Privacy Policy

1. Data Controller

The data controller for personal data processed on this site is Ateş Spor Organizasyon, the operator of the Türkiye Espor Futbol Ligi:

• Legal name: ATEŞ SPOR ORGANİZASYON
• Address: Eyüpsultan Mahallesi, Vadi Sokak No. 10, Sancaktepe / İstanbul
• Phone: +90 216 311 42 27
• Corporate email: info@atesesports.com
• Privacy and KVKK requests: info@tefligi.com

2. What We Process, and Why

You do not need an account to use this site. What is processed depends on what you do:

• Server logs — your IP address, browser information, the address you requested and a timestamp. Purpose: keeping the site secure and stable, diagnosing abuse and errors. Legal basis: legitimate interest (KVKK art. 5/2-f).
• Contact form — name, email address, subject and the content of your message. Purpose: answering your enquiry. Legal basis: processing necessary to fulfil the request you made.
• Match prediction poll — an identifier derived from your browser, a salted digest of your IP address, and the choice you made. Purpose: preventing duplicate votes on the same match. Legal basis: legitimate interest.
• Visit statistics — page views, approximate location (country/city level), device and referring source via Google Analytics 4. Legal basis: your explicit consent. Nothing runs if you decline.
• Error and performance telemetry — JavaScript errors occurring in your browser; if you consent, also a session identifier and page performance measurements. Legal basis: legitimate interest for error records, explicit consent for session tracking and performance measurement.

3. Cookies and Similar Technologies

On your first visit you will see a cookie preference banner. No measurement cookie is written before you decide: Google Analytics starts with every signal set to "denied" under Consent Mode v2 and sends only a cookieless, anonymous ping. Choosing "Accept" enables analytics cookies; choosing "Decline" does not. Advertising and personalisation signals are always off regardless of your choice — no advertising is served on this site. To change your decision, clear this site's data in your browser and the banner will reappear.

4. Google Analytics 4

We use Google Analytics 4, provided by Google Ireland Limited, for visit statistics, and it runs only with your explicit consent. Google Analytics 4 does not log or store your IP address; the IP is used momentarily to derive an approximate location and is then discarded. User-level and event-level data is deleted automatically after 14 months; the aggregated, non-identifying reports derived from it may be retained by Google indefinitely. Google Signals and data sharing for advertising purposes are disabled. For Google's data practices see policies.google.com/privacy

5. Error and Performance Telemetry

We use Grafana Faro to see errors that occur in the browser. This data is not sent to a third-party analytics company: it goes to a collector under our own control and is kept in our own logging system. If you have not consented, only error records are collected and they carry no persistent identifier; session tracking and page performance measurement start only when you consent. We keep these records for the same log retention period stated in section 10 below.

6. Bot Protection (Cloudflare Turnstile)

The contact form is protected against automated submissions by Turnstile, provided by Cloudflare, Inc. When you open the form your browser connects to Cloudflare; in doing so your IP address and certain browser signals are processed by Cloudflare, and short-lived technical cookies may be set for verification. Turnstile does not make you solve puzzles and is not used for profiling. Cloudflare's privacy policy: cloudflare.com/privacypolicy

7. Match Prediction Poll

The match prediction poll is entirely anonymous; no name, email or account is required. To prevent more than one vote on the same match, a short identifier is derived from your browser's characteristics (language, screen size, time zone and similar) and stored in your browser, and a tefl_voted cookie lasting 180 days is set. On the server your IP address is not stored in the clear — only an irreversible, salted digest (SHA-256) is kept, and it is used solely to cap how many votes one address may cast on one match. These identifiers are never used to track you across other sites or for advertising.

8. Player and Club Data Published on the Site

The player names, usernames, profile images and match statistics shown on the standings, fixtures, player profile and statistics pages are taken from the VPG and EA Sports systems as part of league participation, and are published publicly so the league can be run transparently. To request correction or removal of a record about you, write to info@tefligi.com.

The jersey portraits in profiles do not come from VPG. These images are generated from the player's own photograph with their explicit consent; see section 9 below for details.

9. Use of AI

News articles, summaries, page descriptions and the backgrounds of news images on the site are prepared using a large language model (LLM) and image-generation services. AI operates within the league's management system; no data relating to site visitors is sent to external providers of AI and large language model services.

• The league administration reviews content prepared using AI and image-generation services before publication. This content may contain errors; match results, league tables and statistics are not generated by AI and are taken from VPG and EA Sports records.
• The jersey portrait is generated by AI from a photograph uploaded by the player and is not taken from VPG. AI redraws the player's pose, clothing and background; although preserving the face is intended, it may not remain exactly the same.
• The player gives their explicit consent for the jersey portrait to be generated by uploading a photograph in the management system and separately accepting a clear and readable consent statement. No image is generated before the player gives consent.
• If the photograph is uploaded on the player's behalf by a club official, namely the captain or manager, that official also declares that they have obtained the player's permission.
• There is one version of the consent statement, and the version approved by the player is recorded. If the text changes, previous consents are treated as invalid and no new image is generated until the player approves the new text.
• The player's photograph is transferred to the servers of external providers of AI and large language model services for the image to be generated and may be processed outside Türkiye. The providers may process the photograph only to generate the requested image; the league administration does not permit any other purpose.
• The league administrator reviews the generated image before publication.
• The player may delete the photograph they uploaded and the generated image from the management system at any time. When the player withdraws their consent, no new image is generated; it may not be possible to withdraw previously published images from every place where they have been distributed.

Suppliers are referred to by category; a change of supplier does not alter the scope of the permission obtained from the player. You can send your requests to info@tefligi.com.

10. International Transfers

The service providers named above (Google and Cloudflare) may also process data on servers outside Türkiye. For analytics these transfers rest on your explicit consent; for bot protection, on their being necessary to provide the service. They are carried out within the framework of KVKK art. 9. Our server logs and telemetry data stay on our own infrastructure. Player photographs are transferred to external providers of AI and large language model services solely to generate the image described in section 9 and may be processed outside Türkiye. The basis for this transfer is the player's explicit consent.

11. Retention Periods

We do not keep data longer than its purpose requires:

• Server and application logs (including telemetry): 1 year. This policy previously said 30 days; one year is the actual period, and it has been corrected here.
• Google Analytics user-level and event-level data: 14 months. Aggregated reports are non-identifying.
• Match prediction votes: until the corresponding match record is deleted. Votes cannot be linked back to your identity.
• Messages sent through the contact form: deleted from the mailbox within 12 months of the correspondence being concluded.
• Cookies: for the durations listed in the table above; you can delete them from your browser at any time.
• The uploaded photograph and generated image are stored until the player deletes them; the player may delete them at any time.

12. Sharing of Data

Your personal data is never sold commercially or transferred to third parties for marketing. Data may be shared only with the service providers named in this policy (hosting, email delivery, analytics, bot protection, content and image generation using AI), to the extent the service requires, and with competent public authorities where applicable law requires it.

13. Your Rights

Under article 11 of the KVKK you have the right to learn whether your personal data is being processed; to request information if it has been; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties, in Türkiye or abroad, to whom it has been transferred; to request correction of incomplete or inaccurate data; to request its erasure or destruction under the conditions set out in the law; to request that such actions be notified to the third parties the data was transferred to; to object to an adverse outcome reached solely through automated analysis; and to claim compensation if you suffer loss due to unlawful processing. You can submit a request to info@tefligi.com; it will be concluded within thirty days at the latest. If you find the response inadequate, you may lodge a complaint with the Personal Data Protection Board.

14. Children's Data

This site is not directed at children under 13 and we do not knowingly collect data from that age group. If you believe data about your child has been processed, write to us and we will delete the records concerned.

15. Changes to This Policy

We update this policy as the tools used on the site change. The version in force is always published on this page, and the date at the top shows when it was last updated.

16. Contact

For questions about this privacy policy and for KVKK requests: info@tefligi.com