Privacy Notice

This English translation is provided for information. In case of any discrepancy, the Turkish version prevails.

At Miova Kreatif ve Dijital Teknolojiler San. Tic. Ltd. Şti. (“Miova”) we care about the security of your personal data. Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for the Duty to Inform, this notice explains how your personal data is processed when you visit our website, fill in our forms or use the interactive features on the site.

1. Data controller

• Company: Miova Kreatif ve Dijital Teknolojiler San. Tic. Ltd. Şti.
• Address: Değirmiçem Mah. Yamaçobalıdede Cad. Yıllar Apt. No:3/B, 27090 Şehitkamil/Gaziantep, Türkiye
• Email: hi@miova.com.tr
• Phone: +90 544 909 14 16

2. Personal data we process, purposes and legal grounds

Contact form

• Data: full name, email address, phone number (optional), company name (optional), the content of your message, the language and date of submission.
• Purpose: to review your request and reply, to carry out proposal and project discussions, and to keep a record of our correspondence.
• Legal ground: processing is directly related to establishing or performing a contract (KVKK Art. 5/2-c) and our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f).

Career application form

• Data: full name, email address, phone number (optional), the position you are applying for, and the education, experience and portfolio details and links you share in your message.
• Purpose: to review your application, run our candidate selection process and contact you.
• Legal ground: processing is directly related to establishing a contract (Art. 5/2-c) and our legitimate interest (Art. 5/2-f).

Please do not include special categories of personal data, such as health, religion or association membership, in your application.

Email newsletter

• Data: email address, language preference, the form you subscribed through, the date of your consent and the consent wording shown to you at the time, and the date you unsubscribed, if you did.
• Purpose: to send you our new work, articles and announcements by email and to be able to prove your consent.
• Legal ground: your explicit consent (Art. 5/1) and the approval you gave under Law No. 6563 on the Regulation of Electronic Commerce; establishing, exercising or protecting a right (Art. 5/2-e) to prove the consent and its withdrawal.

You can unsubscribe in one click with the link in every email. Once you unsubscribe, we stop sending you the newsletter; the unsubscribe record is kept to prove that you withdrew your consent.

Games and leaderboards

• Data: the nickname you use in games, score, play time, move and round details, difficulty level, room code in multiplayer games, and language preference.
• Purpose: to run the games, match multiplayer games and publish score and weekly leaderboards.
• Legal ground: our legitimate interest (Art. 5/2-f).

Your nickname and score appear on public leaderboards, and in multiplayer games your nickname is also shared with your opponent. We therefore recommend not using your real name, or anything that could identify you, as a nickname.

Blog feedback

• Data: your reaction to a post and a value derived one-way from a random visitor ID generated in your browser.
• Purpose: to stop the same visitor voting on a post more than once and to see how posts are received.
• Legal ground: our legitimate interest (Art. 5/2-f).

This record is not linked to your name, email address or IP address.

Live cursors and reactions

Visitors on the same page can see each other’s cursors in real time, and you can send emoji reactions on the home page.

• Data: your cursor position on the page, the address of the page you are on, a random ID generated only for your open tab, and the emoji you send.
• Purpose: to offer the interactive experience in which visitors on the same page can see each other.
• Legal ground: our legitimate interest (Art. 5/2-f).

This data is only relayed in real time and is not stored. Only total emoji counts are kept, without being linked to anyone.

Site security and technical logs

• Data: IP address, browser and device information, time of request and the address visited.
• Purpose: to run the site securely and without interruption, to prevent abuse of forms and games (spam, automated requests) and to meet our legal obligations.
• Legal ground: compliance with our legal obligations under the relevant legislation, in particular Law No. 5651 (Art. 5/2-ç), and our legitimate interest (Art. 5/2-f).

To prevent abuse of form and game requests, your IP address is held only in server memory and for no more than one hour.

Analytics cookies

Analytics cookies that measure how you use the site through Google Analytics and Mixpanel run only with your explicit consent (Art. 5/1). See our Cookie Policy for details.

3. How we collect personal data

Your personal data is collected electronically, by fully or partly automated means, through the forms, games and interactive features on our website and through cookies and similar technologies. Correspondence we carry out with you by email or phone is also covered.

4. Transfer of personal data

Limited to the purposes above and in line with Articles 8 and 9 of the KVKK, your personal data may be shared with the following recipients:

• Our service providers:
  • Hetzner Online GmbH: servers in a data centre in Finland that run our website and database.
  • Cloudflare, Inc.: content delivery, site security and image storage.
  • Resend: delivery of form notifications and newsletter emails.
  • Google LLC: visit statistics, only if you have consented to analytics cookies.
  • Mixpanel, Inc.: page views and on-site interactions such as form submissions, file downloads, games and blog votes, only if you have consented to analytics cookies. Your name, email address and form contents are not sent to Mixpanel.
• Authorised public bodies: on request of legally authorised authorities, within our legal obligations.
• Our legal and financial advisers: where necessary to establish, exercise or protect a right.

As these service providers’ servers are located outside Türkiye (including the European Union and the United States), your personal data is transferred abroad. These transfers are made in line with Article 9 of the KVKK: where there is no adequacy decision, by providing one of the appropriate safeguards listed in the Law (for example the standard contract announced by the Personal Data Protection Board), and where this is not possible, under the conditions set out in the Law for incidental transfers.

We do not sell your personal data or share it with third parties for advertising.

5. Retention

We keep your personal data for as long as necessary for the purpose it is processed for and for the periods required by the relevant legislation. When you ask us to delete it, we delete, destroy or anonymise your data unless we have a legal retention obligation or a legitimate reason relating to a legal claim. In addition:

• Game session records are deleted automatically after 180 days.
• IP addresses held to prevent abuse are cleared from memory within one hour at most.
• Live cursor data is never stored.

6. Your rights

Under Article 11 of the KVKK, you have the right to apply to the data controller to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions in Article 7 of the KVKK,
• request that the third parties to whom it was transferred are notified of any correction, deletion or destruction,
• object to a result against you that arises from analysis of your data exclusively through automated systems,
• claim compensation if you suffer damage because your data was processed unlawfully.

7. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your full name, Turkish ID number (or, if you are not a Turkish citizen, your nationality and passport or ID number), your address or email address for notification, your phone number and the subject of your request. You can submit it:

• in writing with a wet signature, delivered by hand to our address above or through a notary,
• signed with a secure electronic signature or mobile signature, to hi@miova.com.tr,
• from an email address you have previously given us and that is registered in our systems, to hi@miova.com.tr.

We will conclude your application free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the answer insufficient, or we do not respond in time, you may file a complaint with the Board.

8. Changes

We may update this notice in line with changes in legislation or in our data processing activities. The current version is always published on this page, with the date of the last update shown at the top.