Privacy
Collect little, say it plainly, delete on request. This notice fulfils the duty to inform under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the EU General Data Protection Regulation (GDPR).
Data controller
The team that operates the San Andreas Extended platform (hereinafter "SAEX") is the data controller for personal data processed on this site, in the Hub, on the forum and in the server browser. Community servers are separate data controllers for their own in-game data; they publish their own rules and privacy notices.
Data we process
- Account data: username, email address, an irreversible hash of your password, two-step verification and passkey records.
- Community data: profile, forum posts, reactions, follows and crew details.
- Security data: session records, sign-in attempts, moderation decisions and the short-lived technical logs that go with them.
- Newsletter data: only your email address, the time you gave consent and an irreversible hash of your IP address (the IP address itself is not stored).
We do not collect special categories of personal data (health, biometrics, religion and the like). No payment details are processed on this site.
Purposes and legal bases
| Purpose | Legal basis (KVKK / GDPR) |
|---|---|
| Creating your account and letting you into servers | Entering into and performing a contract: KVKK Art. 5/2-c, GDPR Art. 6/1-b |
| Preventing cheating, fraud and abuse | Legitimate interest: KVKK Art. 5/2-f, GDPR Art. 6/1-f |
| Meeting legal obligations | Provided for by law and legal obligation: KVKK Art. 5/2-a and ç, GDPR Art. 6/1-c |
| Sending the newsletter | Explicit consent: KVKK Art. 5/1, GDPR Art. 6/1-a |
Newsletter
The newsletter uses double opt-in: when you submit the form we send you a confirmation link, and you are not added to the list unless you click it. Every email has a one-click unsubscribe link at the bottom; when you unsubscribe, your email address is permanently deleted. You can withdraw your consent at any time; this does not affect processing carried out before the withdrawal.
Transfers
We do not sell your data or share it for advertising. We only share it with the infrastructure providers needed to run the service (server hosting, email delivery) and, where the law requires it, with the competent authorities. If a transfer abroad is needed, we follow the safeguards in KVKK Art. 9 and Chapter V of the GDPR.
Retention periods
- Account data: for as long as your account stays open; within 30 days after the account is deleted.
- Technical and security logs: 90 days at most.
- Unconfirmed newsletter sign-ups: 30 days; confirmed sign-ups: until you unsubscribe.
- Moderation records: as long as needed for community safety, 2 years at most.
Your rights
You have the following rights under KVKK Art. 11 and GDPR Art. 15–22:
- To find out whether your data is processed and to request information about it
- To find out the purpose of the processing and whether the data is used in line with that purpose
- To know the third parties your data is transferred to
- To have incomplete or inaccurate data corrected
- To have your data erased or destroyed
- To receive your data in a portable format
- To object to an outcome against you that results from automated systems
- To claim compensation for damage caused by unlawful processing
- To lodge a complaint with the Turkish Personal Data Protection Board or the supervisory authority of the country you live in
You can export your account data and delete your account yourself from the privacy screen in the Hub.
Minors
You must be at least 13 years old to create a SAEX account. If you are under 18, you must create your account with your parent or guardian's knowledge. We close accounts that we find belong to a minor without parental consent.
Requests and contact
You can send requests about your rights to [email protected]. We reply free of charge within 30 days at the latest.
For how we use cookies, see the cookie policy.