Legal documents
Every document is versioned; the version you accepted and the date are stored in your account. Changes ask for acceptance again.
Data controller
Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") the data controller is Ema Yazılım ve Bilişim Teknolojileri A.Ş.. Contact: emagames@emaplay.tr
Address: Cevizli, Zuhal Cd., A3 Blok, 34846 Maltepe/İstanbul
What we process
Account data: username, e-mail address, display name and an irreversible hash of your password (argon2id). The password itself is NEVER stored.
Transaction data: purchase records, order amounts, refund requests. Card number, expiry date and CVV never reach us; they stay with the payment provider.
Usage data: playtime, installed games, achievements, friends list, messages, cloud saves.
Technical data: IP address, browser information, session identifier — for security and abuse detection.
Purpose and legal basis
Performance of a contract: creating an account, purchases, download entitlement, cloud saves.
Legal obligation: retention of invoices and accounting records.
Legitimate interest: fraud and abuse detection, service security.
Consent: marketing e-mails and launch notifications. You can withdraw this consent at any time.
Sharing
Your data is shared with the parties whose services we use — payment provider, hosting and e-mail delivery — ONLY to the extent the service requires.
Some of these providers may be located abroad; in that case transfers are made in line with the conditions in KVKK Art. 9.
We do not sell your data to third parties for advertising.
Retention
Account data is kept while your account is open. If you close your account, data other than transaction records we are legally required to keep is deleted or anonymised.
Invoices and financial records are kept for the period required by law (10 years).
Your rights
Under KVKK Art. 11 you have the right to learn whether your data is processed, to request information, to have it corrected or deleted, to object to processing and to seek compensation for damages.
Send requests to emagames@emaplay.tr; they are answered within 30 days at the latest.
Security
Passwords are hashed with argon2id. Session tokens are short-lived and rotating; reusing a token is treated as a leak and closes every session.
Traffic between the site and the API is encrypted. The access token is never sent to the browser — it stays in the server session.
