Membership Privacy Notice
Version 2026-10-v9 · Effective: 26 October 2026
This is an English translation provided for information. In case of any difference, the Turkish text prevails.
1. Data controller
Advenway is an independent sports and outdoor platform run by one person. Within the advenway.com membership service, your personal data is processed by Nusret Berk Mertoğlu, operating under the name Advenway, in accordance with Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
Contact and KVKK requests: iletisim@advenway.com
Electronic requests: iletisim@advenway.com (from the email address registered in our system)
2. Scope of this notice
This notice covers creating an account, signing in, managing your account, saving content to your account and storing your membership preferences.
Race result and activity entry features are not currently available; no data is collected through them. Before they become available, you will be informed separately about the related processing.
Use of the site outside membership, analytics and advertising cookies, and newsletter subscriptions are covered in their own notices.
3. What data do we collect?
| Data group | Scope |
|---|---|
| Account data | Your email address, display name and a one-way hash of your password. Your display name does not have to be your real name. |
| Optional profile data | If you choose to share them: your city, the sports you are interested in and your level. You can create an account without filling in these fields. |
| Preferences and saved items | Language and unit preferences, notification settings and the content you save to your account. |
| Security data | Session records, sign-in and account-change events, an IP hash used in the application's security logs, and browser/operating system type. |
| Google sign-in data | If you use this option: the email address and account ID of your Google account. Your Google profile name and photo are not received. |
| Request and processing records | Requests you send us and our replies, records showing that this notice was presented, and limited evidence records of data deletions. |
We do not ask for a phone number, postal address or national ID number in the sign-up form. Information required by law may be assessed separately during request procedures.
4. How and why do we process data?
Data is collected electronically, fully or partly by automated means, through the sign-up and sign-in screens, account settings, save actions, electronic requests and technical records created while the service runs. If you choose Google sign-in, the related account data is received from Google.
| Purpose | Legal basis |
|---|---|
| Creating the account, email verification, sign-in and password operations; providing the save feature | KVKK Article 5/2-c: directly related to and necessary for concluding or performing the membership agreement. |
| Storing your chosen language, unit and profile preferences and using them in the related account features | KVKK Article 5/2-c, to the extent necessary to provide the feature. Optional profile fields can be left empty and changed in account settings. |
| Preventing unauthorised access and misuse, sending necessary security notifications | KVKK Article 5/2-f: legitimate interest in the security of the service, provided your fundamental rights and freedoms are not harmed. |
| Answering KVKK requests, documenting that this notice was given and documenting data destruction | KVKK Article 5/2-ç: compliance with a legal obligation. |
| Keeping records needed in specific legal disputes | KVKK Article 5/2-e: establishing, exercising or protecting a right. |
Account verification, password reset and security emails are part of the membership service. Information and consent processes for newsletters or promotional messages are handled separately; this notice does not mean you have consented to them.
5. To whom is data transferred, and why?
Your membership data is shared with the following recipients only as far as necessary to run the service:
- Hosting: SH Online İletişim A.Ş. (Türkiye). Account data, the database and security records are kept on this company's servers in Türkiye. Server backups are also kept in this company's backup infrastructure.
- Sending email: Verification, password reset and account security messages are sent from the Advenway email account on the same server (iletisim@advenway.com). No separate email delivery company is used.
- Deletion list: For deleted accounts, only the member number, registration date and deletion date are kept separately, so that deleted accounts can be deleted again if the site is restored from a backup. This list contains no email address, name or other information.
- Authorised public authorities and courts: where required by law.
Transfers abroad: We do not send your membership data to recipients abroad. The data flow when you use Google sign-in is explained separately below.
Google sign-in: If you use this option, your browser is redirected to Google's sign-in page and you confirm the sign-in at Google yourself. During this step Google processes data within its own service (for example IP address and device information) under its own privacy policy. Advenway does not send your profile, saved items or other account data to Google; to complete the sign-in it receives only your email address and Google account ID from Google. If you do not use Google sign-in, no sign-in through Google takes place for your Advenway account.
Account content is not made available to other users or the public. Authorised persons may access it only as far as required for operation and support.
6. How long do we keep data?
Account data, preferences and saved content are kept as long as necessary to provide the membership service. When the conditions for processing no longer apply, the data is deleted, destroyed or anonymised.
| Record | Period |
|---|---|
| Account with unverified email address | 7 days from creation. |
| Application security events | 180 days. Records needed for a specific dispute may be kept separately as long as the related legal reason continues. |
| Extended session («Keep me signed in on this device») | At most 14 days. Expired session records are deleted within 1 day. |
| Deleted data remaining in backups | Removed as backups are rotated: the server takes a backup every day and keeps the last 7 daily backups; the monthly backup is kept until the next monthly backup, about one month. When restoring from a backup, deletion records are applied to prevent previously deleted accounts from being reactivated. |
| Account deletion request | Concluded within 30 days at the latest. Until permanent deletion starts, you can follow and withdraw your request in My Account. |
| Records of deletion, destruction and anonymisation | 3 years from the date of the operation. These records do not contain your email address in clear text; they contain only an irreversible keyed hash of it, the account number and dates. |
| Request and reply records | 3 years from the date the request was concluded. |
Freezing your account does not delete data. When you request deletion, data that no longer has a legal reason to be kept is destroyed; if limited records must be kept, they and the reasons are explained. Deletion does not require keeping the full account content as evidence.
7. Your rights and how to apply
Under KVKK Article 11 you have the right to:
- learn whether your personal data is processed and, if so, request information about it;
- learn the purpose of processing and whether it is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction if it is incomplete or inaccurate;
- request its deletion or destruction when the legal conditions are met;
- request that corrections, deletions and destructions be notified to third parties to whom the data was transferred;
- object to a result against you arising solely from analysis by automated systems;
- claim compensation if you suffer damage due to unlawful processing.
You can send your request from the email address registered in our system to iletisim@advenway.com. Other application methods recognised by law also remain valid. To verify that a request is yours, we may ask for information proportionate to the nature of the request.
Requests are concluded as soon as possible and within 30 days at the latest, free of charge as a rule. If an additional cost arises, the fee permitted by law may be charged. If your request is rejected, the reply is insufficient or no reply is given in time, you may complain to the Personal Data Protection Board (KVKK Board) within the legal time limits.
8. Cookies and updates to this notice
Cookies necessary for the session and sign-in security are used in membership operations. Other cookies used across the site are explained in the relevant cookie notice.
This notice is updated when the data processed or the purposes within the membership change. Before new processing starts, the necessary information is provided and, where required, separate explicit consent is obtained.