Privacy Notice — Vision Games

01

Who are we

Under this User Privacy Notice ("Privacy Notice"), we, VISION GAMES OYUN YAZILIM ANONİM ŞİRKETİ ("Vision Games", "Company", "we"), located at İzzet Paşa Mah. Yeni Yol Cad. Nurol Tower No: 3 İç Kapı No: 254 Şişli / İstanbul, inform you, in our capacity as the data controller, about how we process your personal data within the scope of the services we provide worldwide.

This Privacy Notice explains how we collect, use, retain, and otherwise process your personal data when you play mobile games developed by Vision Games, contact our customer service or technical support teams, use any of the other services we provide, or interact with us in connection with our marketing activities.

02

Which personal data do we collect

Depending on your interaction with us and your device, the personal data we collect and process are specified in the table below:

Data Categories	Processed Personal Data
Identity Data	Name, Surname Username
Contact Data	Email Address Phone Number
Transaction Security Data	IP Address Device Information (Device Model, Device Brand, Operating System Information, Language Preference, MAC Address, Country Information, Device ID Number, Network and Tracker Information) Universal ID Region Information (City) Game Download Platform Information (Apple Store/Google Play) User ID Social Media Token Information In-Game Usage Information (Clicks, Duration, In-Game Instructions, Time of Use, In-Game Preferences, Users Interacted With, and In-Game Usage Habits) Browser Information IDFA, IDFV and AAID
Customer Transaction Data	User Correspondence, Comments, Posts, and Team Name Used Information Regarding In-Game Usage (Clicks, Duration, In-Game Instructions, Time of Use, In-Game Preferences, Users Interacted With and In-Game Usage Habits) Request and Complaint Information App Store Confirmation Information Regarding In-Game Purchases (Without Including Payment Information)
Marketing Data	User ID IP Address Device Information (Device Model, Device Brand, MAC Address, Country Information, Device ID Number, Network and Tracker Information, Operating System Information) Region Information (City) Information Regarding In-Game Usage (Clicks, Duration, In-Game Instructions, Time of Use, In-Game Preferences, Users Interacted With, and In-Game Usage Habits) Gender and Age Group Social Media Token Information Information Regarding Clicked Advertisements Advertising Campaign Information IDFA, IDFV and AAID
Location Data	Location Information

Our services are intended for a general audience and are not directed to children under the age of 13 or below the applicable minimum age under local laws and regulations. We do not knowingly or intentionally collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take the necessary steps to erase such data.

03

Purposes and Legal Bases for the Processing of Personal Data

Data Categories	Processing Purposes	Legal Bases
Transaction Security Data	Ensuring the Security of the Data Controller's Operations, Making Notifications to Authorized Persons, Institutions and Organizations, Preventing Fraud and Illegal Activities, and Managing Compliance Processes with Applicable Legislation	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing is necessary for the data controller to comply with its legal obligations.
	Providing Products to Users, Creating User Accounts, and Providing Users with In-Game Access	Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
	Storing Users' Consent/Preference Information, Managing Legal Disputes, and Ensuring the Security of Our Players	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing is necessary for the data controller to comply with its legal obligations.
Identity Data Transaction Security Data Customer Transaction Data	Ensuring the Security of the Data Controller's Operations, Preventing Illegal Activities, and Managing Legal Disputes	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing is necessary for the establishment, exercise, or protection of a right.
	Providing Products to Users, Enabling In-Game Interaction for Users, Ensuring User Satisfaction, and Managing Player Communications	Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract; Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject.
Identity Data Contact Data Transaction Security Data	Ensuring the Security of the Data Controller's Operations, Making Notifications to Authorized Persons, Institutions and Organizations, Preventing Fraud and Illegal Activities, and Managing Compliance Processes with Applicable Legislation	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing is necessary for the data controller to comply with its legal obligations.
Identity Data Contact Data Transaction Security Data	Providing Products to Users, Creating User Accounts, and Enabling User Logins	Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
Transaction Security Data Customer Transaction Data Marketing Data Location Data	Optimizing Advertising and Game Activities, and Displaying In-App Advertisements to Users Determining Company Strategies, and Managing Payment and Budgeting Processes Related to Business Partner Advertising Companies (Calculation of Fees Based on the Number of Clicks)	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject.
	Conducting Analyses Relating to Advertisements Displayed to Users	Explicit consent.
Transaction Security Data Marketing Data Location Data	Conducting User Analytics and Insight Generation Activities, and Optimizing and Improving Vision Games' Services, Products, and Player Experience	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
Transaction Security Data Marketing Data Location Data	Personalizing Services for Users, Conducting Profiling, Marketing, Research, Analytics, and Contextual and Behavioural Advertising Activities	Explicit consent.
Customer Transaction Data	Verifying Users' In-App Purchases Through the Relevant App Store	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
Identity Data Contact Data Transaction Security Data Customer Transaction Data	Evaluating Users' Refund or Other Requests and Complaints Generating Diagnostic and Error Reports, and Providing Technical Support to Users	Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
Identity Data Contact Data Transaction Security Data Customer Transaction Data Marketing Data Location Data	Complying with Legal Obligations and Responding to Legal Requests (e.g., court orders and subpoenas)	Processing is necessary for the data controller to comply with its legal obligations; Processing is necessary for the establishment, exercise, or protection of a right.

Where we process your personal data based on your explicit consent, you may withdraw your explicit consent at any time. The withdrawal of your explicit consent shall not affect the lawfulness of any processing activities carried out prior to such withdrawal.

04

Who do we share your personal data with

We may share your personal data with the following recipient groups for the specified purposes:

Third-party infrastructure providers located in the United States of America, which provide cloud and information technology infrastructure services for the purposes of ensuring information security processes, data storage, and software development services.
Relevant third parties located in the United States of America, with which users have accounts, for the purpose of enabling users to log in to games through third-party applications.
Third-party application stores (e.g., Google Play, App Store), for the purpose of obtaining confirmations regarding the completion of payment transactions and providing related services.
Third-party outsourced service providers located in the United States of America, which provide various services, including cookies and SDKs, for purposes such as delivering interest-based advertising, tracking preferences, and measuring the effectiveness of advertisements.
Public authorities, including law enforcement authorities, public institutions and organizations, courts, and other public authorities, where necessary to comply with a legal obligation or respond to lawful requests.
Persons who are parties to any existing or contemplated corporate transaction affecting all or part of our Company, including merger, acquisition, share or asset sale, financing, consolidation, restructuring, dissolution, liquidation, or bankruptcy processes.

Where we transfer your personal data, we implement appropriate safeguards in compliance with applicable laws, such as standard contractual clauses or other recognized legal mechanisms. These safeguards ensure that your personal data is protected at an adequate level.

Please note that servers may be located in multiple regions and may change due to infrastructure updates or replications carried out by our service providers. For more information or to obtain a copy of the safeguard measures implemented for any data transfer, please contact us using the contact details provided in this Privacy Notice.

05

How do we collect your personal data

The types of personal data we may collect may vary depending on the service/product you receive or the nature of our relationship with you. Below, you can find the types of personal data we collect and the methods by which we collect such data.

We may collect your personal data through automated means when you download our games to your device or play them on your device, or when you directly submit your feedback, information, or support requests to info@vision.gs. We may also obtain your personal data through automated means from third-party platforms (such as Facebook, Google Play, App Store, etc.) and from our business partners or other third-party companies that have obtained your explicit consent to share such personal data with us or have another legal basis for such sharing.

Personal data collected directly from you

We collect your personal data directly from you when you register and create your player account, when you contact us regarding your refund or support requests, and when you use our products and services. In this context, Vision Games collects your name, surname, email address, phone number, IP address, device information, universal ID, region information (city), user ID, information regarding in-game usage, browser information, information regarding clicked advertisements, advertising campaign information, IDFA, IDFV, AAID, user correspondence, comments, posts, team name used, and request and complaint information.

Personal data collected from third parties

Vision Games may also collect your personal data indirectly from the following sources:

From our business partners (e.g., App Store and Google Play), when you download Vision Games's mobile applications and make in-game purchases through the relevant business partner's application, which are subject to the relevant business partner's terms of service and privacy notice. In this context, Vision Games may collect payment tokens or information regarding the platform through which the game was downloaded.
From third-party social media networks (e.g., Facebook), when you link your account to a third-party social media network or interact with our games through such third-party social media network in a manner subject to that third-party social media network's terms of service and privacy notice. In this context, Vision Games may collect social media token information.

06

How long do we retain your personal data

We will not retain your personal data for longer than is necessary for the purposes for which we collected it and for compliance with our legal obligations. When determining the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of your personal data, the potential risk of harm resulting from the unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, any ongoing legal disputes, and any applicable contractual obligations or legal requirements. We do not retain personal data beyond the periods prescribed by law.

07

Your rights

Under the Turkish Personal Data Protection Law No. 6698 ("TR DPL"), you have the following rights in relation to your personal data. As the legal basis upon which we process your personal data may affect your data protection rights, these rights are briefly described below.

Right of access — You have the right to request copies of your personal data from us. You may also request other information, such as details regarding where we obtained your personal data and with whom we have shared it.
Right to rectification — You have the right to request the correction or deletion of personal data that you believe is inaccurate, incorrect, or incomplete.
Right to erasure — You have the right to request the erasure of your personal data.
Right to object — You have the right to object to the processing of your personal data.
Right to restriction of processing — You have the right to request that we restrict how we use your personal data.
Right to data portability — You have the right to request that the personal data you have provided to us be transferred to another organization or to you.
Right to withdraw explicit consent — Where we process your personal data based on your explicit consent, you have the right to withdraw your explicit consent at any time.
Right not to be subject to a decision based solely on automated processing — You have the right not to be subject to a decision based solely on automated processing that produces adverse legal effects concerning you or significantly affects you.
Right to lodge a complaint — You have the right to lodge a complaint with your local data protection authority.

These rights apply regardless of age; however, where applicable, the processing of children's data is subject to parental consent requirements.

08

Additional Rights for Users Located Outside of Türkiye

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the processing of your personal data is additionally subject to the EU General Data Protection Regulation (GDPR) or equivalent applicable legislation. In this case, the legal bases set out in this Privacy Notice (performance of a contract, legitimate interests, legal obligation, and explicit consent) apply as defined under the GDPR. You also have the right to lodge a complaint with the competent supervisory authority in your country of residence.

If you are located in California or another US state with applicable privacy legislation (including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, "CCPA/CPRA"), you may have additional rights under such legislation, including the right to know, the right to delete, the right to opt-out of the sale or sharing of personal data, and the right to non-discrimination. Please note that we do not sell your personal data. To exercise these rights, please use the contact details provided above.

If you are located in another jurisdiction with applicable data protection legislation, we will endeavor to comply with such legislation to the extent applicable and practicable.

09

How can you exercise your rights and contact us

If you have any questions, requests, or complaints regarding the processing of your personal data, or if you wish to exercise any of the rights described above, please contact us through the following contact channels:

(i) by sending a written request to "İzzet Paşa Mah. Yeni Yol Cad. Nurol Tower No: 3 İç Kapı No: 254 Şişli / İstanbul", or

(ii) by sending an email from the email address that you have previously provided to us and that is registered in our systems to info@vision.gs.

Please specify which of your rights you wish to exercise. Please note that we may need to verify your identity before responding to your request.

If you believe that data protection laws have not been complied with in the processing of your personal data, you may lodge a complaint with your local data protection authority.