Grand G. – Hotel Match — Privacy Policy

Sortis Oyun Yazılım ve Pazarlama Limited Şirketi
Effective Date: 1 October 2026 · Version 4.0

1. Who We Are and What This Policy Covers

We are Sortis Oyun Yazılım ve Pazarlama Limited Şirketi ("Sortis Games", "we", "us"), a company established in the Republic of Türkiye with its registered address at Göktürk Merkez Mah. Kılıncı Göl Sk. No: 7D1 İç Kapı No: 1, Eyüpsultan, İstanbul, Türkiye. We develop and operate the mobile game Grand G. – Hotel Match (the "Game"). We are the data controller of the personal data described in this Privacy Policy.

This Privacy Policy explains how and why we collect, use, store, disclose and otherwise process personal data when you play the Game, visit our websites (including sortisgames.com), interact with our advertisements, or contact our player support (collectively, our "Services"). It does not cover data we collect offline or from job applicants or employees.

Features not yet live. This Policy also describes features we plan to add later: account linking with Apple or Google, Teams, avatars, and player grouping for offer selection. Where we say a feature is "not yet available," we do not currently process any data for it. Before we start, we will update this Policy, notify you in the Game and, where the law requires it, ask for your consent.

If you reside in the United States, please also see our Supplemental U.S. Privacy Statement, which includes our California notice at collection. If you reside in the European Economic Area, United Kingdom or Switzerland ("EEA+"), please also see our EEA+ Privacy Statement. If you reside in Türkiye, please also see our Türkiye (KVKK) Statement. If you reside in Brazil, please also see our Brazil Privacy Supplement; if you reside in the Republic of Korea, our Korea Supplement.

2. The Short Version

The rest of this Policy provides the detail. If anything in this summary conflicts with the detailed sections, the detailed sections prevail.

3. Personal Data We Collect

3.1 Data collected automatically when you play
3.2 Data you provide to us
3.3 Data we receive from others

We do not intentionally collect special categories of personal data (such as health, religion or biometric data) or precise geolocation, and ask that you do not submit such data through support or in-game features.

4. Third-Party Services Operating in the Game

The Game includes software development kits (SDKs) and services from the following partners, each of which may process the data described in Section 3 on our behalf or, where indicated, as an independent controller for its own purposes. Each partner is named below with its role, and links to their privacy policies are kept up to date in the Game under Settings > Terms & Privacy and on our website at sortisgames.com/en/adtech:

5. How and Why We Use Personal Data

We use personal data for the following purposes. (For EEA+ residents, the legal basis for each purpose is set out in our EEA+ Privacy Statement; for Türkiye residents, in our Türkiye (KVKK) Statement.)

We may create aggregated or de-identified data sets from personal data (for example, level win-rate statistics). We maintain and use such data only in aggregated or de-identified form and do not attempt to re-identify it, except as permitted by law to test the effectiveness of de-identification.

6. Advertising, Attribution and Your Choices

6.1 Rewarded advertisements inside the Game

The Game shows optional rewarded advertisements: you may choose to watch a short advertisement in exchange for an in-game reward, up to a daily limit. You are never required to watch an ad to play. Ads are served by Google AdMob. To serve, cap, measure and — only where permitted under Section 6.3 — personalize ads, Google processes device identifiers (GAID or, with your ATT permission, IDFA), IP address, device and app information and ad interaction data as an independent controller; see Google's privacy policy at policies.google.com/privacy and its advertising controls at adssettings.google.com. If you interact with an advertisement, you do so subject to the advertiser's own terms and privacy policy.

6.2 iOS App Tracking Transparency (ATT)

On iOS, neither we nor our partners (Google AdMob, Adjust) access the IDFA or otherwise track you across apps and websites owned by other companies for advertising or measurement purposes unless you have granted permission through Apple's App Tracking Transparency prompt; where the Game requests such tracking, it does so only through that prompt. If you select "Ask App Not to Track," we do not access the IDFA and our partners receive only non-tracking, aggregated measurement. You can change this at any time in iOS Settings > Privacy & Security > Tracking. The data practices in this Policy are reflected in the app's privacy "nutrition label" and Privacy Manifest declarations.

6.3 The consent form (Google User Messaging Platform)

Where regulations require consent for advertising — including in the EEA, the UK and Switzerland — the Game shows Google's User Messaging Platform (UMP) consent form, a Google-certified consent management platform, when you first open the Game (and again if the applicable requirements or partners change). Your choices on that form determine whether ads may be personalized and how advertising identifiers may be used for advertising, and are passed to Google in the formats required under Google's EU User Consent Policy. If you decline, the Game works normally; you may receive non-personalized ads or, in some configurations, no ads. The form is shown again when your consent expires or when the applicable requirements or partners change. You can withdraw or adjust your choices at any time using the device-level controls described in Section 6.4 or by contacting us at support@sortisgames.com; withdrawal does not affect processing that took place before it.

6.4 Device-level controls

You can also use device-level controls at any time: on Android, "Delete advertising ID" or "Opt out of Ads Personalization" in Google settings; on iOS, the ATT setting described in Section 6.2. Resetting or deleting your advertising identifier makes you appear as a new user to advertising systems. U.S. residents have additional opt-out rights described in our U.S. Privacy Statement.

6.5 Our own marketing

We advertise the Game on third-party platforms and networks. Our attribution partner Adjust measures which campaigns led to installs and certain post-install events so that we can evaluate campaigns and pay advertising partners correctly, and may exchange campaign, device-identifier and event data with the networks that showed our advertisements for that purpose, subject to your choices under this Section and applicable law. We do not send marketing emails unless you have provided an email address and opted in, and every marketing email will include an unsubscribe link. Push notifications may include offers; you can disable them in your device settings.

7. How We Share Personal Data

Equal protection by third parties. We require the third parties with whom we share personal data as described in this Policy — including analytics providers, advertising and attribution partners and other third-party SDK providers, and any contractors, affiliates or other entities that have access to user data — to provide the same or equal protection of user data as stated in this Privacy Policy and as required by the policies of the app marketplaces through which the Game is distributed (including Apple App Store Review Guideline 5.1 and the Google Play User Data policy).

We do not sell personal data for money, and we do not share personal data with third parties for their own unrelated purposes except as described in this Policy.

8. International Data Transfers

We are established in Türkiye and use service providers that store and process data in the United States, the European Union and other countries. Where we transfer personal data of EEA+ residents outside the EEA+, we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA where applicable), together with supplementary measures where appropriate. Where we transfer personal data out of Türkiye, we do so in accordance with Articles 9 et seq. of the Turkish Personal Data Protection Law No. 6698 (KVKK), including standard contracts registered or notified as required, adequacy decisions of the Turkish Personal Data Protection Board where available, or your explicit consent where relied upon. You may request a copy of the relevant safeguards via the contact details in Section 15.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, and then delete or de-identify it. In general: (i) game profile, gameplay and player-grouping data are retained while your Account is active and for up to 24 months of inactivity, after which they are deleted or de-identified; (ii) purchase and transaction records are retained for the periods required by tax, commercial and consumer law (in Türkiye, generally up to 10 years under the Turkish Commercial Code and Tax Procedure Law); (iii) crash and diagnostic logs are retained for up to 90 days; (iv) support tickets are retained for up to 24 months after closure; (v) attribution data is retained for up to 24 months; and (vi) records of consent, opt-outs, Terms acceptance and data subject requests are retained as required to demonstrate compliance. When you delete your Account, we delete or de-identify the data associated with it as described in Section 13, except where retention is required by law or for the establishment, exercise or defense of legal claims, in which case we retain only what is necessary, only for as long as necessary, and only for those purposes.

10. Security

We implement technical and organizational measures appropriate to the risk, including encryption of data in transit, access controls and least-privilege access for staff and contractors, server-side validation of purchases, spins and game state, logging and monitoring, and vendor due diligence. No system is perfectly secure and we cannot guarantee absolute security. If we become aware of a personal data breach that we are legally required to report, we will notify the competent authority and, where required, affected players without undue delay.

11. Children and Teens

Our Services are intended for a general audience and are not directed to children. We do not knowingly collect personal data from children under 13 (or under the higher minimum age applicable in their country, such as the age of digital consent in EEA+ countries), and our Terms of Service do not permit children under 13 to use our Services. We do not ask for your name, birth date or age. If we learn that we have collected personal data from a child below the applicable minimum age without required consent — for example through a report from a parent or guardian, or an age or parental-consent signal from the Platform — we will delete the associated Account and data. If you believe a child has provided us personal data, please contact us at support@sortisgames.com.

Teens. Where the Platform provides us with an age category or parental-consent signal for an account, we act on it as required by law and by Platform policy — for example by not showing personalized advertising where the signal requires it. Parents or guardians of teenaged players may contact us with questions or requests using the details in Section 15.

12. Your Choices

13. Access, Deletion and Other Requests; Account Deletion

Subject to applicable law (see the supplemental statements for your jurisdiction, linked in Section 1), you may request access to, correction of, deletion of, or a portable copy of your personal data, and may object to or ask us to restrict certain processing. Because most game data is keyed to a random player ID rather than your name or email, the most reliable way to make a request is through the in-game help function, which allows us to match the request to your Account; you may also use the contact details in Section 15, in which case we will ask for the player ID shown in Settings to verify the request. We respond within the timelines required by applicable law and will not discriminate against you for exercising your rights. You may authorize an agent to act for you where the law allows, and you may appeal a refusal as described in those supplemental statements.

Account deletion. You may delete your Account: (i) in the Game under Settings > Delete Account; or (ii) on the web at sortisgames.com/en/delete-account by entering the player ID shown in Settings, without needing to reinstall the Game, in accordance with Google Play and App Store account-deletion requirements. Deletion is permanent: your progress and any unused Virtual Items, including purchased Diamonds, are lost and cannot be restored. Upon deletion we delete or de-identify the data associated with your Account, retaining only what Section 9 permits (for example, legally required transaction records and a record of the deletion request itself).

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" above shows when it was last revised. For material changes — including the introduction of any feature listed as "not yet live" — we will provide reasonable advance notice (for example, an in-game notice) and, where required by law, obtain your consent before the change takes effect. Superseded versions will be archived and available on request.

15. How to Contact Us

Data controller: Sortis Oyun Yazılım ve Pazarlama Limited Şirketi, Göktürk Merkez Mah. Kılıncı Göl Sk. No: 7D1 İç Kapı No: 1, Eyüpsultan, İstanbul, Türkiye. Privacy inquiries: support@sortisgames.com. General contact: support@sortisgames.com. Player support: via the in-game help function (recommended for account-specific requests; please include the player ID shown in Settings). Advertising choices: the in-game consent form and the device-level controls described in Section 6. Account deletion: Settings > Delete Account, or sortisgames.com/en/delete-account.