Under article 10 of Turkish Law no. 6698 on the Protection of Personal Data ("KVKK"), this notice explains how your personal data is processed when you use the Nova2 game, its mobile application and the nova2.online site (the "Service").

1. Data controller

Nova2 [to be completed]

Address: [to be completed]

E-mail: [to be completed]

2. Personal data processed

• Account data: username, e-mail address, password (kept only as an irreversible hash; we cannot see the password itself), character deletion code.
• Connection records: IP address, date and time of the connection, account creation and login records.
• Game data: characters, level, inventory, in-game transactions (trades, sales, shop purchases), in-game chat messages, player reports and sanction records.
• Device data: technical details such as the application version, the operating system and the device model (for troubleshooting and compatibility).
• Support correspondence: the information you share when you write to us.

We do not ask for or keep identity numbers, addresses, telephone numbers or payment card details. We do not process special categories of personal data.

3. Purposes and legal grounds of processing

• To create your account, let you log into the game and provide the Service: KVKK art. 5/2-c (formation and performance of a contract).
• To prevent cheating, fraud, account takeover and abuse; to enforce the game rules; to keep the Service secure: KVKK art. 5/2-f (legitimate interest).
• To keep traffic records as required by Law no. 5651 and related legislation and to answer requests from authorities: KVKK art. 5/2-ç (legal obligation).
• To answer your requests and complaints and to recover accounts: KVKK art. 5/2-c and 5/2-f.
• To protect rights in the event of a dispute: KVKK art. 5/2-e.

We do not use your data for advertising and we do not sell it.

4. Transfers

Your personal data may be transferred to the following parties only for the purposes above and only as far as necessary:

• The providers from whom we obtain server and hosting services.
• The content delivery network service that handles website traffic and attack protection (Cloudflare). Its servers may be located abroad. This transfer is made in line with the safeguards set out in KVKK art. 9.
• The store the application is distributed through (Google Play) and the game engine provider (Unity); anonymous device and crash statistics, under their own policies.
• Public authorities and judicial bodies competent by law, upon request.

5. Method of collection

The data is collected electronically, by automatic or partly automatic means, when you fill in the registration form, when you play the game and when you write to us.

6. Retention period

• Account and game data: for as long as the account stays open. When the account is deleted it is erased or anonymised within 30 days at the latest.
• Connection and traffic records: the period required by legislation (at least 1 and at most 2 years).
• Sanction records: at most 2 years after the account is deleted, in order to prevent repeated breaches.

Once the period expires the data is erased, destroyed or anonymised.

7. Security

Passwords are stored irreversibly, database connections are encrypted and access to the servers is limited to authorised people. Even so, no method on the internet is completely secure; we recommend that you do not reuse your password elsewhere.

8. Children

The Service is not designed for children under 13 and we do not knowingly collect data from children under 13. People under 18 may register with their guardian's permission. If you notice an account belonging to a child under 13, report it to [to be completed] and we will delete the account.

9. Your rights (KVKK art. 11)

By applying to the data controller you can:

• Learn whether your personal data is being processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties to whom it is transferred.
• Request correction if it has been processed incompletely or incorrectly.
• Request its erasure or destruction, and request that corrections and erasures be notified to the parties it was transferred to.
• Object to an adverse outcome produced by analysis through automated systems.
• Claim compensation if you suffer damage because of unlawful processing.

You can make your application by writing from the e-mail address registered to your account to [to be completed]. Applications are answered free of charge within 30 days at the latest.

10. Account and data deletion

You can delete your account and the data attached to it with the "Delete account" button on the application's login screen or at nova2.online/hesap-silme. Your account closes immediately; your characters, items and account details are permanently deleted within 24-48 hours. All data other than the records we are required by law to keep is erased.

11. Changes

We may update this notice. The current version is always published in the application and on the nova2.online site. We also announce important changes separately.