KVKK Disclosure Notice

1. Data controller

Data controller: ArcadeServers (HecekaSoft) — https://arcadeservers.com. Contact: [email protected]. The legal name, full address and tax/ID number will be added and this notice re-versioned once finalised; in the meantime you can send requests to the email address above.

2. Personal data processed

• Identity and contact: name (optional), email address, optional profile picture.
• Account security: one-way hash of your password, session records, last login date and IP address.
• Operational security: server create/start/stop records, access and system logs.
• Financial: wallet balance, top-up and spending history, order numbers. Card details are NEVER processed by us; they are collected on the payment provider's secure page.
• Consent records: date of acceptance for the terms, privacy policy and distance sales contract, the accepted document version and the IP address at the time.
• Requests/complaints: your support conversations and attachments.
• Marketing measurement (only if you accept cookies): site usage statistics and ad click identifier.

3. Purposes of processing

• Providing the service: server provisioning, operation, backup and technical support.
• Formation and performance of the contract: account creation, hourly billing, wallet transactions.
• Legal obligations: keeping invoicing and accounting records, responding to authorised requests.
• Security: detecting and preventing abuse, fraud and attacks.
• Proof: keeping consents (terms/privacy/distance sales) in a verifiable form.
• Optional: improving the service and measuring ad performance (only with your explicit consent).

4. Legal bases (KVKK art. 5)

• Necessary for the establishment or performance of a contract (art. 5/2-c): account, server and billing data.
• Compliance with a legal obligation (art. 5/2-ç): invoice, payment and consent records.
• Establishment, exercise or protection of a right (art. 5/2-e): consent records, security logs.
• Legitimate interest (art. 5/2-f): system security, prevention of abuse.
• Explicit consent (art. 5/1): analytics and advertising cookies only — you may refuse or withdraw later.

5. Method of collection

Your data is collected electronically, by automated or partly automated means, through the registration form, panel usage, support requests and the payment flow. Payment data is collected directly by the payment provider; we only receive the result (amount, order number, date).

6. Transfers and international transfer

Your data is shared, only as far as needed to run the service, with: hosting and network infrastructure providers (Germany/EU), site delivery and security infrastructure (global), email delivery infrastructure, the payment institution (Türkiye) and — if you gave explicit consent — analytics/ad measurement services. Data may also be disclosed to legally authorised public bodies upon request, to the extent required. International transfers are limited to what performance of the service requires and are covered by contractual safeguards.

7. Retention periods

• Account data: while the account is open; deleted or anonymised within 6 months of closure.
• Invoice, payment and accounting records: 10 years (tax legislation).
• Consent records: 10 years after account closure (burden of proof).
• Support conversations: 3 years after closure.
• Access and system logs: 12 months.
• Server world and files: indefinitely with File Protection, otherwise 14 days after sleep.

8. Your rights (KVKK art. 11)

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties to whom the data is transferred, domestically or abroad.
• Request correction if the data is incomplete or incorrect.
• Request erasure or destruction where the conditions are met.
• Request that correction/erasure be notified to the third parties the data was transferred to.
• Object to a result produced against you solely by automated analysis.
• Claim compensation if you suffer damage due to unlawful processing.

9. How to apply

To exercise your rights, send your request from the email address REGISTERED ON YOUR ACCOUNT (so we can verify your identity) to [email protected]. Your request is concluded free of charge within 30 days at the latest (a fee from the Board's tariff may apply if the action entails additional cost). If your request is rejected or unanswered, you retain the right to file a complaint with the Turkish Personal Data Protection Board.

10. Changes

When this notice is updated its version number and effective date change; for material changes you are informed via the panel or email.