Privacy Notice

1. Data controller

ThundersFlag Sports Club (“the Club”) acts as data controller within the meaning of Article 3 of Turkish Law no. 6698 on the Protection of Personal Data (“KVKK”). This notice is issued under Article 10 of that Law and covers the processing carried out through thundersflag.com.

For any question or request concerning this notice or your personal data, write to [email protected]

2. Personal data we process

We process the data below only where you fill in one of our forms yourself. Fields not marked as required are entirely up to you.

• Identity data: First name, surname and date of birth in the athlete application; first name and surname in the contact and sponsorship forms.
• Contact data: E-mail address and phone number; for sponsorship enquiries also company name, website and the role of the contact person.
• Sporting assessment data: Height, weight, primary and secondary playing positions, flag football and tackle football experience, and previous club.
• Content you provide: Your application text, message content and, where given, links to your Instagram profile and highlight video.
• Transaction security data: The date and time of the submission, the language of the form, the moment consent was given, an irreversible hash of your IP address and a session cookie record.
• Visit statistics: The page you viewed, its language, the domain you arrived from, and a hash of your IP address that is regenerated every day. These records cannot be tied to a person, nor linked from one day to the next.

3. How the data is collected

Your data is collected electronically and by partly automated means through the athlete application, sponsorship enquiry and contact forms on thundersflag.com. We collect no other visitor data, and the site carries no third-party analytics, profiling or advertising trackers.

In addition, the club runs a simple visit counter on its own server to see which pages draw interest. It sets no cookie and sends nothing to any third party; it records only the page viewed, its language, the domain you arrived from and a hash of your IP address. That hash is regenerated daily, so the same visitor cannot be recognised the next day, and the records are never linked to any person, form or account.

4. Purposes of processing

Your personal data is processed for the following purposes and no others:

• Athlete applications: Assessing your application, inviting you to tryouts and trial sessions, deciding on the appropriate team and position, and contacting you about the process.
• Sponsorship enquiries: Assessing your enquiry, discussing the terms of co-operation and responding to you.
• Contact form: Answering your question and closing your request.
• All forms: Recording the submission, preventing abuse and automated (bot) submissions, keeping the website and the admin panel secure, meeting legal obligations and holding evidence in the event of a dispute.

5. Legal grounds for processing

Processing rests on the following grounds under Article 5 of the KVKK:

a) The explicit consent you give on the form (Art. 5/1). No form can be submitted without ticking the consent box.

b) Processing directly related to the conclusion or performance of a contract (Art. 5/2-c), covering the assessment of your athlete application and the preliminary steps towards membership.

c) Compliance with a legal obligation of the controller (Art. 5/2-ç).

d) The legitimate interests of the controller, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f), covering website security, prevention of abuse and the keeping of records as evidence.

Height and weight are processed solely for sporting assessment and, to the extent they qualify as health data, on the basis of your explicit consent under Article 6. You are not obliged to fill in those fields.

6. Applicants under eighteen

The athlete application form is open to candidates aged 16 and over. For candidates under eighteen, the consent of a parent or legal guardian is required before the process continues. Records found to belong to anyone under sixteen are deleted without delay.

7. Transfer of personal data

Your data is never sold, rented or transferred to third parties for marketing purposes. Transfers take place only as far as the service requires:

• Hosting and e-mail (in Türkiye): The website and database are hosted on servers located in Türkiye. Form notifications reach the club’s mailbox over the same infrastructure. The provider can access the data only as technical maintenance requires.
• Security and content delivery (abroad): The site is served through the infrastructure of Cloudflare, Inc. (USA) for protection against attacks and bot traffic. Connection data (IP address, browser information, request time) and the technical data generated by bot verification on form submissions may therefore be processed on servers abroad. That transfer is made under Article 9 of the KVKK, on the basis of contractual safeguards agreed with the provider and your explicit consent.
• Public authorities: Duly made requests from authorities competent under Turkish law are answered to the extent the legislation requires.

8. Cookies

The site uses strictly necessary cookies only. The session cookie (thunders_sid) secures form submission and prevents the same form being sent twice; it expires when the browser is closed or the session ends.

The security layer may set technical cookies on visits where bot verification takes place, solely so that the check is not repeated. They are never used for advertising, measurement or profiling. There are no analytics or advertising cookies on this site.

The club’s own visit counter sets no cookie either: counting happens entirely on the server and anonymously.

9. Retention and erasure

What you send through a form reaches the club’s mailbox and is stored in the database on the hosting server. Only administrators signed in with two-step verification can reach those records.

Athlete applications are kept for at most 12 months from submission; sponsorship enquiries and contact messages for at most 24 months. Once the period ends, an automated daily task deletes the records from the database.

Transaction security records (hashed IP data and sign-in attempts) are kept for at most 12 months. Copies held in backup media expire within the backup cycle.

Row-level visit statistics are kept for at most 30 days. After that the rows are deleted and only daily totals remain, which contain no visitor information at all.

Where a dispute, an audit or a statutory retention duty exists, the relevant records may be kept for the duration of that duty and for that purpose alone.

10. Security measures

Under Article 12 of the KVKK the Club takes the technical and administrative measures needed to provide an appropriate level of security, to prevent unlawful processing of and access to personal data, and to keep that data safe.

The main technical measures are: encrypted connections across the whole site (TLS), a web application firewall and bot protection, bot verification and rate limiting on form submissions, mandatory two-step verification for the admin panel, account and IP based lockout after failed sign-in attempts, storage of IP addresses only as irreversible hashes, logging of administrator actions, and permissions limited to each person’s role.

11. Your rights

Under Article 11 of the KVKK you may apply to the controller and:

a) learn whether your personal data is processed, b) request information if it has been, c) learn the purpose of processing and whether the data is used accordingly, ç) know the third parties in Türkiye or abroad to whom it is transferred, d) request rectification where it is incomplete or inaccurate, e) request erasure or destruction under the conditions in Article 7, f) request that rectification, erasure or destruction be notified to third parties to whom the data was transferred, g) object to a result against you arising from analysis solely by automated systems, ğ) claim compensation for damage suffered as a result of unlawful processing.

Where processing rests on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

12. How to apply

Send your request in writing together with documents establishing your identity, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, or by e-mail from the address registered in our system to [email protected]

Your request is answered as soon as possible and in any event within thirty days. Where the process entails a cost, the fee set by the Personal Data Protection Board may be charged.

If your request is refused, you find the answer inadequate or no answer arrives in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any event within sixty days of your application (Art. 14).

13. Updates to this notice

This notice may be revised in line with changes in legislation or in the Club’s processing activities. The current version is always published on this page.