Turkish Law No. 6698 · Statutory Data Controller Clarification Notice
KVKK Statutory Privacy Notice
This notice describes personal data processing by the operator of CSRadar under Turkish Law No. 6698 (“KVKK”). Its contents must match the actual operator, services, providers and deployment used when the service is public.
Effective Date: 11 October 2026 · Version 2.3
1. Identity of the Data Controller
In accordance with KVKK Article 3/1-(ı), the Data Controller determining the purposes and means of processing personal data is CSRadar.
The controller's legal name and postal address are not configured in this build. Configure both before public launch.
Data subject requests may be submitted by email to [email protected].
2. Categories of Processed Personal Data
CSRadar processes the following categories of data in connection with its player intelligence and smurf-detection operations:
A. Identity & Profile Metadata
SteamID64 (64-bit unique numerical identifier), public persona name, Steam vanity URL, public FACEIT nickname, FACEIT level, and competitive ELO rating.
B. Visual Signatures & Avatars
Public profile avatars and, where the scan feature uses them, computed image hashes used as one possible similarity signal.
C. Telemetry & Network Signals
Public Steam friend-list connections, public group memberships, total hours played, account creation age, VAC and game ban records, and spatial replay telemetry extracted from public match demos (.dem).
D. Session & Communication Records
HttpOnly authentication session cookies, short-lived human-verification tokens sent to the verification provider, rate-limit signals, and email communication details included in support or rights requests.
3. Purposes of Processing Personal Data
Depending on the feature used, data may be processed for these purposes:
- Provision of Service: Analyzing competitive CS2 match lobbies, estimating smurf and alt-account linkages using transparent mathematical scoring, and issuing non-punitive player integrity passports.
- Cybersecurity & Abuse Prevention: Guarding platform infrastructure against automated scraping, DDoS attacks, credential stuffing, and bot traffic via rate-limiting mechanisms.
- Dispute Resolution & Rights Fulfillment: Reviewing and processing false-positive disputes, rectification requests, and statutory data erasure demands submitted under KVKK Article 11.
- Compliance with Legal Demands: Fulfilling legally binding disclosure orders issued by competent judicial, administrative, or consumer arbitration authorities.
4. Collection Methods and Legal Grounds under KVKK Article 5
Data is collected through account and contact forms, Steam OpenID sign-in, public Steam endpoints, public FACEIT endpoints when enabled, and match demo files submitted for analysis.
The legal ground depends on the data and purpose. Where the conditions are met, this may include processing necessary to perform a contract (KVKK Article 5/2-c), data made public by the data subject (Article 5/2-d), or a documented legitimate interest that does not override the data subject's rights (Article 5/2-f). A legal-obligation ground applies only where a specific law requires the processing (Article 5/2-ç). These grounds are not blanket permission for every data category or feature.
How legal grounds are applied
The operator must identify the applicable ground for each processing purpose and retain the supporting assessment. Public availability alone does not make every later use lawful.
5. Data Transfers and Security Safeguards
The repository does not establish the live production host, data-center region, provider contracts, international transfer mechanism, or active backup lifecycle. The operator must confirm and publish the actual recipients, locations and transfer safeguards before production processing begins.
This codebase contains an encrypted backup path to a configurable object-storage provider, but it does not prove that a particular provider, region, certification, retention period or data-transfer arrangement is active. Deleted records may remain in backups until the configured storage lifecycle removes those copies.
6. Rights of the Data Subject under KVKK Article 11
Pursuant to Article 11 of KVKK, you possess the right to:
- Learn whether your personal data is being processed,
- Request information if personal data has been processed,
- Learn the purpose of the processing and whether data is used in accordance with its purpose,
- Know the third parties to whom personal data is transferred domestically or internationally,
- Request rectification of incomplete or inaccurate data,
- Request erasure or destruction of personal data under statutory conditions,
- Object to the occurrence of a result against you through analyzing data exclusively via automated systems,
- Claim compensation for damage in case of unlawful processing of personal data.
Application Procedure:
To exercise your statutory rights, submit a request using the privacy contact details configured above. Your request will be handled within the statutory period applicable to the request. The contact channel and controller details shown on this page must be configured and monitored before public launch.