KVKK Notice (Turkish data protection law)

Last updated: 30 October 2026

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), Alpa Player (a non-profit project run by Alpa Yazılım), Mardin, Türkiye, e-mail: info@alpayazilim.com, as data controller, processes your personal data as described below.

1. Personal data processed

• Identity and contact: full name, institution name, e-mail, phone (panel applications and support requests).
• Institution user: institution code, student / staff number, name defined by the institution.
• Transaction security: app device ID, device model, IP address, sign-in and activity logs.
• Security logs for institution content: when the institution’s lesson / stream content is accessed, the content watched, the time, the IP address and the device ID; blocked attempts (a link opened from another network, a modified app, a failed sign-in). Playlists added by users themselves and other content they watch are not recorded.
• Site list-upload logs: when a list is uploaded to a device (MAC address) via alpaplayer.com, the uploader’s IP address, the date and time, the device’s MAC address, the uploaded list / account details (encrypted) and the version of the accepted responsibility statement; kept for at most 2 years to prevent abuse and to respond to requests from competent authorities.
• Legal retention (operation) records: for operations on the panel and the site: time of the operation, institution / panel name, the user who performed it, IP address, browser information, MAC address, device ID / key, the assigned list link (URL) and access details (encrypted). Kept for 2 years even if the device, list, user or account is deleted.

2. Purposes of processing

Concluding and performing the contract, providing the institution service, ensuring account and content security (device lock, short-lived playback link, watermark), fulfilling legal obligations, and responding to requests and complaints. Security logs are processed only to prevent unauthorised sharing of institution content and to identify the source in case of a leak; they can be seen by the authorised staff of the institution concerned and by Alpa Yazılım, and are deleted automatically after 90 days.

The legal retention records are processed to fulfil the traffic-information retention obligation arising from Law No. 5651 as a hosting provider, to respond to requests from competent authorities and to detect unlawful use.

3. Legal bases

KVKK Art. 5/2-(a) it is expressly provided for by law (Law No. 5651, Art. 5), (c) establishment or performance of a contract, (ç) compliance with a legal obligation, (e) establishment, exercise or protection of a right, and (f) our legitimate interests, provided that your fundamental rights and freedoms are not harmed.

4. Transfers

Your personal data may be transferred to the server provider from which we obtain hosting services and, on request, to competent public bodies and institutions (courts, public prosecutors, BTK and other relevant authorities). Because the server of the institutional service is located in France (European Union), data is transferred abroad in accordance with the procedures and principles under KVKK Art. 9. Institutional user data is also shared with the relevant institution (the institution acting as data controller).

5. Method of collection

Data is collected electronically through the forms on the website, e-mail, the institution panel, lists provided by the institution and the app.

6. Retention period and destruction

• Security logs: 90 days.
• Legal retention (operation) records, list upload records from the site and app download records: 2 years; kept for this period even if the related device, list, user or account is deleted.
• When the period ends, the data is deleted, destroyed or anonymised in periodic destruction runs (at least every six months) in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. If a legal investigation or official request is ongoing, the related records may be kept until that process ends.

7. Your rights (KVKK Art. 11) and how to apply

You have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in accordance with that purpose; to know the third parties to whom it is transferred in Türkiye or abroad; to request correction if it is incomplete or incorrect; to request deletion or destruction under KVKK Art. 7 and to have these actions notified to the third parties to whom the data was transferred; to object to a result against you arising from analysis of the data exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

You can submit your applications in writing to info@alpayazilim.com or to the postal address above, in a way that allows us to verify your identity; applications are concluded free of charge within 30 days at the latest, depending on their nature. Data that must be kept by law, such as the legal retention records, cannot be deleted before the retention period ends; your requests are fulfilled with respect to all other data. If you find the reply insufficient, or your application is rejected or not answered, you may complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of learning the reply and in any case within 60 days of the application date. Users in the European Union / European Economic Area may also contact the data protection authority of their country, to the extent applicable.