Privacy Policy and KVKK Notice
Last updated:
This notice explains, under Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK"), how your personal data is processed when you use the games offered at boombala.net ("Boombala"). This English text is a translation; if it differs from the Turkish version, the Turkish version prevails.
1. Data controller
Your personal data is processed by ST Bilişim as data controller. Contact us at mail@boombala.net.
2. Personal data we process
| Category | Data |
|---|---|
| Identity | Your username, or the nickname you typed as a guest. |
| Contact | Your e-mail address, if you signed up. |
| Security | Your password (only in irreversibly hashed form), session data, IP address, browser details and server access logs. |
| Games and usage | The tables you sat at, your moves, scores and statistics (games played, wins, best score, play time) and your chosen language. |
| Table chat | The messages you write in a table's text chat. |
| Audio and video | Your voice and camera image if you turn on voice or video chat. They are transmitted live to the players at your table; they are not recorded or stored. |
| Analytics (with your consent) | Page visits and site usage collected through Google Analytics cookies. |
We don't ask for or process special categories of personal data. Please don't share such information in chat or in your username.
3. Purposes and legal grounds
- Providing accounts and games (sign-up, log-in, hosting and joining tables, running games, keeping scores and statistics, table chat, relaying voice and video chat): KVKK Art. 5/2(c), performance of a contract.
- Keeping the service and accounts secure (session management, preventing forged requests and abuse, tracking errors): KVKK Art. 5/2(f), legitimate interest.
- Legal obligations (keeping records under Law No. 5651 and related legislation, responding to competent authorities): KVKK Art. 5/2(ç).
- Answering your requests: KVKK Art. 5/2(c) and 5/2(ç).
- Measuring how the site is used (Google Analytics) and the related transfer abroad: your explicit consent under KVKK Art. 5/1 and Art. 9. Without "Accept" on the cookie banner, this processing doesn't happen.
4. How we collect data
Electronically, partly by automated means: through the site's forms (sign-up, log-in, guest join, profile), your actions in games, table chat, the voice and video chat you turn on, cookies and server logs.
5. Sharing
- Other players at your table: by the nature of the game, your username, moves, scores, chat messages and, if you turn them on, your voice and video are shown to players at the same table.
- Hosting: the site and database are hosted on a server in Turkey (Bursa). Voice and video chat flows directly between browsers or through our relay (TURN) server in Turkey.
- Authorities: competent public bodies and courts, when required by law and requested.
- Abroad (Google): with your consent, Google Analytics data is transferred to Google LLC (USA). Also, while setting up voice chat your browser contacts Google's STUN servers to find its network address, so your IP address is visible to Google.
We don't sell your personal data or share it with anyone for advertising.
6. How long we keep data
- Account data and statistics: until you delete your account.
- Guest accounts: deleted automatically after 7 days of inactivity while not seated at any table.
- Tables and moves: deleted after 30 minutes of inactivity for waiting rooms and finished games, 2 hours for games in progress (while nobody is connected).
- Table chat: the last 50 messages per table, for at most 12 hours.
- Audio and video: not stored.
- Sessions: 2 hours; the "remember me" cookie at most 400 days or until you log out.
- Server access logs: for the period required by law.
- Google Analytics: cookies for at most 2 years; at Google, for the retention period set in our Analytics account.
7. Your rights (KVKK Art. 11)
You may ask the data controller to: learn whether your personal data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties in Turkey or abroad it is transferred to; have it corrected if incomplete or wrong, or erased or destroyed under KVKK Art. 7, and have these actions notified to those it was transferred to; object to an adverse outcome arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
8. Making a request
Send your request from the e-mail address registered on the site to mail@boombala.net, stating your name, username, request and contact details. We answer free of charge within 30 days at the latest. You can also delete your account and its data yourself at any time from Delete my account on your profile page, and change your cookie choice on the cookie policy page.
9. Security
Connections are encrypted with HTTPS, passwords are stored irreversibly hashed, server access is limited to authorised people and data no longer needed is deleted regularly.
10. Children
Boombala isn't designed for children under 13. If you are under 18, use the site with your parent's or guardian's permission. If you find that data of a child under 13 is being processed, write to us and we will delete the account.
11. Changes
We may update this notice when needed; the current version is always on this page with its date above.