PRIVACY NOTICE ON THE PARENT AND CHILD USE PROCESSES OF THE UPPY PLATFORM UNDER THE PERSONAL DATA PROTECTION LEGISLATION
1. INTRODUCTION
As Düş Yeri Bilişim Teknoloji ve Animasyon A.Ş. ("Company"), the privacy and security of your personal data is among our highest priorities. Our Company processes your personal data in compliance with Law No. 6698 on the Protection of Personal Data ("KVKK") and secondary legislation. Personal data means any information that makes your identity determined or determinable.
This Privacy Notice has been prepared to inform you about the processing of the personal data of parents, legal representatives and/or contracting parties ("Parent User") who use the services provided within the scope of our mobile application named Uppy and related interfaces ("Platform Services"), and the personal data relating to the minor child user ("Child User") who benefits from the Platform in this context.
2. WHICH PERSONAL DATA DO WE PROCESS?
2.1. Parent User Processes:
If you create a Platform subscription, accept the User Agreement and benefit from the Platform Services, the following personal data may be processed:
Identity Data: Your name, surname, Turkish ID number.
Contact Data: Your telephone number, e-mail address.
Customer Transaction Data: Your customer number, subscription details, invoice details, user account preferences and transaction details, requests, complaints, suggestions, the content of conversations on communication channels, your survey answers and your feedback on the customer experience.
Financial Data: Payment details, registered IBAN / card details, transaction reference details provided by the cooperating institution, payment institution or bank.
Transaction Security Data: Device data, IP address, user account and session data, password and passcode data, Platform access records, log records, cookie data.
Marketing Data: Your preference and transaction records relating to campaigns and announcements.
Legal Transaction Data: Information in correspondence with authorised persons, institutions and organisations, information relating to legal information requests, information within the scope of your data subject applications, information relating to legal disputes, litigation, enforcement, mediation and similar legal processes, and where necessary, information capable of proving that you are the parent, guardian, custodian or legal representative of the Child User.
Visual and Audio Recording Data: Voice recording data processed within the scope of customer services.
2.2. Child User Processes:
We are aware that Uppy is a platform aimed at children and that personal data belonging to the Child User must be protected with particular sensitivity. For this reason, in addition to your personal data as a Parent User within the scope of the Platform subscription, certain personal data belonging to the Child User may also be processed for purposes such as providing the Platform Services, conducting them securely, offering an experience suitable for children, enabling parental control and fulfilling our obligations arising from legislation.
In this context, in relation to the Child User; child profile data such as age group, gender, username/nickname and preferred language provided by you, together with usage data relating to the content, games, activities and in-app transactions accessed or used by the Child User within the scope of the Platform, completed activities and usage duration data may be processed.
Where Premium membership and the analysis/reporting features within this scope are active, in-app progress status, points, results, usage distribution, content/activity-based assessment and reporting data based on the Child User's use of the Platform may also be processed.
If the Uppygram feature is used, photographs, videos, voice recordings belonging to the Child User and information relating to content created, uploaded, shared or displayed within the scope of this feature may also be processed solely for the purpose of providing the relevant feature, conducting sharing/display and in-app interaction processes and ensuring security. In order for the Uppygram feature to be used securely, a parent password and related security settings are applied, and the Parent User is able to follow the content created and shared within the scope of this feature through their own account.
We would like to emphasise that personal data belonging to the Child User is not processed for the purposes of advertising, segmentation or marketing profiling. Such marketing processes are carried out solely within the scope of information belonging to the Parent User and, where necessary, on the basis of explicit consent and/or commercial electronic message approval.
3. WHAT ARE THE LEGAL GROUNDS, PURPOSES AND COLLECTION METHODS FOR PROCESSING YOUR PERSONAL DATA?
Your personal data and the personal data belonging to the Child User are collected by our Company wholly or partly by automated means or by non-automated means provided that they form part of a data recording system, through the electronic environments in which the Platform Services belonging to our Company that you benefit from under our user agreement are located; through the channel you contact us via in electronic form if you contact us through e-mail channels, and in physical form if delivered to our Company by printed forms, notification or post or if served by legal authorities. The personal data processed, the purposes of processing and the legal grounds are set out below.
3.1. Subscription and Account Creation / Cancellation Processes:
Personal data processed in this category: your identity, contact, customer transaction, financial, transaction security, legal transaction, visual and audio recording data.
Purposes:
- Establishment and performance of the distance sales, subscription and/or user agreement.
- Management of the processes for creating and closing Platform user accounts.
- Verification of contact details.
- Carrying out your purchase / return / cancellation transactions via the Platform.
- Conducting and auditing the Company's business activities and conducting Platform operations in compliance with legislation and ensuring their security.
- Fulfilment of obligations arising from the legislation to which our Company is subject, in particular the KVKK, Law No. 6563 on the Regulation of Electronic Commerce, Turkish Commercial Code No. 6102, Turkish Penal Code No. 5237 and Law No. 6502 on Consumer Protection.
Legal Grounds: being expressly provided for by law, being mandatory for the fulfilment of our Company's legal obligations, and being necessary for the performance of the agreement between us.
3.2. Provision of Platform Services Processes:
Personal data processed in this category: your identity, contact, customer transaction, financial, transaction security, legal transaction, visual and audio recording data.
Purposes:
- Creation and management of user profiles within the scope of the Platform and enabling the use of the Platform Services.
- Provision, personalisation and maintenance of the Platform experience in line with the settings determined by the Parent User.
- Conducting the usage processes relating to the content, games and activities accessed by the Child User within the scope of the Platform; monitoring and reporting completed activities, progress status, points, results and assessment data for Premium accounts.
- Providing Platform content and services to the Child User in a suitable, safe and personalised manner.
- Conducting and concluding request, complaint, suggestion and support processes relating to the use of the Platform.
- Conducting payment, collection, invoicing and finance processes.
- Conducting and auditing the Company's business activities and conducting Platform operations in compliance with legislation and ensuring their security.
Legal Grounds: being mandatory for the fulfilment of our Company's legal obligations and being necessary for the performance of the agreement between us.
3.3. Improvement of the User Experience Processes:
Personal data processed in this category: your identity, contact, customer transaction, financial, transaction security, legal transaction, visual and audio recording data.
Purposes:
- Measuring, analysing and improving the Platform experience within the scope of the Platform Services.
- Conducting analysis, reporting and assessment studies in order to increase the ease of use, performance and service quality of products and services.
- Measuring the satisfaction of the Parent User.
- Receiving requests, complaints, suggestions and support applications relating to products and services, conducting after-sales support services and carrying out the necessary communication activities in this context.
Legal Grounds: being necessary for the performance of the agreement between us and processing being mandatory for the legitimate interests of our Company.
3.4. Company Information Security, Risk, Audit and Control Processes:
Personal data processed in this category: your identity, contact, customer transaction, financial, transaction security, legal transaction, visual and audio recording data.
Purposes:
- Conducting and auditing finance, accounting and invoicing processes.
- Ensuring information security and conducting platform operations securely.
- Investigating suspicious transactions, preventing and detecting fraudulent activities.
- Operating risk detection, assessment and internal control mechanisms.
- Conducting internal audit, quality control and compliance processes.
- Carrying out the necessary review, reporting and assessment activities in this context.
Legal Grounds: being necessary for the performance of the agreement between us and processing being mandatory for the legitimate interests of our Company.
3.5. Conduct of Legal Processes:
Personal data processed in this category: your identity, contact, customer transaction, financial, transaction security, legal transaction, visual and audio recording data.
Purposes:
- Conducting legal and litigation affairs, responding to your legal requests, reviewing and responding to your duly made data subject applications.
- Conducting activities in compliance with legislation and fulfilling the obligations arising from the legislation to which our Company is subject.
- Conducting legal consultancy processes.
- Sharing information with authorised persons, institutions and organisations upon request.
- Exercising and protecting a right in the event of a legal dispute.
Legal Grounds: processing being mandatory for the establishment, exercise or protection of a right and being mandatory for the fulfilment of our Company's legal obligations.
3.6. Conduct of Marketing and Communication Activities:
Personal data processed in this category: your identity, contact, customer transaction and marketing* data.
Purposes:
- Conducting marketing, advertising and promotional activities.
- Carrying out segmentation and profiling.
- Offering you advantageous offers specific to your subscription, conducting activities aimed at increasing your satisfaction by getting to know you better, and sending commercial electronic messages in this context.
Legal Ground: The existence of your explicit consent.
* We would like to emphasise that personal data belonging to the Child User is not processed for marketing purposes under this heading.
If you wish to withdraw the consent you have given, you may convey your request to our Company using the methods set out under the heading "Contact for Your Rights and Requests".
4. TO WHOM AND FOR WHAT REASONS DOES THE COMPANY TRANSFER YOUR PERSONAL DATA?
Our Company takes care to process your personal data in accordance with the principles of "need to know" and "need to use", ensuring the necessary data minimisation and taking the necessary technical and administrative security measures.
Your personal data is shared domestically by our Company with the recipient groups detailed below on the legal grounds of "being expressly provided for by law, being mandatory for the fulfilment of our Company's legal obligations, being necessary for the establishment or performance of the agreement, processing being mandatory for the establishment, exercise or protection of a right and/or being mandatory for the legitimate interest of our Company" pursuant to Article 8 of the KVKK.
In cases where your personal data is transferred abroad by our Company, it is shared with the recipient groups detailed below on the legal grounds of "providing appropriate safeguards by means of a standard contract, or, on an incidental basis, the existence of one of the situations set out in paragraph 6 of Article 9 of the KVKK" regulated in Article 9 of the KVKK and in the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad.
4.1. Subscription and Account Creation / Cancellation Processes:
- Shared with our business partners and service providers that provide, operate or supply our information technology infrastructure for the purposes of enabling you to benefit from the Platform Services under our contractual relationship, the establishment and performance of the subscription agreement, conducting Platform operations, and procuring information technology, technology and software services.
Legal Ground: being necessary for the establishment or performance of the agreement and providing appropriate safeguards by means of a standard contract.
4.2. Provision of Platform Services Processes:
- With our service providers for the purposes of enabling you to benefit from the Platform Services, conducting purchase and invoicing processes and fulfilling the obligations arising from the legislation to which our Company is subject,
- With our contracted business partners, banks and other payment institutions and business partners for the purpose of conducting and monitoring your payment processes,
- With our business partners from whom bulk SMS / e-mail sending services are procured for the purpose of informing you about the use of the Platform and the services,
it is shared.
Legal Ground: fulfilment of our Company's legal obligations, being necessary for the establishment or performance of the agreement and providing appropriate safeguards by means of a standard contract.
4.3. Improvement of the User Experience Processes:
- With our business partners and service providers offering customer support services for the purposes of providing sales and after-sales support services, ensuring customer satisfaction and meeting requests and complaints,
- With service providers located domestically and abroad, and our business partners and consultants providing information technology infrastructure, software and technology services in order to provide Platform services and conduct Platform operations, for the purposes of conducting activities aimed at developing and improving the products and services offered by our Company,
it is shared.
Legal Ground: being necessary for the establishment or performance of the agreement, processing being mandatory for the legitimate interests of our Company, providing appropriate safeguards by means of a standard contract and, on an incidental basis, the existence of one of the situations set out in paragraph 6 of Article 9 of the KVKK.
4.4. Company Information Security, Risk, Audit and Control Processes:
- With our business partners, consultants and service providers, banks, e-invoice business partner, cargo and courier companies, private integrator, independent audit, financial adviser/accounting service providers for the purposes of conducting invoicing processes, sending e-invoices to the customer electronically, delivering physical contracts or invoices, managing financial and accounting processes, detecting and assessing risks and preventing fraud,
- With independent audit, financial adviser/accounting service providers, our shareholders, private integrators, technology companies, our business partners and suppliers providing services for the purposes of ensuring the security of Company operations, controlling and improving the quality of the products and services offered by our Company, and carrying out risk detection and analysis,
it is shared.
Legal Grounds: fulfilment of our Company's legal obligations, being necessary for the establishment or performance of the agreement, being mandatory for the legitimate interest of our Company, providing appropriate safeguards by means of a standard contract.
4.5. Conduct of Legal Processes:
- With regulatory and supervisory authorities and authorised public institutions and organisations such as courts, enforcement offices and mediators for the purposes of fulfilling the obligations arising from the legislation to which our Company is subject and conducting Platform activities in compliance with legislation, providing information to authorised persons, institutions and organisations, following up and conducting legal affairs, and exercising and protecting a right in the event of a legal dispute,
- With lawyers, auditors, tax advisers, forensic informatics experts, cyber security consultants, our shareholders, other third parties and business partners from whom we receive consultancy and services for the purposes of conducting our Company's audit activities, conducting legal consultancy processes, ensuring the security of company operations and reviewing suspicious transactions,
- With authorised public institutions and organisations for the purposes of providing information to authorised persons, institutions and organisations domestically and abroad upon request, and exercising and protecting a right in the event of a legal dispute,
it is shared.
Legal Grounds: being expressly provided for by law, fulfilment of our Company's legal obligations, processing for the establishment, exercise or protection of a right, being necessary for the establishment or performance of the agreement and, on an incidental basis, the existence of one of the situations set out in paragraph 6 of Article 9 of the KVKK.
4.6. Conduct of Marketing and Communication Activities:
- Shared with service providers and business partners for the purposes of conducting marketing, advertising and promotional activities, offering you advantageous offers specific to you, and conducting activities aimed at increasing your satisfaction by getting to know you better.
Legal Ground: The existence of your explicit consent.
5. YOUR RIGHTS REGARDING THE PROTECTION OF YOUR PERSONAL DATA
By applying to our Company using the methods set out in the "Contact for Your Rights and Requests" section of this Privacy Notice, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
- know the third parties to whom it is transferred domestically or abroad,
- request the correction of personal data in the event that it has been processed incompletely or incorrectly,
- request the erasure or destruction of your personal data within the framework of the conditions set out in the KVKK,
- request notification of the transactions carried out pursuant to your rights of correction, erasure and destruction mentioned above to the third parties to whom the personal data has been transferred,
- object to the emergence of a result against you by analysing your processed personal data exclusively through automated systems,
- request compensation for damages in the event that you suffer damage due to the processing of your personal data contrary to the relevant legislation.
6. CONTACT FOR YOUR RIGHTS AND REQUESTS
You may submit your questions and requests relating to your personal data using the methods below, with a petition drawn up in accordance with the conditions set out in the Communiqué on the Procedures and Principles for Application to the Data Controller, or with the "Data Subject Application Form". You can reach the application form here.
Written Application in Person*
Kandilli Mah. Vaniköy Cad. Berton Blok No: 77 İç Kapı No: 1 Üsküdar / İstanbul
Notary
Kandilli Mah. Vaniköy Cad. Berton Blok No: 77 İç Kapı No: 1 Üsküdar / İstanbul
Registered Electronic Mail (KEP) signed with a secure electronic signature or mobile signature
[email protected]
From your electronic mail address previously notified to our Company and registered in the system
[email protected]
* Data Subjects who apply by way of Written Application in Person are obliged to present documents verifying their identity. In this context, for written applications made in person to the address Kandilli Mah. Vaniköy Cad. Berton Blok No: 77 İç Kapı No: 1 Üsküdar / İstanbul, we kindly ask that only the front side of a photocopy of your identity card (in a manner that does not show blood type and religion fields) be presented together with the application form.
** We kindly ask that "Personal Data Protection Law Data Subject Request" be written on the notification envelope of the application form or in the subject line of the e-mail.
As personal data owners, if you submit your requests relating to your rights to the Company, your request will be concluded free of charge by the Company within a maximum of 30 (thirty) days. However, if the response to your application requires a cost pursuant to the legislation, the fee in the tariff determined by the Personal Data Protection Board may be charged by the Company.
7. ABOUT THE PRIVACY NOTICE
The Company reserves the right to update this Privacy Notice on the Protection of Personal Data at any time within the framework of changes that may be made to the legislation in force.
Update Date: 01.07.2026