PadelDrawKVKK Information Notice
English translation of the PadelDraw notice under Turkish data protection law (KVKK): purposes, legal bases, recipients, retention and how to exercise your rights.
Effective date: 18 October 2026
This is an English translation of the information notice (Aydınlatma Metni) we provide under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It covers personal data processed through the PadelDraw website, live tournament pages, TV screen and iOS/Android apps (the "Service"). It is for information only and does not ask for your consent. If this translation and the Turkish version differ, the Turkish version prevails.
For a general overview and information for users in the EU, see our Privacy Policy; for cookies and data stored on your device, see our Cookie Policy.
1. Data controller
| Name | Noesis Social - Burak OHRİLİ (sole proprietorship) |
| Address | Gazi Osmanpaşa Mah. 5499/1 Sok. No:9 Bornova / İzmir, Türkiye |
| Tax office / Tax ID | Ege Tax Office / 6360302767 |
| Phone | +90 532 744 94 34 |
| padeldrawapp@gmail.com | |
| Electronic applications | Contact form, topic: Privacy |
PadelDraw is the data controller for operating the Service. When a person running a tournament or club (the organiser) enters player names into the Service, they use that information for their own event; informing their players and, where required, obtaining their consent is the organiser's responsibility.
2. Categories of personal data
| Category | Data |
|---|---|
| Identity | Display name; for guest players, the name entered for the tournament |
| Contact | Email address (with Sign in with Apple, possibly a relay address provided by Apple); name and email you give in the contact form; email address of a person invited as club staff |
| Customer transaction | Account ID; Apple or Google user identifier; language preference; tournament, club, league and event records; pairings, scores, standings, podium records, league ratings; optional level, gender in mixed formats and city; contact messages and content reports |
| Visual records | Optional profile photo |
| Transaction security | Score-change history and audit records of critical actions; guest device key; hashed referee PIN; Expo push token and platform; daily-changing hash of the IP address in the contact form; IP address, date/time and browser/app information in hosting providers' server logs |
No location, contacts, audio, health, payment or advertising-ID data is collected, and the Service uses no analytics, advertising or error-tracking tools. We do not intend to process special categories of personal data (KVKK Art. 6); please do not enter such information in name or note fields. The camera is used only to scan QR codes; images are not saved.
3. Purposes and legal bases
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating an account, signing in with Apple/Google or an email code, keeping you signed in, profile | Identity, contact, customer transaction, visual records | Establishment or performance of a contract (Art. 5/2-c) |
| Creating tournaments, adding players, draws, score entry, standings, live page and TV screen, club and league features | Identity, customer transaction | Establishment or performance of a contract (Art. 5/2-c) |
| Letting guest players join without an account and recognising them on the same device | Identity, customer transaction, transaction security | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Sending sign-in code emails | Contact | Performance of a contract (Art. 5/2-c) |
| Push notifications (with your device permission; can be turned off at any time) | Transaction security (push token), customer transaction | Performance of a contract (Art. 5/2-c) |
| Score history and audit records, handling content reports, preventing abuse, information security | Transaction security, identity, customer transaction | Legitimate interest (Art. 5/2-f); establishment, exercise or protection of a right (Art. 5/2-e) |
| Keeping past results intact for other players as "Deleted player" after account deletion | Customer transaction | Legitimate interest (Art. 5/2-f) |
| Answering contact requests and KVKK applications | Identity, contact, customer transaction | Legal obligation (Art. 5/2-ç); performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Legal obligations and requests from competent authorities | Relevant categories | Legal obligation (Art. 5/2-ç) |
No processing is based on explicit consent. No commercial electronic messages are sent for marketing; if they are in future, your separate consent will be obtained.
4. Recipients
Your personal data is shared, limited to the purposes above, with:
- Supabase Inc.: database, authentication, file storage and server functions (servers in Frankfurt, Germany).
- Vercel Inc.: hosting the website, live pages and share images (US-based; global network).
- Resend (Plus Five Five, Inc.): sign-in code emails and forwarding contact-form messages to the operator (servers in Ireland).
- Expo (650 Industries, Inc.): delivering push notifications and distributing app updates (US).
- Apple Inc. and Google LLC: authentication for Sign in with Apple and Google Sign-In; delivering notifications to devices (APNs, FCM).
- Tournament participants and anyone with the link: your name and results appear on the live tournament page and TV screen; your display name, profile photo and level are visible to other users on podium, league and club pages.
- Organisers and club admins: player details of their own tournaments and content reports about them.
- Competent public authorities and courts: where legally authorised and requested.
Your personal data is not sold or shared for advertising.
5. Transfers abroad
Because the servers of the providers above are outside Türkiye (Germany, Ireland and, for Vercel, Expo, Apple and Google, including the US), these are transfers abroad under KVKK Art. 9.
As there is no adequacy decision of the Personal Data Protection Board for the destination countries, these regular transfers are made under KVKK Art. 9/4 on the basis of the standard contracts published by the Board. Signed standard contracts are notified to the Personal Data Protection Authority within five business days of signature. Your explicit consent is not relied on for regular transfers; the exceptions in Art. 9/6 can apply only to occasional transfers.
6. How we collect personal data
Your personal data is collected electronically, by fully or partly automated means:
- when you create an account, sign in, edit your profile and use the Service;
- from Apple or Google when you sign in with them;
- when you join a tournament via QR code, link or join code, or when an organiser adds you as a player;
- when scores are entered by the organiser, a referee or players;
- when you fill in the contact form or report content;
- through cookies, browser storage, device storage and server logs.
7. Retention periods
| Data | Period |
|---|---|
| Account and profile details, profile photo, podium records, league ratings, club memberships | While the account is open; deleted immediately when it is deleted |
| Tournament records (name, pairings, scores, standings) | 5 years from the tournament date; player names are then anonymised. If the account is deleted, the name becomes "Deleted player" immediately |
| Notification registrations of signed-in devices | Until the account is deleted, notifications are turned off or the token becomes invalid |
| Notification registrations of guest devices | Up to 12 months after last use |
| Club staff invitations | 1 year from creation |
| Contact-form messages | 2 years |
| Content reports | 2 years |
| Audit records | 2 years |
| Providers' server and email delivery logs | At most 30 days |
| Backups | Deleted data is removed from backups within 30 days |
If there is a dispute, an official request or a legal obligation, the relevant records may be kept until it is resolved and the limitation period has expired. Data whose period has ended is deleted, destroyed or anonymised.
You can delete your account in the app under Profile → Delete my account, or on the web under Account → Delete account. When the account is deleted, the account, profile, podium records, notification registrations, pending club invitations sent to your email address and contact messages sent from that address are deleted. Your name in tournament entries is replaced with "Deleted player", level and gender are cleared and the link to the account is removed; matches and scores stay for other players. Content reports you made are kept without a link to your account, and audit records only with your pseudonymous former account ID, for the periods above. Details are on the account deletion page.
8. Your rights under KVKK Art. 11
By applying to the data controller, you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request correction of incomplete or inaccurate data;
- request deletion or destruction under the conditions of KVKK Art. 7;
- request that third parties to whom data was transferred be notified of correction, deletion or destruction;
- object to a result against you arising from analysis exclusively by automated systems;
- claim compensation if you suffer damage due to unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your application in Turkish by one of these methods:
- In writing: a letter with your wet signature, delivered by hand, by registered post with return receipt or through a notary to Gazi Osmanpaşa Mah. 5499/1 Sok. No:9 Bornova / İzmir, Türkiye. Please write "Information request under the Personal Data Protection Law" on the envelope.
- Electronically: through the contact form we provide for applications, choosing the Privacy topic. Using the email address registered with the Service makes it easier for us to verify your identity; our reply is sent to that address.
- By email: from the email address you have previously notified to us and that is registered with the Service, to padeldrawapp@gmail.com; our reply is sent to that address.
Your application must include your name, surname and, for written applications, your signature; your Turkish ID number if you are a Turkish citizen, or your nationality and passport number (or ID number, if any) if you are not; your residential or business address for notifications; your email address, phone and fax number if any; and the subject of your request. We may ask for additional information to verify your identity.
Your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient or we do not respond in time, you may file a complaint with the Personal Data Protection Board under KVKK Art. 14 within 30 days of learning of the response and in any case within 60 days of your application.
10. Changes
We update this notice when our processing changes. When paid plans start, the related processing will be added to this notice. The current version and its effective date are always on this page.
Last updated: