Privacy and Personal Data
Last updated:
This notice explains how personal data is processed through Spora Başla (sporabasla.tr) under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
Data controller
The data controller is Bumba Teknoloji Limited Şirketi, Ataşehir / Istanbul, Türkiye. Spora Başla is a product of Bumba Life, part of Bumba Group.
Contact and data protection requests: bilgi@bumbagroup.com
What we process
| Data | When / why | Kept for |
|---|---|---|
| Email address, full name, password (stored only as a one-way hash) | When you sign up; to create your account and let you sign in | Until you delete your account |
| Google account details (email, name, profile photo URL, Google user ID) | When you sign in with Google; to recognise your account | Until you delete your account |
| Session record (hash of a random key, creation and expiry time) | When you sign in; to keep you signed in | Up to 30 days; removed when you sign out |
| Email verification and password reset links | On sign-up and password reset; single-use and time-limited | Deleted once expired |
| Forum topics and replies, comments, coach reviews (what you write and your display name) | When you post; to publish it. This content is public | Until you delete your account (see account deletion) |
| Coach photos you upload | When you upload; to show them on the coach page | Until you or your account are deleted |
| Saved sports and Sport Finder answers (child's age, height/build group, preferences) and recommendations | Only if you are signed in; to show them in your profile | Until you delete your account |
| Partnership and application forms (name, email, phone, organisation, message) | When you submit a form; to reply to you. Not stored in our database — forwarded by email to bilgi@bumbagroup.com | As long as your request requires |
| Achievement badges (badge ID and the day it was earned) | If you are a member; to show your saved-sport, forum and comment badges (see "Achievement badges" below) | Until you delete your account; gone from backups within 30 days |
| Site search queries | When you search; to see in aggregate what people look for. Not linked to who you are | As aggregate statistics |
| IP address | To prevent abuse and repeated attempts (e.g. sign-in limits), held only in server memory; also in the hosting infrastructure's technical logs | Briefly in memory; technical logs per infrastructure policy |
Visit statistics (only with your permission)
For visit statistics we use Umami, running on Bumba's own server in Istanbul (istatistik.bumba.tr). Umami only loads if you allow statistics in the cookie banner or in Cookie preferences; if you do not, it never loads. Umami sets no cookies.
With your permission, your browser sends the following on each page visit: the page visited, the referring site, browser, operating system, device type, screen size, language and IP address. Your IP address is not stored; only the country, region and city derived from it are kept. Your visits are grouped under a regularly renewed session ID that does not identify you directly (pseudonymous data).
We also count these actions: sign-up, sign-in, joining the email list, site search, language and theme changes, and earning an achievement badge (the badge ID only). Your name, email or account ID are never sent. The admin panel is not counted.
The legal ground is your explicit consent (KVKK art. 5/1). You can withdraw it at any time from the "Cookie preferences" link in the footer. Shared cookie policy: https://bumbagroup.com/cerez-politikasi?dil=en
Achievement badges
In your browser: Badges you earn while using the site (for example browsing sport pages, finishing the Sport Finder quiz, coming back on consecutive days) are kept only in this browser, under a single local storage key called "sporabasla-rozetler": the ID of each badge earned and the day it was earned (no time), plus the counters needed to work out progress (for example how many times a sport page was opened, how many days in a row you visited and the last day). No list of the pages you opened is kept. This is first-party data and is never sent to the server; it stays until you delete it. You can delete it with the "Delete badges" button on the Badges page or by clearing your browser data. The legal ground is legitimate interest (KVKK art. 5/2-f): the data never leaves your device and you can see and delete it.
In your account: If you are a member, your saved-sport, forum and comment badges are kept in a separate table in your account; the only data processed is the badge ID and the day it was earned. The purpose is to show you your badges and progress; badges are worked out automatically from your actions on the site (the sports you save, your forum posts, your comments). Badges are part of the service as described in the Terms of Use; the legal ground is performance of a contract (KVKK art. 5/2-c). Your badges are never shown to other users. They are kept while your account is open; they are deleted when you delete your account and are gone from backups within 30 days.
From browser to account: When you sign in, the badges in your browser do not move to your account by themselves. If you press "Add this browser's badges to my account" on the Badges page, only the badge IDs and days are sent; the badges and counters in the browser are then deleted.
Umami: If you allowed statistics, we count which badge was earned the first time it is earned; like page visits, this is recorded with browser, device, country and city information. No name, email or progress is sent.
External content (only with your permission)
Videos on sport pages (YouTube, youtube-nocookie.com), the Nearby Facilities map (Google Maps), sample coach photos (randomuser.me and loremflickr.com) and the profile photo of people who sign in with Google come from other companies' servers. They only load if you allow external content in the cookie banner or in Cookie preferences; otherwise a placeholder is shown.
When they load, your browser connects to those companies' servers: your IP address and browser details go to them and may be processed under their own policies, outside Türkiye. The legal ground is your explicit consent (KVKK art. 5/1), which also covers this transfer abroad and can be withdrawn at any time.
Email list
Joining the newsletter is separate from membership and needs its own consent. The list is run by Bumba Group's shared email list service, which has its own privacy notice: https://bumbagroup.com/liste/aydinlatma?dil=en
Purposes and legal grounds
- Membership, sign-in and account actions — establishing and performing a contract (KVKK art. 5/2-c)
- Publishing content you share — performance of a contract; you initiate the publication
- Security, preventing abuse and improving the service — legitimate interest (KVKK art. 5/2-f)
- Replying to requests and applications — pre-contractual steps and legitimate interest
- Meeting legal obligations — KVKK art. 5/2-ç
Service providers we share data with
We do not sell your personal data or share it for advertising. To run the service we use these providers:
- Hosting: Netverim (Istanbul, Türkiye) — website and database
- Automated emails (account verification, password reset, form notifications): Resend — your email address and the message content are passed to it for delivery; its servers may be outside Türkiye
- Sign in with Google: Google — only if you choose that method; outside Türkiye
- Nightly backups: Cloudflare R2 — backups of the database and uploaded files; may be outside Türkiye
- Mailbox: Google Workspace (bilgi@bumbagroup.com) — form notifications and your requests
- Only if you allow external content: YouTube and Google Maps (Google), randomuser.me, loremflickr.com — see "External content" above; outside Türkiye
Deleting your account
You can delete your account from the My Account page. Your account, sessions, saved sports, quiz results, achievement badges, comments, coach reviews and uploaded photos are then deleted, and are gone from backups within 30 days. Your forum topics and replies stay so that other people's conversations remain intact, but your display name is changed to "Silinmiş üye" (Deleted member) and they are no longer linked to your account.
Your rights (KVKK art. 11)
Send your requests to bilgi@bumbagroup.com.
- To learn whether your personal data is processed and, if so, to request information about it
- To learn the purpose of processing and whether it is used for that purpose
- To know the third parties in Türkiye or abroad to whom it is transferred
- To ask for incomplete or incorrect data to be corrected
- To ask for deletion or destruction under the conditions in KVKK art. 7
- To ask that corrections and deletions be notified to the third parties it was transferred to
- To object to an outcome against you that results solely from automated analysis
- To claim compensation for damage caused by unlawful processing
Children
Spora Başla is meant for parents; membership and posting are for adults. Information you give about your child in the Sport Finder quiz (age, height/build group, preferences) is used only to produce recommendations and is saved to your account only if you are signed in.