Data Protection Notice
Version 3 · Sep 8, 2026, 12:29 AM
Prepared pursuant to Article 10 of Turkish Personal Data Protection Law no. 6698 (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
1. Data controller
| Legal name | RMY YAZILIM REKLAM HİZMETLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ |
|---|---|
| Brand | Oyun Deposu |
| Address | Gazipaşa Mah. 865 Sk. Akalan Evleri C Blok No: 4 C İç Kapı No: 1, Menderes / İzmir |
| MERSIS number | [MERSİS NUMARASI] |
| Trade registry number | [TİCARET SİCİL NUMARASI] |
| Tax office / number | Menderes / [VERGİ NUMARASI] |
| ETBIS registration | [ETBİS KAYIT NUMARASI] |
| Phone | [TELEFON NUMARASI] |
| [email protected] | |
| Support | [email protected] |
| Registered e-mail (KEP) | [KEP ADRESİ] |
| Website | rmy-software.com |
VERBIS registration number: [VERBİS KAYIT NUMARASI]
2. Personal data processed
| Category | Data processed |
|---|---|
| Identity | First name, surname; tax identification details for corporate invoices |
| Contact | E-mail address, phone number, billing address |
| Customer transactions | Order number, order contents, amount, order and delivery records, wallet movements, support requests |
| Finance | The amount, date, description and sender name of the bank transaction; invoice records |
| Transaction security | IP address, browser and device information, session records, transaction timestamps, verification records |
| Marketing | Message preferences, only where consent has been given |
| Other | Steam ID and trade URL, if the Skin Market is used |
No special categories of personal data are collected.
3. Purposes of processing
- Creating the membership record and managing the account
- Concluding the sales contract, matching the payment and delivering the product
- Issuing invoices and keeping financial records
- Sending order, payment and delivery notifications
- Handling support requests and resolving disputes
- Preventing fraud and abuse and ensuring transaction security
- Measuring and improving service quality
- Sending commercial electronic messages where explicit consent has been given
- Providing information to competent authorities
4. Legal grounds
Your personal data is processed on the following grounds set out in Article 5 of the Law:
- Directly related to the conclusion or performance of a contract (Art. 5/2-c) — account, order, payment and delivery data
- Compliance with a legal obligation (Art. 5/2-ç) — invoices, financial records, traffic logs
- Establishment, exercise or protection of a right (Art. 5/2-e) — contract acknowledgements, transaction records, dispute files
- Legitimate interests (Art. 5/2-f) — fraud prevention, system security, service improvement
- Explicit consent (Art. 5/1) — only for commercial electronic messages and non-essential cookies
5. Method of collection
Data is collected by partly automated and automated means through the forms you complete on the website, the order and support flows, automatic system records, account movements received from the bank, and the information provided by Google or Steam if you sign in with those accounts.
6. Transfers
Limited to the purposes above, your data is transferred under Article 8 of the Law to hosting and infrastructure providers, e-mail and SMS providers, banks in the context of payment matching, accounting and audit service providers, Valve Corporation where the Skin Market is used, and to competent public authorities where required by law.
Transfers to providers located abroad are made under Article 9 of the Law, relying on an adequacy decision, appropriate safeguards (including standard contractual clauses) or the exceptions set out in the Law.
7. Retention periods
Data is retained for the longer of the period required by the purpose of processing and the mandatory retention periods set out in legislation. The periods are listed in the table in the Privacy Policy. Once the period ends, data is deleted, destroyed or anonymised.
8. Your rights as a data subject
Under Article 11 of the Law you have the right to:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties, in Türkiye or abroad, to whom the data has been transferred
- Request rectification if the data is incomplete or inaccurate
- Request erasure or destruction under the conditions in Article 7 of the Law
- Request that rectification, erasure and destruction be notified to third parties to whom the data was transferred
- Object to a result adverse to you arising from analysis carried out exclusively by automated systems
- Claim compensation for damage suffered due to unlawful processing
9. How to apply
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, requests may be submitted:
- In writing, by signed petition, to Gazipaşa Mah. 865 Sk. Akalan Evleri C Blok No: 4 C İç Kapı No: 1, Menderes / İzmir
- By registered electronic mail with a secure electronic signature to [KEP ADRESİ]
- By e-mail to [email protected] from the address registered in our system
Your application must include your name and surname, signature (for written applications), Turkish ID number (passport number for foreign nationals), address for notification, e-mail and phone number if any, and the subject of your request.
Applications are concluded free of charge within 30 days at the latest; where the process entails an additional cost, the fee set by the Board may be charged. If your application is rejected or not answered in time, you have the right to lodge a complaint with the Personal Data Protection Board.
10. Updates
This notice may be updated. It takes effect when published and receives a new version number; earlier versions are retained unchanged.