This notice informs Seahorse Backgammon customers, prospective customers and website visitors about the processing of personal data under Article 10 of Turkish Personal Data Protection Law No. 6698.

Effective date 21 October 2026

1 Data controller

Cem Gürer is the data controller that determines the purposes and means of processing personal data for Seahorse Backgammon activities.

2 Categories of personal data

• Identity data, including name and surname.
• Contact data, including email, telephone number, delivery address and billing address.
• Customer transaction data, including product, order, personalisation, invoice, payment status, delivery, withdrawal, return, exchange and support records.
• Financial transaction data, including order amount, currency, payment method and transaction or refund references. The Seller does not store the full card number or CVV.
• Transaction security data, including IP address, timestamp, session, device, browser, security and system logs.
• Marketing data, including commercial communication and cookie preferences and campaign interactions.
• Legal transaction data, including requests, complaints, disputes and official correspondence.

3 Purposes and legal grounds

The duty to inform and explicit consent are separate. If processing relies on explicit consent, consent is obtained separately for a specific purpose and by free choice. Withdrawal does not affect processing lawfully carried out before withdrawal.

4 Collection methods

Data is obtained electronically or physically through website forms, account or payment steps, cookies and similar technologies, email and telephone communications, order and support records, iyzico, banks, carriers or logistics providers, and legally authorised sources. Processing may be fully or partly automated or non-automated as part of a data filing system.

5 Recipient groups and transfer purposes

If personal data is transferred to a provider outside Türkiye, the transfer is based on the applicable mechanism under Article 9 of Law No. 6698, such as an adequacy decision, appropriate safeguard or an eligible incidental-transfer condition. If a standard contract is used, the applicable notification requirements are fulfilled.

6 Retention and deletion

Personal data is retained for the period required for the purpose and for mandatory retention or limitation periods under tax, commercial, consumer, payment and dispute law. When the period ends and no other legal ground remains, the data is deleted, destroyed or anonymised.

7 Data subject rights

Under Article 11 of Law No. 6698, you may apply to the controller to:

• Learn whether your personal data is processed and request information if it is.
• Learn the purpose of processing and whether the data is used in accordance with that purpose.
• Learn the third parties in Türkiye or abroad to whom the data is transferred.
• Request correction of incomplete or inaccurate data; request deletion or destruction where the conditions are met; and request notification of those operations to recipients.
• Object to a result against you arising from analysis exclusively through automated systems.
• Claim compensation if you suffer damage because personal data was processed unlawfully.

8 How to apply

You may submit a request with information sufficient to verify your identity and describe your request in writing, by hand or notary, to Arap Cami Mahallesi, Kürekçiler Kapısı Sokak, Kurşunlu Han No. 47, Unit 25, Beyoğlu, Istanbul, Türkiye. You may also email info@seahorsebackgammon.com from an email address previously notified to and registered in our systems. A secure electronic signature, mobile signature or another method accepted by applicable rules may also be used.

The application should include full name; for Turkish citizens, national identity number; for foreign nationals, nationality and passport or other identity number; notification address; available email and telephone details; the subject of the request; and supporting documents. Requests are answered free of charge as soon as possible and no later than 30 days. If the response requires an additional cost, the fee permitted by the Turkish Data Protection Board’s tariff may apply.

9 Updates and language

If the processing purpose, method or recipient group changes, the required notice is given before the new processing starts. The current notice is published on the website with its effective date. This English notice is an informative translation; to the extent permitted by mandatory law, the Turkish notice prevails if the versions conflict.