WinwayStatsKVKK Information Notice
1. Data Controller
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Winway Veri Analizi ve Yazılım Danışmanlık Hizmetleri Limited Şirketi ("WinwayStats") as data controller within the scope described below.
Trade name: Winway Veri Analizi ve Yazılım Danışmanlık Hizmetleri Limited Şirketi
Address: Kınıklı Mah. 6021 Sok. No:59/7 Pamukkale / Denizli, Türkiye
Tax office and number: Pamukkale Tax Office, 8131516608
MERSİS number: 0813151660800001
Registered e-mail (KEP): winway@hs01.kep.tr
E-mail: info@winway.com.tr
2. Personal Data Processed, Purposes and Legal Grounds
• First and last name: Identifying the account holder and verifying identity in support requests and for rewards that may be offered in the future. Legal ground: Establishment and performance of a contract (KVKK Art. 5/2-c).
• E-mail address: Account creation and sign-in, sending verification and password reset codes, mandatory service information. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Username: Creating the name shown in the Application (profile, ranking). Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Password: Secure sign-in; stored in irreversible form. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Phone number: Account security and communication; in the future, phone sign-in and SMS verification. Legal ground: Establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f).
• Date of birth: Checking the Application's 18+ age limit. Legal ground: Establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f).
• Country and city (optional): Region-appropriate content and anonymous user statistics; country also determines which support organisation is shown. Legal ground: Legitimate interest (Art. 5/2-f).
• Favourite team: Personalising the home page and notifications for your team. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Favourite and pinned countries, leagues and matches: Highlighting them in the Bulletin and showing their results; not shown to other users. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Match poll votes ("Who Will Win?"): Showing the overall distribution of users' choices; other users see only overall percentages; deleted when the account is deleted. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Followed users: Showing coupons of followed users on the Predictions page; not shown to other users. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Notification preferences and notification address (the phone's notification address, app language, match / user / Pisagol notifications turned on, points threshold preferences, a log of sent notifications): Sending the notifications the user has turned on to their phone. Notifications are off by default and contain no advertising; the notification address is deleted on sign-out and the log of sent notifications after 7 days. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Subscription information (package, start and end dates, whether the trial has been used; device information to prevent trial abuse): Providing Winway Plus packages, calculating the trial period, determining the loyalty badge. Card details are not collected. Legal ground: Establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f).
• Coupon and prediction history: Providing the service; keeping a prediction history that cannot be deleted; calculating performance indicators and rankings; statistically analysing coupon data to measure and improve the Application's effect. Analysis results are shared with third parties only in anonymous and aggregated form. Legal ground: Establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f).
• Virtual coin transactions: Allocating and tracking the monthly virtual budget, preventing cheating and manipulation. Coins have no real-money value. Legal ground: Establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f).
• Behaviour summaries (calculated from coupon and coin history: share of balance used per coupon, time between coupons, winning/losing streaks and changes after them, day and hour distribution, change compared with the first 14 days): Letting users see their own decision behaviour. No additional data is collected; shown only to the user, contains no diagnosis or label and is not used for any decision with legal effect on the user. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Points history and ranking information: Determining monthly rankings and tracking points. Legal ground: Establishment and performance of a contract (Art. 5/2-c).
• Consent records (agreement acceptance and 18+ declaration, with date and time): Proof that consent was given. Legal ground: Establishment, exercise or protection of a right (Art. 5/2-e).
• Technical data (IP address, device and session information, sign-in logs): Account and system security, cheat detection, record-keeping obligations under the law. Legal ground: Legal obligation (Art. 5/2-ç), legitimate interest (Art. 5/2-f).
• App error logs (type of error and where it occurred in the code, app version, device model and operating system): Finding and fixing errors; not linked to the account. Legal ground: Legitimate interest (Art. 5/2-f).
• Usage statistics (screens opened and time spent on them, app opening and closing, device model, operating system, app version, language, approximate country and city derived from the IP address, account ID): Improving the app. Name, e-mail, phone and coupon content are not sent. Legal ground: Legitimate interest (Art. 5/2-f).
• Bot verification (IP address and browser / device signals): Preventing mass fake accounts and automated attacks; verification is performed by Cloudflare, WinwayStats does not store it. Legal ground: Legitimate interest (Art. 5/2-f).
3. Method of Collection
Your personal data is collected electronically and by automated means through the registration and profile forms in the Application, your use of the Application (coupon, coin, points and notification actions) and technical records created while the Application runs.
In the web version, session information and preferences are kept in the browser's local storage. No advertising or tracking cookies are used.
4. Information Visible to Other Users
In line with the Application's transparency principle, your username, points and points progress, ranking, coupon and prediction history (including coins staked and potential winnings), performance statistics, virtual coin balance and budget use, and loyalty badge can be seen by other users.
Your first and last name, e-mail, phone number, date of birth, city, behaviour summaries, package type and payment information are not shown to other users.
5. Recipients and Purposes of Transfer
Your personal data is transferred to the following recipients in accordance with Articles 8 and 9 of the KVKK, limited to the stated purpose:
• Supabase Inc.: data hosting, database and sign-in service
• Resend (e-mail delivery service): sending verification, password reset and information e-mails
• PostHog Inc.: app error logs and usage statistics
• Cloudflare Inc.: bot verification during sign-up, sign-in and password actions (Turnstile)
• Expo (650 Industries Inc.) and Google LLC (Firebase Cloud Messaging), on iPhone Apple Inc. (Apple Push Notification service): delivering the notifications the user has turned on to their phone (notification address and notification text)
• App stores and the payment institution (once package sales start): verifying purchases
• Authorised public authorities and courts: where required by law and upon request
6. Transfers Abroad
Your data is stored on servers in Frankfurt, Germany, through Supabase Inc. Error logs and usage statistics are kept on PostHog's servers in Germany; e-mails are sent through Resend via servers in Ireland; bot verification runs on Cloudflare's global network.
Notifications are delivered through Expo and Google (on iPhone, Apple) servers abroad, including in the United States; only the phone's notification address and the notification text are sent to these servers.
These transfers are carried out through the standard contracts announced by the Personal Data Protection Board, one of the appropriate safeguards provided for in Article 9 of the KVKK.
7. Retention Period
Your data is kept as long as your account is open. When you delete your account, the personal data linked to it is permanently deleted at the end of the 30-day waiting period. Coupon and virtual coin records are anonymised by removing their link to your account and are used only for statistical analysis.
Consent records are kept for the relevant limitation periods and technical records for the period required by the relevant legislation; at the end of that period they are deleted, destroyed or anonymised.
8. Your Rights under Article 11 of the KVKK
• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom it is transferred
• To request correction if it is incomplete or inaccurate
• To request deletion or destruction under the conditions of Article 7 of the KVKK
• To request that correction, deletion and destruction be notified to third parties to whom the data was transferred
• To object to a result against you arising from analysis exclusively by automated systems
• To claim compensation if you suffer damage due to unlawful processing
9. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit requests regarding your rights in one of the following ways:
• In person or through a notary with a wet-signed petition: Kınıklı Mah. 6021 Sok. No:59/7 Pamukkale / Denizli, Türkiye
• By registered e-mail (KEP): winway@hs01.kep.tr
• With a secure electronic or mobile signature, or from the e-mail address registered in the Application: info@winway.com.tr
Your application must include your first and last name, your Turkish ID number (if you are a Turkish citizen) or your nationality and passport or ID number (if you are not), your address for notifications, your e-mail address if any, and the subject of your request.
Your application is concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, the answer is insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board.