Under this User Privacy Notice (“Privacy Notice”), we, Agave Games Bilişim Yazılım ve Pazarlama Anonim Şirketi (“Agave”, “Company”, “we”), located at Esentepe Mahallesi, Levent, Büyükdere Cd. No:199 D:11. Kat, 34394 İstanbul, inform you, in our capacity as the data controller, about how we process your personal data within the scope of the services we provide worldwide.

This Privacy Notice explains how we collect, use, retain, and otherwise process your personal data when you play mobile games developed by Agave, contact our customer service or technical support teams, use any of the other services we provide, or interact with us in connection with our marketing activities.

Which personal data do we collect

Depending on your interaction with us and your device, the personal data we collect and process are specified below:

• Identity Data — Name, surname; username.
• Contact Data — Email address; phone number.
• Transaction Security Data — IP address; device information (device model, device brand, operating system information, language preference, MAC address, country information, device ID number, network and tracker information); universal ID; region information (city); game download platform information (Apple Store / Google Play); user ID; social media token information; in-game usage information (clicks, duration, in-game instructions, time of use, in-game preferences, users interacted with, and in-game usage habits); browser information; IDFA, IDFV and AAID.
• Customer Transaction Data — User correspondence, comments, posts, and team name used; information regarding in-game usage (clicks, duration, in-game instructions, time of use, in-game preferences, users interacted with, and in-game usage habits); request and complaint information; app store confirmation information regarding in-game purchases (without including payment information).
• Marketing Data — User ID; IP address; device information (device model, device brand, MAC address, country information, device ID number, network and tracker information, operating system information); region information (city); information regarding in-game usage (clicks, duration, in-game instructions, time of use, in-game preferences, users interacted with, and in-game usage habits); gender and age group; social media token information; information regarding clicked advertisements; advertising campaign information; IDFA, IDFV and AAID.
• Location Data — Location information.

Our services are intended for a general audience and are not directed to children under the age of 13 or below the applicable minimum age under local laws and regulations. We do not knowingly or intentionally collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take the necessary steps to erase such data.

Purposes and legal bases for the processing of personal data

Transaction Security Data

• Purposes: Ensuring the security of the data controller’s operations, making notifications to authorized persons, institutions and organizations, preventing fraud and illegal activities, and managing compliance processes with applicable legislation.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing is necessary for the data controller to comply with its legal obligations.
• Purposes: Providing products to users, creating user accounts, and providing users with in-game access.
  Legal bases: Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
• Purposes: Storing users’ consent/preference information, managing legal disputes, and ensuring the security of our players.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing is necessary for the data controller to comply with its legal obligations.

Identity Data, Transaction Security Data and Customer Transaction Data

• Purposes: Ensuring the security of the data controller’s operations, preventing illegal activities, and managing legal disputes.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing is necessary for the establishment, exercise, or protection of a right.
• Purposes: Providing products to users, enabling in-game interaction for users, ensuring user satisfaction, and managing player communications.
  Legal bases: Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract; processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject.

Identity Data, Contact Data and Transaction Security Data

• Purposes: Ensuring the security of the data controller’s operations, making notifications to authorized persons, institutions and organizations, preventing fraud and illegal activities, and managing compliance processes with applicable legislation.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing is necessary for the data controller to comply with its legal obligations.
• Purposes: Providing products to users, creating user accounts, and enabling user logins.
  Legal bases: Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

Transaction Security Data, Customer Transaction Data, Marketing Data and Location Data

• Purposes: Optimizing advertising and game activities, and displaying in-app advertisements to users; determining company strategies, and managing payment and budgeting processes related to business partner advertising companies (calculation of fees based on the number of clicks).
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject.
• Purposes: Conducting analyses relating to advertisements displayed to users.
  Legal bases: Explicit consent.

Transaction Security Data, Marketing Data and Location Data

• Purposes: Conducting user analytics and insight generation activities, and optimizing and improving Agave’s services, products, and player experience.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
• Purposes: Personalizing services for users, conducting profiling, marketing, research, analytics, and contextual and behavioral advertising activities.
  Legal bases: Explicit consent.

Customer Transaction Data

• Purposes: Verifying users’ in-app purchases through the relevant app store.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

Identity Data, Contact Data, Transaction Security Data and Customer Transaction Data

• Purposes: Evaluating users’ refund or other requests and complaints; generating diagnostic and error reports, and providing technical support to users.
  Legal bases: Processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject; processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

All data categories

• Purposes: Complying with legal obligations and responding to legal requests (e.g., court orders and subpoenas).
  Legal bases: Processing is necessary for the data controller to comply with its legal obligations; processing is necessary for the establishment, exercise, or protection of a right.

Where we process your personal data based on your explicit consent, you may withdraw your explicit consent at any time. The withdrawal of your explicit consent shall not affect the lawfulness of any processing activities carried out prior to such withdrawal.

Who do we share your personal data with

We may share your personal data with the following recipient groups for the specified purposes:

• Third-party infrastructure providers located in the European Economic Area (EEA), Asia, and North America (including the United States), which provide cloud and information technology infrastructure services for the purposes of ensuring information security processes, data storage, and software development services.
• Relevant third parties located in the European Economic Area (EEA), Asia, and North America (including the United States), with which users have accounts, for the purpose of enabling users to log in to games through third-party applications.
• Third-party application stores (e.g., Google Play, App Store), for the purpose of obtaining confirmations regarding the completion of payment transactions and providing related services.
• Third-party outsourced service providers located in the European Economic Area (EEA), Asia, Türkiye, and North America (including the United States), which provide various services, including cookies and SDKs, for purposes such as delivering interest-based advertising, tracking preferences, and measuring the effectiveness of advertisements.
• Public authorities, including law enforcement authorities, public institutions and organizations, courts, and other public authorities, where necessary to comply with a legal obligation or respond to lawful requests.
• Persons who are parties to any existing or contemplated corporate transaction affecting all or part of our Company, including merger, acquisition, share or asset sale, financing, consolidation, restructuring, dissolution, liquidation, or bankruptcy processes.

Where we transfer your personal data outside the European Union and Turkey, we implement appropriate safeguards in compliance with applicable laws, such as standard contractual clauses or other recognized legal mechanisms. These safeguards ensure that your personal data is protected at an adequate level.

Please note that servers may be located in multiple regions and may change due to infrastructure updates or replications carried out by our service providers. For more information or to obtain a copy of the safeguard measures implemented for any data transfer, please contact us using the contact details provided in this Privacy Notice.

How do we collect your personal data

The types of personal data we may collect may vary depending on the service/product you receive or the nature of our relationship with you. Below, you can find the types of personal data we collect and the methods by which we collect such data.

We may collect your personal data through automated means when you download our games to your device or play them on your device, or when you directly submit your feedback, information, or support requests to Agave. We may also obtain your personal data through automated means from third-party platforms (such as Facebook, Google Play, App Store, etc.) and from our business partners or other third-party companies that have obtained your explicit consent to share such personal data with us or have another legal basis for such sharing.

Personal data collected directly from you

We collect your personal data directly from you when you register and create your player account, when you contact us regarding your refund or support requests, and when you use our products and services. In this context, Agave collects your name, surname, email address, phone number, IP address, device information, universal ID, region information (city), user ID, information regarding in-game usage, browser information, information regarding clicked advertisements, advertising campaign information, IDFA, IDFV, AAID, user correspondence, comments, posts, team name used, and request and complaint information.

Personal data collected from third parties

Agave may also collect your personal data indirectly from the following sources:

• From our business partners (e.g., App Store and Google Play), when you download Agave’s mobile applications and make in-game purchases through the relevant business partner’s application, which are subject to the relevant business partner’s terms of service and privacy notice. In this context, Agave may collect payment tokens or information regarding the platform through which the game was downloaded.
• From third-party social media networks (e.g., Facebook), when you link your account to a third-party social media network or interact with our games through such third-party social media network in a manner subject to that third-party social media network’s terms of service and privacy notice. In this context, Agave may collect social media token information.

How long do we retain your personal data

We will not retain your personal data for longer than is necessary for the purposes for which we collected it and for compliance with our legal obligations. When determining the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of your personal data, the potential risk of harm resulting from the unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, any ongoing legal disputes, and any applicable contractual obligations or legal requirements. We do not retain personal data beyond the periods prescribed by law.

Automated decision-making

Where we obtain users’ explicit consent for such processes, we use automated decision-making methods to direct users to appropriate advertisements based on their past behaviour and interactions. Through automated decision-making, users receive only advertisements and promotional offers that are relevant to their interests and past interactions.

In addition, where we obtain users’ explicit consent for such processes, we use automated decision-making methods to optimize users’ gaming experience based on their past behaviour and interactions. Through automated decision-making, users’ gaming experiences are personalized by adapting difficulty levels and other in-game features.

The types of personal data used in our automated decision-making processes consist of user ID, IP address, information regarding in-game usage (clicks, duration, in-game instructions, time of use, in-game preferences, users interacted with, and in-game usage habits), gender, age group, social media token information, information regarding clicked advertisements, location, advertising campaign information, IDFA, IDFV, AAID, and browser information (page/URL information, browser type and language, and landing page).

Profiling

We carry out profiling activities in order to provide you with a personalized gaming experience and improve the quality of our services. Through profiling, users are targeted for in-game advertisements and promotional campaigns. The types of personal data used in our profiling processes consist of user ID, IP address, device information (device model, device brand, MAC address, country information, device ID number, network and tracker information, operating system information), region information (city), information regarding in-game usage (clicks, duration, in-game instructions, time of use, in-game preferences, users interacted with, and in-game usage habits), gender, age group, social media token information, information regarding clicked advertisements, location information, advertising campaign information, IDFA, IDFV, AAID, and browser information (page/URL information, browser type and language, and landing page).

Your rights

Under applicable data protection laws, including the European Union General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“TR DPL”), you have the following rights in relation to your personal data. As the legal basis upon which we process your personal data may affect your data protection rights, these rights are briefly described below.

• Right of access — You have the right to request copies of your personal data from us. You may also request other information, such as details regarding where we obtained your personal data and with whom we have shared it.
• Right to rectification — You have the right to request the correction or deletion of personal data that you believe is inaccurate, incorrect, or incomplete.
• Right to erasure — You have the right to request the erasure of your personal data.
• Right to object — You have the right to object to the processing of your personal data.
• Right to restriction of processing — You have the right to request that we restrict how we use your personal data.
• Right to data portability — You have the right to request that the personal data you have provided to us be transferred to another organization or to you.
• Right to withdraw explicit consent — Where we process your personal data based on your explicit consent, you have the right to withdraw your explicit consent at any time.
• Right not to be subject to a decision based solely on automated processing — You have the right not to be subject to a decision based solely on automated processing that produces adverse legal effects concerning you or significantly affects you.
• Right to lodge a complaint — You have the right to lodge a complaint with your local data protection authority.

These rights apply regardless of age; however, where applicable, the processing of children’s data is subject to parental consent requirements.

How can you exercise your rights and contact us

If you have any questions, requests, or complaints regarding the processing of your personal data, or if you wish to exercise any of the rights described above, please contact us through the following contact channels:

• by sending a written request to “Esentepe Mahallesi, Levent, Büyükdere Cd. No:199 D:11. Kat, 34394 İstanbul”, or
• by sending an email from the email address that you have previously provided to us and that is registered in our systems to kvkk@agave.games.

Please specify which of your rights you wish to exercise. Please note that we may need to verify your identity before responding to your request.

If you believe that data protection laws have not been complied with in the processing of your personal data, you may lodge a complaint with the competent supervisory authority.

If we process your personal data pursuant to the GDPR and you wish to lodge a complaint regarding your rights under the GDPR, you may identify the competent supervisory authority by reviewing the list available here.

If we process your personal data pursuant to the TR DPL and you wish to lodge a complaint regarding your rights under the TR DPL, the competent supervisory authority in Turkey is the “Personal Data Protection Authority”, which can be accessed here.

European Union representative

As Agave offers services to individuals located in the European Union, it has appointed a European Union representative pursuant to Article 27 of the GDPR. The European Union representative acts on behalf of Agave for GDPR compliance purposes and may be contacted by data subjects located in the European Union regarding any questions, requests, or complaints relating to the processing of their personal data.

Contact details of the European Union representative:

• Address: Esentepe Mahallesi, Levent, Büyükdere Cd. No:199 D:11. Kat, 34394 İstanbul
• Email address: contact@agave.games

This appointment has been made by Agave through a written authorization and has been duly accepted by the representative.

Explicit consent for profiling and advertising activities

I consent to the processing of my personal data described in the Privacy Notice for the purposes of personalizing the services provided to me, conducting profiling, marketing, and behavioural advertising activities, and to the sharing of such personal data with third-party business partners operating in these fields.

Last updated: 30.07.2026