 If we learn that we have collected personal data from a child in breach of this section, we will delete it promptly. Parents and guardians can contact us at [DPO / KVKK CONTACT: [email protected]] to review, delete or stop the processing of their child's personal data.

15. Changes to this Privacy Policy

15.1 We may update this Privacy Policy to reflect changes in our processing, the Service or the law. We will publish the updated version with a new version number and effective date and, where the changes are material, notify Account holders by email and display a prominent notice on the Service before the changes take effect. Where a change requires your consent, we will ask for it.

16. Notice for California and other US state residents

16.1 Scope. This section applies to residents of California and supplements this Privacy Policy, to the extent the CCPA applies to us. It also describes rights available under other US state comprehensive privacy laws (such as those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) to the extent they apply.

16.2 Categories of personal information collected in the last 12 months, with the sources in section 5, the business and commercial purposes in section 6, and the retention criteria in section 10:

CCPA category	Examples	Disclosed for a business purpose to	"Shared" for cross-context behavioural advertising with
Identifiers	Email address, username, Account ID, Anonymous ID, IP address, cookie IDs, advertising identifiers	Processors / service providers; Advertising Partners acting as service providers	Advertising Partners, only if you have not opted out
Customer records (Cal. Civ. Code §1798.80(e))	Name, email address; for Publishers and Creators, bank and tax details	Service providers; payment providers	Not shared
Internet or other electronic network activity	Gameplay data, pages viewed, interactions with advertisements, log data	Service providers; Advertising Partners	Advertising Partners, only if you have not opted out
Geolocation data (approximate, not precise)	Country and region derived from IP address	Service providers; Advertising Partners	Advertising Partners, only if you have not opted out
Commercial information	For Publishers and Creators, revenue and payout history	Service providers; payment providers	Not shared
Professional or employment-related information	For Publishers and Creators, business role and company details	Service providers	Not shared
Inferences	Advertising interest segments inferred by Advertising Partners (only with consent or where you have not opted out)	Advertising Partners	Advertising Partners, only if you have not opted out
Sensitive personal information	Account login credentials (email address and password); for Publishers and Creators, tax identification numbers and financial account details	Service providers	Not shared

16.3 We do not sell personal information for money. We do not sell personal information in exchange for monetary consideration. However, allowing Advertising Partners to collect identifiers and online activity on the Service to deliver advertising personalised on the basis of your activity across other businesses' websites and applications may constitute "sharing" for cross-context behavioural advertising, and in some cases a "sale", under the CCPA and "targeted advertising" under other US state laws. You have the right to opt out of this.

16.4 How to opt out. You can opt out by: (a) clicking "Your Privacy Choices / Do Not Sell or Share My Personal Information" in the footer of every page; (b) enabling Global Privacy Control in your browser, which we honour as an opt-out for that browser (and for your Account, if you are signed in); or (c) emailing [DPO / KVKK CONTACT: [email protected]]. After you opt out, we request only non-personalised advertising for your browser and Account.

16.5 Minors. We do not have actual knowledge that we sell or share the personal information of consumers under 16, and we do not do so without the affirmative authorisation required by law.

16.6 Sensitive personal information. We use and disclose sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, §7027(m) (such as providing the Service, security and fraud prevention, and compliance with law), and not to infer characteristics about you. We therefore do not offer a right to limit its use.

16.7 Your rights. Subject to the exceptions in the law, you have the right to: (a) know what personal information we have collected about you, including the categories of personal information, sources, purposes, categories of third parties to whom we disclose it, and the specific pieces of personal information; (b) delete personal information we have collected from you; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information and of targeted advertising; and (e) not be discriminated against for exercising these rights. We do not offer financial incentives in exchange for personal information; rewarded advertisements are optional in-game features, not incentives for the collection of personal information.

16.8 Exercising your rights. You can submit a request by emailing [DPO / KVKK CONTACT: [email protected]] or using the self-service tools in section 12.4. We verify requests by matching information you provide with information we hold (for Account holders, by confirming the request from your Account email address). You may use an authorised agent, who must provide proof of authorisation; we may ask you to verify your identity directly. We respond within 45 days (extendable by a further 45 days where reasonably necessary, with notice to you).

16.9 Appeals. If you are a resident of a state whose law provides a right to appeal (such as Virginia, Colorado or Connecticut) and we decline to take action on your request, you may appeal by replying to our decision or emailing [DPO / KVKK CONTACT: [email protected]] with the subject line "Privacy appeal". We will respond within the period required by law. If you are not satisfied with the outcome, you may contact your state Attorney General.

16.10 Do Not Track. Apart from Global Privacy Control, there is no uniform standard for browser "Do Not Track" signals, and we do not respond to them.

17. KVKK Information Notice (Aydınlatma Metni)

17.1 Purpose. This section is provided to fulfil the obligation to inform under Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (the "Communiqué"). It applies to all data subjects whose personal data we process, including Players, Guests, visitors, Publisher Personnel and Creators. Where we ask for your explicit consent, we do so separately from this information notice.

17.2 Identity of the data controller. The data controller is [BENERITS LEGAL ENTITY NAME], registered address [REGISTERED ADDRESS], trade registry / MERSIS number [TRADE REGISTRY / MERSIS NO.], tax office and number [TAX OFFICE / TAX NO.], email [DPO / KVKK CONTACT: [email protected]]. Where required by law, we are registered with the Data Controllers' Registry Information System (VERBİS). We have not appointed a data controller representative, as we are established in Türkiye.

17.3 Purposes of processing. We process your personal data for the purposes set out in section 6.1, in summary: establishing and managing Accounts; providing guest play; delivering Games, Cloud Saves, profiles and Leaderboards; serving advertising (personalised only with your explicit consent); analytics and service improvement; providing aggregated statistics to Publishers and Creators and calculating revenue shares; ensuring information security and preventing cheating, invalid traffic, fraud and abuse; moderation and handling notices, complaints and appeals; sending transactional messages and, with your approval, marketing messages; handling support and data protection requests; reviewing Games and managing Publisher and Creator relationships and payments; fulfilling tax, accounting, record-keeping and hosting provider obligations; establishing, exercising and protecting our rights; and responding to requests from competent authorities.

17.4 Recipients and purposes of transfer. Your personal data may be transferred, for the purposes stated in section 17.3 and within the limits of Articles 8 and 9 of the KVKK, to: (a) our Processors providing hosting, database, object storage, email delivery (Resend, Inc., United States), consent management and network security services, for the purpose of operating the Service; (b) our Advertising Partners AppLovin (United States) and Google (Ireland and United States), for the purposes of delivering, measuring and protecting advertising and, only with your explicit consent, personalised advertising; (c) banks and payment providers (for Publishers and Creators), for the purpose of making payments; (d) professional advisers and auditors, for the purpose of obtaining advice and audit services; (e) authorised public institutions and organisations and courts, for the purpose of complying with legal obligations and requests; (f) our affiliates and, in the event of a corporate transaction, potential acquirers or successors, for the purpose of carrying out the transaction; and (g) other users and the public, for the limited profile and Leaderboard information you make public. Publishers and Creators receive only aggregated statistics and never your personal data. Transfers abroad are carried out in accordance with Article 9 of the KVKK as described in section 9.3, primarily on the basis of standard contracts notified to the Personal Data Protection Authority within five business days of signature.

17.5 Method of collection and legal grounds. Your personal data is collected through electronic means: through the forms you complete on the Service and in Studio; automatically through our servers, the SDK, cookies and similar technologies when you use the Service; through Games via the SDK; from our Advertising Partners and payment providers; and through your communications with us by email or post. It is processed on the legal grounds in Article 5 of the KVKK set out in the "KVKK" column of the table in section 6.1, namely: explicit consent (Art. 5(1)) for personalised advertising, non-essential cookies, marketing messages and, where applicable, incidental transfers abroad; processing necessary for the establishment or performance of a contract (Art. 5(2)(c)); compliance with a legal obligation (Art. 5(2)(ç)); establishment, exercise or protection of a right (Art. 5(2)(e)); and our legitimate interests, provided that they do not harm your fundamental rights and freedoms (Art. 5(2)(f)).

17.6 Your rights under Article 11 of the KVKK. You have the right to: (a) learn whether your personal data is processed; (b) request information about the processing if it has been processed; (c) learn the purpose of processing and whether the data is used in accordance with that purpose; (d) know the third parties to whom your personal data is transferred, in Türkiye or abroad; (e) request the rectification of incomplete or inaccurate data; (f) request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK; (g) request that the operations under (e) and (f) be notified to third parties to whom your personal data has been transferred; (h) object to a result that is to your detriment arising from the analysis of your data exclusively through automated systems; and (i) claim compensation for damage suffered as a result of unlawful processing of your personal data.

17.7 Method of application to the data controller. In accordance with Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in Turkish: (a) in writing, by a signed letter sent or delivered by hand to [REGISTERED ADDRESS]; (b) by registered electronic mail (KEP) to [KEP ADDRESS]; (c) by an email bearing a secure electronic signature or mobile signature, sent to [DPO / KVKK CONTACT: [email protected]]; or (d) by email to [DPO / KVKK CONTACT: [email protected]] from the email address you previously notified to us and that is registered in our systems (for Account holders, the email address associated with your Account). Your application must include: your name and surname and, if written, signature; for Turkish citizens, your Turkish identity number, and for foreign nationals, your nationality and passport number or identity number (if any); your residence or workplace address for notifications; your email address, telephone number and fax number (if any) for notifications; and the subject of your request. Any relevant information and documents should be attached. We will respond free of charge as soon as possible and at the latest within 30 days of receipt, depending on the nature of the request; if the response entails an additional cost, we may charge the fee in the tariff determined by the Personal Data Protection Board. If your application is rejected, our response is found insufficient or we do not respond in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of our response, and in any event within 60 days of your application, in accordance with Article 14 of the KVKK.

18. Contact

18.1 Data protection officer / KVKK contact: [DPO / KVKK CONTACT: [email protected]] General legal enquiries: [CONTACT EMAIL: [email protected]] Post: [BENERITS LEGAL ENTITY NAME], [REGISTERED ADDRESS] EU representative: [EU REPRESENTATIVE, if appointed] UK representative: [UK REPRESENTATIVE, if appointed]

19. Language

19.1 This Privacy Policy is available in English and Turkish, and the two versions are intended to be substantively identical. In case of conflict: for Turkish consumers and data subjects in Türkiye, the Turkish version prevails; for Publishers and Creators, the English version prevails; in all other cases, the English version prevails, except where applicable law requires otherwise.