Scope: NOXSIGN Player application (Android, Windows).
This notice has been prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the related Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
1. Data Controller
Trade name: İSKAY BİLİŞİM — İSKAY SOFT
Authorised person: Derya Kaygusuz
Address: Medrese Mah. Fevzi Çakmak Cad. Ay Apt. No: 11/A, 40100 Merkez / Kırşehir, Türkiye
Tax office: Kırşehir
E-mail: destek@iskaysoft.com
2. Categories of Personal Data Processed
2.1. Transaction security data: Pairing key and hardware identifier derived from the device's hardware details, device model, operating system version, application version, connection IP address, connection date and time.
2.2. Customer transaction data: Licence number, licence status, licence start and end dates, usage duration records.
2.3. Account data (when an optional account is opened): E-mail address, name, a one-way verifier digest of the password derived on the device (the password itself is not processed), the name, platform, hardware identifier and last-seen time of devices linked to the account, account licence status and device limit, and the IP address used when the account was opened.
2.4. The broadcast source details you enter into the application (address, user name, password) and your viewing history are not processed in readable form by the data controller; they remain on your device. If you use an account, your source list is stored only as a package encrypted with a key that exists solely on your devices; the data controller cannot decrypt this package.
3. Purposes of Processing
3.1. Determining and verifying which device a licence belongs to.
3.2. Preventing misuse, unauthorised duplication and sharing of licences.
3.3. Performing contractual obligations, providing support and resolving faults.
3.4. Delivering software updates and monitoring version compatibility.
3.5. Ensuring information security and fulfilling legal obligations.
3.6. Verifying the identity of a user who opens an account, linking their devices to the account and syncing the encrypted source package between those devices.
4. Legal Grounds
4.1. KVKK Art. 5/2-c: Processing is directly related to the conclusion or performance of a contract (licence verification, support).
4.2. KVKK Art. 5/2-ç: Processing is mandatory for the data controller to fulfil a legal obligation (record-keeping obligations).
4.3. KVKK Art. 5/2-f: Processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (preventing licence misuse, information security).
5. Method of Collection
5.1. Data is collected electronically and by partly automated means through the device on which the application runs.
5.2. Collection takes place during the licence verification performed at application start-up and at regular intervals, during update checks and, if an account is used, during registration, sign-in, device pairing and source syncing.
6. Transfers
6.1. Your personal data is processed on servers located in Türkiye and operated by İskay Soft.
6.2. Data is not transferred to third parties for advertising, marketing, profiling or sales purposes.
6.3. Transfers may be made only to legally authorised public authorities, within the procedures and limits prescribed by law.
6.4. No personal data is transferred abroad.
7. Retention
7.1. Records relating to the licence relationship are kept for its duration and thereafter for the applicable limitation periods.
7.2. Connection and transaction security records are kept for the period required by law.
7.3. Account data is kept for as long as the account remains open; when a device is removed from the account, that device's record is deleted. Upon a deletion request the account, its linked devices and the encrypted source package are deleted.
7.4. Data whose retention period has expired is deleted, destroyed or anonymised.
8. Rights of the Data Subject
8.1. Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom the data has been transferred domestically or abroad; request correction if the data is incomplete or inaccurate; request erasure or destruction; request that correction or erasure be notified to third parties to whom the data was transferred; object to a result that is against you arising from analysis solely by automated systems; and claim compensation for damage suffered due to unlawful processing.
8.2. You may submit your requests in writing to the address above or by e-mail to destek@iskaysoft.com. Your application will be concluded as soon as possible and in any event within thirty days, depending on the nature of the request.
8.3. If your application is rejected, the response is found insufficient, or no response is given in time, you have the right to lodge a complaint with the Turkish Personal Data Protection Board.
9. Processing Not Requiring Explicit Consent
9.1. The processing described in this notice relies on the legal grounds set out above and therefore does not require separate explicit consent.
9.2. Should processing requiring explicit consent be introduced in the future, it will be brought to your attention separately and clearly, and will not begin without your consent.