Website privacy policy

1. Scope and the short version

This policy covers pekogames.com, the Peko Games information and support website. The PEKO mobile app has a separate app privacy policy describing device storage, camera and microphone features, crash reporting, optional usage statistics and parent-connected AI 3D.

This website has no user accounts, checkout, advertising, behavioural analytics, tracking pixels or embedded social feeds. Fonts and images are served with the website. You can read every document without signing in. We do not sell personal data or share it for targeted advertising.

2. Who is responsible

The website operator and data controller is Sercan Göger, trading as Corylustech. Peko Games and PEKO are brand names; Corylustech is not a separate legal entity.

• Address: Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul.
• Privacy and rights requests: privacy@pekogames.com.
• General enquiries: hello@pekogames.com.
• Contact options: contact page.

3. Data, purposes and collection methods

Connection information. When your browser requests a page, our hosting provider Cloudflare necessarily processes network information such as your IP address, requested URL, request time, browser and operating system information, response status and technical error information. This is used to deliver pages, protect the service, diagnose failures and prevent abuse. It is collected automatically through the connection. Operational logs and traces are different from advertising or behavioural analytics; the absence of tracking scripts does not mean that no connection data is processed.

Language. The home page reads your browser’s language preference and, if present, the language you previously selected. Selecting a language saves a first-party cookie named peko_lang. It contains a language code, not a personal identifier. See the cookie policy.

Messages you choose to send. Clicking an email link opens your email application; the website does not submit a form or upload attachments. If you send an email, we receive your email address, display name, message, attachments and normal email metadata. We use these to answer your enquiry, provide support, assess a rights or copyright request, or consider an application you send to us. Sending a message does not subscribe you to marketing.

Please do not include a child’s name, photographs, voice recordings, parent PIN, passwords or a complete world backup. Describe the issue first. We request additional information only when necessary for the particular enquiry.

4. Legal grounds

Where Turkish Law No. 6698 (KVKK) applies, necessary delivery and security processing relies on our legitimate interest in operating a safe website, subject to your fundamental rights (Article 5(2)(f)). Replying to an enquiry may also be necessary for steps you request before a contract (Article 5(2)(c)). Rights requests and records needed to establish, exercise or defend a right rely on Articles 5(2)(ç) and 5(2)(e), as applicable.

Where the GDPR or UK GDPR applies, the corresponding grounds are legitimate interests in operating and protecting the site and responding to enquiries (Article 6(1)(f)), requested pre-contractual steps (Article 6(1)(b)), and compliance with applicable legal duties (Article 6(1)(c)). We weigh these interests against your rights, particularly where children are involved.

The language preference serves the function you request when choosing a language. You may use the site without it. This notice is information about processing; reading it is not blanket consent to unrelated data uses. If a new purpose requires consent, we will request it separately before starting that processing.

5. Recipients and international processing

Cloudflare provides hosting, delivery and security. The email service used for our mailboxes processes messages for delivery and storage. Authorised people handling support may access only the information needed for the request. We may disclose relevant information to competent authorities or professional advisers where required by law or necessary to establish or defend legal rights. We do not send support messages to advertising networks.

Cloudflare operates internationally, including in the United States. An email may also be processed outside your country depending on the sending and receiving providers. A service provider’s location or privacy policy alone does not establish that a transfer is lawful. Where a transfer requires safeguards under KVKK Article 9, the GDPR or UK GDPR, those safeguards must be established for that transfer. Contact us for the applicable provider and transfer information. No claim that a particular contract has been signed or notified is made by this notice.

Cloudflare explains its own processing in its privacy policy. App stores and other sites you open from our links have their own notices; they are responsible for their own services.

6. How long data is kept

• Language cookie: up to one year from the most recent language selection, or until you delete it. Choosing again renews that period.
• Website operational logs and traces: Cloudflare Workers’ standard retention is three days on Free and seven days on Paid. We do not configure an additional log archive in this website. Cloudflare’s separate security and network records follow the applicable service settings and its policies.
• Support and rights correspondence: only for the time needed to resolve the enquiry, normally no longer than two years after closure, to document the response and protect legal rights.
• Unsuccessful job enquiries: for the recruitment discussion and normally no longer than six months after it ends. Keeping an application for future opportunities requires a separate agreement with you.
• A specific legal dispute or statutory obligation: relevant records may be kept for the necessary legal period, with access restricted, and deleted when that reason ends.

We do not promise deletion of mail held independently by the sender or of copies that a third party controls. We explain any lawful retention exception when responding to a deletion request.

7. Children and families

The website explains a creativity app designed primarily for ages 6–12. It does not ask children to register, submit creations or provide contact information. Parents and guardians should handle support messages. If a child sends personal information unnecessarily, contact us so that we can assess and remove it where appropriate.

This website’s limited functions do not change the app’s data practices. Read the children and families guide for the app’s privacy settings, local storage and parental controls.

8. Your rights

Subject to the law that applies, you may request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, and withdraw any consent you have given. Withdrawal does not affect lawful processing before withdrawal. We do not make decisions with legal or similarly significant effects solely through automated processing.

Under KVKK Article 11, you may also learn whether and why data is processed, whether it is used for its stated purpose, and to whom it is transferred; request notification of correction or deletion to recipients; object to an adverse result from solely automated analysis; and seek compensation for damage from unlawful processing.

Write to privacy@pekogames.com with the subject “Website privacy request”, the right you wish to exercise and enough information to locate the relevant correspondence. Do not send identity documents in your first email. We may request proportionate verification if necessary. The support guide explains formal KVKK application routes. Technical logs may not contain enough information to reliably identify a particular visitor; we do not collect extra tracking information solely to identify you.

KVKK requests are answered within 30 days; GDPR requests normally within one month, with any permitted extension and its reason communicated within that first month. Requests are normally free; exceptions apply only where the law permits. You may complain to the Turkish Personal Data Protection Board after the required controller application, or to the competent EEA authority or UK ICO, as applicable. In Türkiye, the usual complaint deadlines are 30 days from learning of the response and in any event 60 days from the controller application.

9. Security and changes

We use HTTPS and browser security headers and limit access to operational services. No internet service can guarantee absolute security. Report a suspected vulnerability through the contact page; do not include other people’s personal information.

The date at the top identifies this version. If the site adds a contact form, newsletter, analytics service or another material processing purpose, we will update this policy and apply any required choices before enabling it. The legal centre links to all current documents.