UniClub

KVKK Privacy Notice

Last updated: 1 October 2026

This notice explains, under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK), how your personal data is processed when you use UniClub. It is not a contract or a consent form; it is here to inform you.

Processing based on explicit consent (keeping your name on a club’s list after you delete your account, and Google Analytics on the website) is asked for separately. You can use the service in the same way without giving it.

Short summary: Privacy Policy · How to delete your account

Data controller
Data, purposes, legal bases, periods
How data is collected
Who receives it
Service providers abroad
Cookies
Your rights
Requests and complaints
Other

1. Data controller

Data controller: Can Önder (individual) — UniClub
Istanbul, Türkiye · club.uniclub@gmail.com

UniClub is an independent project and is not officially affiliated with any university. A school email is required only to verify that you are a student.

2. Data processed, purposes, legal bases and retention

Legal bases follow KVKK Art. 5: formation and performance of a contract (5/2-c), legal obligation (5/2-ç), establishing, exercising or protecting a right (5/2-e), legitimate interest (5/2-f) and explicit consent (5/1).

Account and sign-in

Data: Your school email address, user ID (uid), sign-in method (Google, email code or password) and email verification status. Your password is stored only in encrypted form by Google’s authentication service; we cannot see it.
Purpose: Creating your account, signing you in, verifying that you are a student; sending account-related information emails (e.g., a one-time email explaining how to sign in to the app once an account opened at a stand is ready).
Who sees it: Only you.
Legal basis: Formation and performance of a contract (Art. 5/2-c).
How long: Until your account is deleted.

Profile and UniPoints

Data: First and last name, student number, faculty, department, year, phone number; optionally a profile photo and gender; your UniPoints and point records; people you follow; settings such as “Hide my name in rankings”.
Purpose: Showing your profile, running club and event features, operating the points system.
Who sees it: Your name, photo, faculty, department, year, gender (if you entered it), the clubs you belong to and your UniPoints are visible to other users of the app. Your student number and phone are not visible to other users; when clubs see them is described below.
Legal basis: Art. 5/2-c. Filling in optional fields is your choice.
How long: Until your account is deleted. You can edit optional fields at any time.

Club membership (app and stand QR)

Data: Your membership status and date; the first and last name, student number, email, phone, faculty, department and year copied onto the membership record; your answers to the club’s questions; how many of the club’s events you attended; where the sign-up came from (app or stand).
Purpose: Running your membership; letting the club manage its member list, contact you and send announcements.
Who sees it: Only that club’s managers. They can download the list as an Excel file (see section 4).
Legal basis: Art. 5/2-c.
How long: While you are a member. If you leave or are removed, you drop off the club’s list; the record stays inactive until your account is deleted. Deleting your account deletes it completely; the only exception is the consent below.

Your name on a club’s list after account deletion (optional explicit consent)

Data: Only your first and last name and the date you joined the club. Your email, phone, student number, faculty, department and answers are still deleted.
Purpose: Letting the club keep a record of past members.
Who sees it: Only that club’s managers. The record is labelled “account deleted”, is not counted in the member total and cannot be linked to your account.
Legal basis: Explicit consent (Art. 5/1). Asked on the stand form with a separate, unticked, optional box, per club, apart from the terms of use. Your sign-up completes without it.
How long: Until you withdraw consent or the club removes the record; in any case at most 2 years after your account is deleted. It is then deleted automatically.

You can withdraw your consent at any time by emailing club.uniclub@gmail.com or asking the club. If your account still exists, the consent is removed and your name will be deleted too if you later delete your account; if your account is already deleted, the record is deleted right away. Withdrawal does not make earlier processing unlawful.

Event registration, tickets and check-in

Data: Your registration and waitlist status, ticket, and QR check-in time.
Purpose: Managing your registration and entry, preparing the club’s attendee list.
Who sees it: The organising club’s managers and check-in staff: your name, student number, faculty, department, registration and check-in status. They can export it to Excel.
Legal basis: Art. 5/2-c.
How long: Until your account is deleted.

Events with applications and UniClub Form

Data: Your answers to the club’s questions; the name, student number, email, phone, faculty, department and year copied onto the application; its status (pending, approved, rejected), where it came from (app or web form) and whether you were a member of the club at the time. On the web form shared by the club (UniClub Form, uniclubapp.com/forms/…): the email verification code at sign-in (only an encrypted form is stored, never the code itself; valid for 10 minutes). If you have no account, one is opened with the details on the form; if you do, details you change on the form are also written to your profile.
Purpose: Letting the club assess your application; confirming by email that it was received and, if you cannot receive notifications, emailing you the club’s decision.
Who sees it: Only that club’s managers. If the club connects one, the application details (except sensitive answers) are also written to the club’s Google Sheet (Google, abroad).
Legal basis: Art. 5/2-c.
How long: Until your account is deleted. Verification code at most 1 day.

UniClub Form sensitive questions

Data: Your answers to questions the club marked as “sensitive” (e.g. health conditions, allergies, ID number). Health information is special category personal data.
Purpose: Letting the club run the event safely and within the rules (e.g. health precautions, an insurance list).
Who sees it: Only that club’s managers. It does not appear on UniClub’s admin screens; the application list shows a lock in its place.
Legal basis: Explicit consent (Art. 6 and Art. 5/1). Asked on the form with a separate, unticked box, apart from the other consents. Without consent you can’t answer the sensitive question; if the club made it required, the application can’t be completed.
How long: Deleted automatically 30 days after the event ends; if the event is postponed, the period follows the new date. Deleted immediately if you delete your account.

Applying from outside the university (UniClub Form, guest)

Data: If the club opened the event to applicants from outside the university: your email address, first and last name, your phone number if the club asks for it, your answers to the club’s questions and the status of your application (pending, approved, rejected). The email verification code at sign-in (only an encrypted form is stored, never the code itself; valid for 10 minutes) and a short-lived session key so you can fill in the form (kept in your browser; we store only an encrypted form). No UniClub account is opened; you can’t sign in to the app.
Purpose: Letting the club review your application; telling you by email that it was received and what the club decided; adding you to the club’s participant list and checking you in at the event if you are approved.
Who sees it: Only that club’s managers and check-in staff. If the club connects one, the application details (except sensitive answers) are also written to the club’s Google Sheet (Google, abroad). The club can download the list as an Excel file.
Legal basis: Art. 5/2-c.
How long: Kept in the club’s application and participant records. To have it deleted, write to club.uniclub@gmail.com from the email address you applied with. The verification code (valid for 10 minutes) and the session key (valid for 12 hours) are deleted within 2 days at the latest. Answers to sensitive questions are deleted 30 days after the event, as above.

Event form

Data: Your answers to the form you fill in after being checked in; name, student number and submission time.
Purpose: Letting the club collect feedback or information about the event. Filling in the form is optional.
Who sees it: Only that club’s managers; they can export it to Excel.
Legal basis: Art. 5/2-c.
How long: Until your account is deleted.

Announcements: likes, comments, forms, reports

Data: Your likes, comments, answers to announcement forms and the reports you file; a comment ban record in case of abuse.
Purpose: Interacting with announcements and content moderation.
Who sees it: Your comments are public together with your name. Form answers are seen by the club that posted the announcement. Reports are seen only by UniClub’s administrator.
Legal basis: Art. 5/2-c; for reports and bans, legitimate interest (Art. 5/2-f).
How long: Until your account is deleted. A report remains for moderation, but its link to you is removed when your account is deleted.

Event ratings

Data: The score and comment you give to an event you attended.
Purpose: Measuring event quality.
Who sees it: The club sees the ratings; your score counts toward the event’s average.
Legal basis: Art. 5/2-c.
How long: Until your account is deleted.

In-event game (RUSH)

Data: Your answers, score, number of correct answers and display name.
Purpose: Running the quiz at the event and showing the leaderboard.
Who sees it: Attendees of the same event see the leaderboard; the club sees the results and can export them to Excel.
Legal basis: Art. 5/2-c.
How long: Until your account is deleted.

Daily games (UniWord, UniBlast)

Data: Your guesses or moves, score and time; the club you chose if you play for a club.
Purpose: Running the games and leaderboards.
Who sees it: Leaderboards show your first name and last initial (e.g. “Can Ö.”). With “Hide my name in rankings” in Settings you appear as “Hidden student”.
Legal basis: Art. 5/2-c.
How long: Until your account is deleted.

Notifications

Data: Your device’s push token, your notification preferences and the notifications sent to you.
Purpose: Event reminders, club announcements, membership and registration updates; sponsored campaign notifications if you are in the target audience.
Who sees it: Notifications are delivered through Expo, Apple and Google push services (see section 5).
Legal basis: Art. 5/2-c. You can turn notifications off in your phone’s settings at any time.
How long: Until your account is deleted.

Stand QR sign-up

Data: The details on the form (written to your membership and profile, see above); the email verification code at sign-in (only an encrypted form is stored, never the code itself; valid for 10 minutes); your email and name for the welcome and set-password email. So that the next club’s form is pre-filled on the same phone, these details are also kept in your own browser. A technical measurement is also kept to see where the form gets stuck: browser, operating system, user-agent string, a randomly generated session number and the club. Your name, email, student number and user ID are never written to it.
Purpose: Fast sign-up and sign-in at the stand, setting up your account, finding problems with the form.
Who sees it: The form details go to the club (see “Club membership”). Only UniClub sees the measurement.
Legal basis: Art. 5/2-c for the form, code and emails; legitimate interest (Art. 5/2-f) for the measurement.
How long: Verification code at most 1 day, welcome email record at most 30 days, measurement 30 days. The record in your browser disappears when your session ends or you clear browser data.

Security and abuse prevention

Data: IP address, browser and device information, server request logs, rate-limit counters, Google reCAPTCHA / Firebase App Check signals.
Purpose: Protecting your account and the service; preventing spam, fake sign-ups and automated attacks; debugging.
Who sees it: Only UniClub and the relevant infrastructure providers.
Legal basis: Legitimate interest (Art. 5/2-f); establishing, exercising or protecting a right (Art. 5/2-e).
How long: Server logs at most 30 days.

Support and KVKK requests

Data: Your email address, correspondence and request.
Purpose: Answering your request and keeping a record of KVKK requests.
Who sees it: Only UniClub.
Legal basis: Legal obligation (Art. 5/2-ç) and Art. 5/2-c.
How long: At most 2 years after the request is closed.

Club manager accounts

Data: The club’s email account, club profile, published events and announcements.
Purpose: Letting the club manage events and announcements in the app.
Who sees it: Club profiles and published content are public.
Legal basis: Art. 5/2-c.
How long: Until the club account is deleted.

We do not ask for special categories of personal data (health, religion, political opinion, biometric data and the like); please do not write such information in answers to club questions. Membership of some clubs (e.g. faith- or opinion-based clubs) may hint at such information; only that club sees these records.

3. How data is collected

Your data is collected electronically: from what you enter in the mobile app, on the website and on the QR form at club stands; from your Google account (name and email) if you sign in with Google; and automatically while you use the service (device and connection information, push token, server logs, and Analytics if you consent). The legal basis of each activity is listed in section 2.

4. Who receives it

Club managers and check-in staff: the club you are a member of, registered with or applied to; only the details listed in section 2. The club can download these lists as Excel files; a downloaded file is stored on the club’s device and is no longer under UniClub’s control. We ask clubs to use this information only for the club’s membership and event work. You can ask the club or us to have a record deleted from downloaded files as well; we will pass the request on to the club.
Other users: the public part of your profile, your comments, RUSH and daily game leaderboards (section 2).
Sponsoring businesses: only if you claim a coupon — the coupon and your display name.
Authorised public bodies: where required by law, to the extent requested (Art. 5/2-ç).
Service providers abroad: section 5.

Your data is not sold and is not shared with ad networks.

5. Service providers abroad

UniClub has no servers of its own; the service runs on the infrastructure of the providers below. Your data is therefore processed and stored outside Türkiye. Providers process data to deliver the service; their own privacy policies also apply.

Provider	Used for	Location
Google — Firebase Authentication	Account and sign-in	USA (global)
Google — Cloud Firestore	Database	EU (Belgium, Netherlands)
Google — Cloud Functions	Server processing	EU (Belgium)
Google — Cloud Storage	Profile photos, club and event images	USA
Google — reCAPTCHA / App Check	Security checks on the website	USA
Google — Analytics	Site statistics (only with your consent)	USA
Google — Gmail	Support email	USA
Google — Sheets	Writing the application list to the club’s Google Sheet, if the club connects one	USA
Expo (650 Industries)	Push notification delivery	USA
Apple (APNs), Google (FCM)	Delivering notifications to your phone	USA
Resend	Sending email (verification code, welcome, account and application information)	USA
Vercel	Website hosting	USA and global
Apple App Store, Google Play	App distribution	Their own policies

6. Cookies (website)

Necessary (no consent needed): keeping you signed in (browser storage), security checks (Google reCAPTCHA / Firebase App Check) and your cookie preference. Sign-in and forms do not work without them.
Analytics (optional): Google Analytics — which pages are opened, device and browser information, approximate location and a cookie ID. It loads only if you consent (explicit consent, Art. 5/1) and never on the stand sign-up page. Google Analytics keeps this data for at most 14 months.
You can change your choice at any time with “Cookie settings” at the bottom of every page; withdrawing consent deletes the Analytics cookies.
The mobile app does not collect advertising IDs (IDFA/AAID) and uses no third-party advertising or analytics tools.

7. Your rights (KVKK Art. 11)

Under Article 11 of the KVKK, you can apply to UniClub to exercise these rights:

Learn whether your personal data is processed
Request information if it has been processed
Learn the purpose of processing and whether the data is used accordingly
Know the third parties in Türkiye or abroad to whom it is transferred
Request correction if it is incomplete or inaccurate
Request deletion or destruction under the conditions of Article 7 of the KVKK
Request that correction and deletion be notified to third parties who received the data
Object to a result against you that arises solely from automated analysis
Claim compensation if you suffer damage from unlawful processing

Where processing is based on explicit consent, you can withdraw it at any time. You can correct your profile in the app and delete your account yourself via Profile → Settings → Delete my account.

8. Requests and complaints

Send your request to club.uniclub@gmail.com from the email address registered in the app; we will then not ask for further proof of identity. State your name and your request clearly. You can also use the other channels listed in the Communiqué on the Procedures and Principles of Applications to the Data Controller (in writing, registered electronic mail (KEP), secure electronic signature or mobile signature).

We will resolve your request as soon as possible depending on its nature, and within 30 days at the latest. It is free of charge as a rule; if the action involves an additional cost, the fee set by the Board may apply.

If your request is rejected, you find the answer insufficient or we do not reply within 30 days, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your request (Art. 14).

9. Other

Automated decisions: No decision producing a result against you is made solely by automated means. Events and sponsored cards may be shown according to your department; this places no obligation on you.

Age: UniClub is for users aged 13 and over; if you are under 18, you should use it with your parent’s or guardian’s knowledge.

Changes: We may update this notice; the current date is shown at the top. If the scope of processing based on your explicit consent changes, we will ask for consent again. You can request earlier versions by email.