Last updated: 21 October 2026
This notice explains how we process your personal data on playformore.app (the "Site") and in the PFM court calendar on club websites, as required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). It also contains the information required for visitors in the EU, the UK and Switzerland under the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Swiss Federal Act on Data Protection ("FADP"). It is not a consent form: where we need your consent, we ask for it separately.
1. Controller
| Controller | PFM Spor Teknolojileri Organizasyon ve Gıda Ticaret Anonim Şirketi ("PFM", "we") |
|---|---|
| Address | Barbaros Mah. İran Cad. No: 17/17, 06680 Çankaya/Ankara, Türkiye |
| Trade registry | Ankara Trade Registry, MERSİS no. 0729127011900001 |
| Tax office / no. | Kavaklıdere / 7291270119 |
| E-mail (also for privacy requests) | info@playformore.app |
| Phone | +90 532 216 86 13 |
We are exempt from registration in VERBİS, the Turkish data controllers' registry (Board decision 2023/1154). For our processing, the law does not require us to appoint a data protection officer or a representative in the EU, the UK or Switzerland (GDPR and UK GDPR Art. 27(2)(a) and 37; FADP Art. 14). You can write to us directly, in English.
2. Scope
This notice covers visitors to the Site, people who use the contact or club registration form, people who write to us by e-mail, and people who book a court online on the Site or on a club's website.
It does not cover the PFM mobile app, which has its own privacy notice; the club's use of your booking for its own business (the club is a separate controller and its own notice applies); or the member and customer data that clubs enter in the PFM panel (there PFM processes data on the club's behalf).
3. What we process, why, and on what legal basis
The tables give the legal basis under KVKK (Art. 5) and, for visitors in the EU and the UK, under the GDPR (Art. 6). For Swiss residents the same grounds apply under the FADP.
3.1 Visiting the Site: server logs and security
Our server records your IP address, the time of your visit, the page opened and your browser details. When you ask for a booking code or send a form, Cloudflare Turnstile processes your IP address and technical browser details to check that the request comes from a person.
| Purpose | KVKK | GDPR |
|---|---|---|
| Running and securing the Site, preventing misuse and fake bookings | Art. 5(2)(f) legitimate interest | Art. 6(1)(f) legitimate interest |
3.2 Cookie choice and analytics
Your choice in the cookie banner is stored only in your browser. Google Analytics 4 is loaded only if you click "Accept"; otherwise nothing is measured. With your consent we process:
- online identifiers in cookies and your approximate location (country, city) derived from your IP address,
- device, browser, referring page and campaign information,
- usage statistics such as page views, clicks and form submissions (not what you type in forms), and page speed.
Google LLC (USA) processes this data on our behalf; it may also use it as a separate controller to improve its own services (policies.google.com/privacy). Details are in the Cookie Policy. Cookie Policy
| Purpose | KVKK | GDPR |
|---|---|---|
| Remembering and proving your cookie choice | Art. 5(2)(ç) and (f) | Art. 6(1)(c) and (f) |
| Measuring how the Site is used and improving its content and speed | Art. 5(1) explicit consent | Art. 6(1)(a) consent |
You can withdraw your consent at any time under "Cookie settings" at the bottom of every page; this does not affect processing before the withdrawal.
3.3 Online court booking
If the club allows it, you can book a court without an account. You pay the club on site; no card details are processed on the Site. We process:
- Identity and contact: first name, last name, mobile number, e-mail address, Site language
- Booking: club, court, date, time, duration, extras, price, booking code, status, cancellation details and the website on which you booked
- Acceptance and security: the version and time of the texts you accepted, verification and security records
If your e-mail address belongs to a PFM app account, the booking is linked to that account; otherwise a "web guest" record is created.
| Purpose | KVKK | GDPR |
|---|---|---|
| Creating the booking, passing it to the club, sending confirmation, change and cancellation e-mails, providing the management page | Art. 5(2)(c) contract | Art. 6(1)(b) contract |
| Verifying your e-mail address, preventing fake and excessive bookings, keeping your bookings together | Art. 5(2)(f) | Art. 6(1)(f) |
| Keeping proof of the booking and of what you accepted | Art. 5(2)(e) establishing and protecting a right | Art. 6(1)(f) |
Sharing with the club. Your name, contact details and booking go to the club so that it can manage the booking and take payment.
3.4 Contact form and e-mails
Name, e-mail address, phone number (optional), subject, message and time sent; when you write to us, the content of your e-mail and any attachments.
| Purpose | KVKK | GDPR |
|---|---|---|
| Answering demo, quote and plan requests | Art. 5(2)(c) | Art. 6(1)(b) |
| Answering other questions and keeping the correspondence | Art. 5(2)(e) and (f) | Art. 6(1)(f) |
The "I have read" box in the form only confirms that you were informed; it is not consent.
3.5 Club registration form
Club name, country, city, sports and number of courts; the applicant's name, role, phone number and e-mail address; message; the version and time of the texts accepted. When you register, the club is created in PFM with the status "setting up" and a sign-in link to the club panel is sent to you.
| Purpose | KVKK | GDPR |
|---|---|---|
| Opening the club account, reviewing and publishing the club, contacting you, preparing an offer and a contract | Art. 5(2)(c) and (f) | Art. 6(1)(b) and (f) |
| Keeping proof of the accepted terms | Art. 5(2)(e) | Art. 6(1)(f) |
3.6 Job applications
We process the e-mail and CV you send to hr@playformore.app. Please do not include special categories of data (for example health, religion, political opinions, trade union membership or criminal records).
| Purpose | KVKK | GDPR |
|---|---|---|
| Assessing your application and contacting you | Art. 5(2)(c) and (f) | Art. 6(1)(b) |
| Keeping your application for future vacancies | Art. 5(1) explicit consent (asked separately) | Art. 6(1)(a) consent |
3.7 Maps
The Google Map on club pages and the OpenStreetMap map on city pages load only if you click "Load map". Your browser then connects to Google (including in the USA) or to the OpenStreetMap Foundation (UK), which receive your IP address and browser details. The note next to the button tells you this; clicking is your consent.
| Purpose | KVKK | GDPR |
|---|---|---|
| Showing the club's location on a map when you ask for it | Art. 5(1) explicit consent | Art. 6(1)(a) consent |
4. How we collect data
Electronically and partly automatically: through forms and booking steps, server logs, browser storage, cookies and e-mail. Without the required fields we cannot provide a booking or answer a form; consent to analytics and maps is optional.
5. Who receives your data
- The club you book with, as a separate controller (KVKK Art. 8(2)(a), Art. 5(2)(c)).
- GNET İnternet Telekomünikasyon A.Ş. (Istanbul): data centre and encrypted backup server; it has no access to the content.
- Cloudflare, Inc. (USA): bot check.
- Google LLC (USA): if you consent to analytics or load a club map.
- OpenStreetMap Foundation (UK): if you load a city map.
- Authorities and courts, where the law requires it; our lawyers and accountants, where needed to protect our rights or meet legal duties.
6. International transfers
Under KVKK. For the USA and the UK there is no adequacy decision of the Turkish Personal Data Protection Board and no appropriate safeguard, so data goes there only under KVKK Art. 9(6), in these cases:
- Google Analytics and the maps: on your explicit consent, given after being told of the risks (Art. 9(6)(a)). The risk is that these countries may not protect your data to the level of Turkish law and that you may find it harder to exercise your rights there. You can avoid the transfer by not accepting analytics and not loading the maps.
- Cloudflare Turnstile: because it is necessary for the booking or request you make (Art. 9(6)(b)). If you do not want this, you can book by calling the club.
For visitors in the EU, the UK and Switzerland. Data you send us reaches PFM in Türkiye directly, and the GDPR applies to our processing directly. Transfers to Google and Cloudflare rely on the EU-US Data Privacy Framework and its UK and Swiss extensions (both companies are certified); the transfer to the OpenStreetMap Foundation relies on the EU's adequacy decision for the UK.
7. How long we keep data
| Data | Period |
|---|---|
| Server, error and security logs | Up to 90 days |
| Online bookings, contact messages and e-mails | 2 years; for the legal period if they become part of a contract |
| Club registrations | 2 years if no contract follows; with a contract, 10 years after it ends (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253) |
| Job applications | 6 months after the process ends; 2 years with your consent |
| Cookie choice and analytics | The periods in the Cookie Policy |
When a period ends, the data is deleted, destroyed or anonymised; copies in backups are deleted in the normal backup cycle. Data needed for an ongoing dispute or an official request is kept until it is over.
8. Security
We take appropriate technical and organisational measures to protect your data, including encrypted connections and restricted access.
9. Your rights
Under KVKK Art. 11 you have the right to:
- learn whether your personal data is processed;
- ask for information about it;
- learn the purpose of the processing and whether the data is used for it;
- know the third parties in Türkiye or abroad to whom it is transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for deletion or destruction under KVKK Art. 7;
- ask that the third parties who received your data are told about steps 5 and 6;
- object to a result to your detriment that arises solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
Under the GDPR and the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and not to be subject to a decision based solely on automated processing (Art. 15–18, 20, 22; FADP Art. 25–28, 32). You can object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21). You can withdraw your consent at any time, with effect for the future.
For the club's own use of your booking, you can also contact the club directly.
10. How to make a request
Send your request in writing to our address above, by registered e-mail (KEP), secure electronic signature or mobile signature, or to info@playformore.app from an e-mail address you have already given us (for example the one used for your booking). For a request under KVKK, the Communiqué on Applications to the Controller asks for your name, your signature (for a written request), your Turkish ID number or, if you are not a Turkish citizen, your nationality and passport or ID number, your address, your e-mail address and phone number if any, and your request.
We answer free of charge within 30 days; if a request involves extra cost, a fee under the Board's tariff may be charged. Requests from the EU and the UK are answered within one month at the latest.
Complaints. If your request is rejected, you find the answer insufficient or we do not answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning of our answer and in any case within 60 days of your request (KVKK Art. 14). You can also complain to the data protection authority of the EU/EEA country where you live or work, to the ICO in the UK or to the FDPIC in Switzerland.
11. Visitors in the United States
We do not sell personal information. The Site does not change its behaviour in response to Do Not Track signals; analytics runs only with your consent. The Site is not directed at children under 13.
12. Changes
If our processing changes, we update this notice and its date. The version shown to you when you book or register is stored with that booking or registration.