KVKK and GDPR Information Notice

Pursuant to the Turkish Personal Data Protection Law No. 6698 ('KVKK'), we, as Orinium (the 'Data Controller'), process your personal data within the scope explained below, in compliance with the law and the rules of good faith.

If you reside in the European Union or the European Economic Area (EEA), Regulation (EU) 2016/679 ('GDPR') also applies; for that purpose the data controller is likewise Orinium. The KVKK information is given first, followed by the GDPR information below.

Your personal data is processed on the legal grounds set out in Article 5 of the KVKK:

• Identity and game information (Minecraft username, UUID): being directly related to the conclusion or performance of a contract (KVKK art. 5/2-c).

• Transaction security data (IP address, port, session cookies, access logs): being expressly provided for by law (Law No. 5651) and the legitimate interest of the Data Controller (KVKK art. 5/2-ç, f).

• Financial and order data (order code, purchased package, payment confirmation): performance of the contract and fulfilment of legal obligations (KVKK art. 5/2-a, c).

Your personal data is collected electronically by automated or partly automated means through our website (orinium.net), the Minecraft server connection protocols, cookies and Discord support channels.

Under Article 11 of the KVKK, data subjects have the following rights:

a) To learn whether their personal data is being processed,

b) To request information if their personal data has been processed,

c) To learn the purpose of processing and whether the data is used in accordance with that purpose,

ç) To know the third parties in Turkey or abroad to whom the personal data is transferred,

d) To request rectification where the personal data has been processed incompletely or incorrectly,

e) To request erasure or destruction of the personal data under the conditions set out in Article 7 of the KVKK,

f) To object to a result arising against them from the analysis of the processed data solely by automated systems,

g) To claim compensation for damage suffered as a result of unlawful processing of personal data.

You may submit your requests concerning the rights listed above, together with documents evidencing your identity or your Minecraft account, by sending an e-mail to 'support@orinium.net' or through our official Discord server. Your applications will be concluded free of charge within thirty (30) days at the latest.

• Performance of a contract (Art. 6/1-b): creating the order, confirming payment and delivering the content to the in-game account.

• Legal obligation (Art. 6/1-c): keeping access logs under Turkish Law No. 5651 and retaining commercial records.

• Legitimate interests (Art. 6/1-f): preventing cheating, fraud and account takeover, and protecting the service and site security.

• Consent (Art. 6/1-a): only for processing that is not strictly necessary and that we base on your consent; you may withdraw it at any time.

Your personal data is never sold to third parties for commercial purposes or rented out for marketing purposes.

Your data may only be shared with:

• Payment infrastructure providers (for payment confirmation and invoicing),

• Hosting and server infrastructure providers (as required by technical operations),

• Authorised judicial and administrative authorities where duly requested under the applicable legislation, as a legal obligation.

Payment is collected through the Tebex Checkout infrastructure. Tebex Limited (United Kingdom), as the seller, processes card and billing data under its own controllership; that data never reaches Orinium. See Tebex's own privacy policy for details.

The site and its database are held on our hosting provider's servers. Where those servers are outside the European Economic Area (EEA), transfers take place with appropriate safeguards under GDPR Art. 46.

You may ask us for the countries of transfer and the safeguards used at the contact address below.

• Session records: the session cookie is valid for seven (7) days; expired records are deleted seven days later. An idle session becomes invalid after two days.

• Failed login attempts: deleted after twenty-four (24) hours.

• Orders, payments and credit movements: retained for the maximum period required for commercial records by applicable law.

• Application logs: kept under a size limit (2 MB with a single rotated copy); once the limit is reached the oldest entries are rotated out.

• Support correspondence: kept for at most two (2) years after the request is closed.

If you are in the European Union (or the EEA), you have the following rights under the General Data Protection Regulation (EU) 2016/679 ('GDPR'):

• Right of access (Art. 15): you may request a copy of the personal data we process about you.

• Right to rectification (Art. 16): you may have inaccurate or incomplete data corrected.

• Right to erasure — 'right to be forgotten' (Art. 17): in certain circumstances you may have your data deleted.

• Right to restriction of processing (Art. 18): you may ask that your data be stored but not otherwise used.

• Right to data portability (Art. 20): you may receive the data you provided in a structured, machine-readable format.

• Right to object (Art. 21): you may object to processing based on legitimate interests.

• Rights regarding automated decisions (Art. 22): you may object to decisions taken solely by automated means that significantly affect you. No such decision-making exists on this site.

• Right to withdraw consent (Art. 7/3): where processing relies on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

Requests relating to these rights are answered free of charge within thirty (30) days at the latest.

For requests under the KVKK you may apply to the Turkish Personal Data Protection Board.

If the GDPR applies to you, we recommend contacting us first — but you are not obliged to. Your right to lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement remains unaffected.