Privacy Policy

This website is published as part of the Erasmus+ KA220-SCH project "Cultivating Peaceful Communities: Non-Violent Communication via Gamification". The data controller for personal data processed through it is Kastamonu University, the project coordinator.

• Controller: Kastamonu University, Kuzeykent Campus, 37150 Kastamonu, Türkiye
• Contact for data protection matters: info@eunvcgames.com
• Project consortium: Kastamonu University (Türkiye), Kastamonu Provincial Directorate of National Education (Türkiye), Nextstapp UG (Germany), Arte e Cultura Sociale (Italy), Kohtla-Järve Iidla Põhikool (Estonia), Associação de Jardins-Escolas João de Deus (Portugal)
• Project duration: September 2025 – August 2027

We collect only what the website needs in order to work and to show us how it is being used. We do not sell personal data, and we do not use it for advertising or profiling.

• Contact form: your name, your email address, the content of your message, and a one-way hash of your IP address stored beside it. The form asks for nothing else — there is no field for a surname or a telephone number.
• Usage analytics: the page you visited, the type and identifier of the content shown, the domain that referred you, your country where our own server can tell it without asking anyone else, a randomly generated session identifier, a one-way hash of your IP address, and a coarse browser label.
• Site search: the words you searched for, how many results they returned, and a one-way hash of your IP address.
• Anti-spam: a one-way hash of your IP address, held for a couple of minutes at a time, so that the contact form and the download links cannot be hammered from one address. No outside anti-spam service is involved.
• Server logs kept by our hosting provider for security and troubleshooting.

Every processing activity has one purpose and one legal basis, under the EU General Data Protection Regulation and, for a controller established in Türkiye, Personal Data Protection Law No. 6698.

• Answering your enquiry, using what you send through the contact form. Basis: steps taken at your request, and our legitimate interest in replying (GDPR Art. 6(1)(b) and 6(1)(f); KVKK Art. 5(2)(c) and 5(2)(f)).
• Understanding how the site is used, so that we can report on the project's dissemination. Basis: your consent, given through the cookie banner (GDPR Art. 6(1)(a); KVKK Art. 5(1)). You can withdraw it whenever you like.
• Keeping the contact form free of automated abuse. Basis: our legitimate interest in a working, spam-free service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

This website sets no advertising or cross-site tracking cookies. One cookie can reach an ordinary visitor, and it only remembers the language you are reading in; the other three exist for signed-in project administrators. Everything else is kept in your browser's local storage.

• NEXT_LOCALE — a cookie holding nothing but the code of the language you are reading in, so that the site opens in it again. It is deleted when you close the browser.
• cookie-consent — records whether you accepted or declined analytics. Stays until you clear it.
• analytics_session_id — a random identifier that groups your page views into one visit. Created only after you accept analytics, sent to us with each page view, and not linked to your identity.
• preferred-language, theme, animations-enabled — your display preferences. Never transmitted.
• cms-recently-viewed and cms-recently-viewed-dismissed — the last eight pages you opened here, with their titles, and whether you closed the small panel that offers them back to you.
• cms-recent-searches and cms-cmdk-recent — the last five terms you typed into the search box and the last six you typed into the quick-search panel, so that they can be offered again. The lists themselves stay in your browser and are never sent to us, though running a search does send that term to our server, as section 2 describes.
• __session — an HTTP-only cookie set only when a project administrator signs in to the content management area. It lasts five days. Ordinary visitors never receive it.
• __csrf — issued with __session and checked on every change an administrator makes, so that another site cannot make it for them. It is deliberately readable by this site's own scripts, and expires with the session cookie.
• __preview — set for one hour when a signed-in editor opens an unpublished page to check it. Ordinary visitors never receive it.

We do not sell or rent personal data. It reaches only the providers we need in order to run the website, and only as far as that requires.

• Google Ireland Limited and Google LLC, whose Firebase Firestore, Authentication and Storage services hold the website's database and files, acting as our processor.
• Our hosting provider, which handles server logs on our behalf.
• Project partners and the Erasmus+ National Agency, who receive aggregated statistics that identify no one.

The controller is established in Türkiye and some of our processors are established in the European Economic Area or the United States. Where personal data leaves the EEA we rely on the European Commission's Standard Contractual Clauses agreed with the provider concerned. For transfers abroad under KVKK we rely on the safeguards in Article 9 of Law No. 6698, including your explicit consent where that is required.

We keep personal data only for as long as the purpose it was collected for lasts. Deletion is automated wherever it can be.

• Raw analytics events, including the hashed IP address: 90 days, then deleted automatically.
• Aggregated daily statistics: kept for the lifetime of the project and its reporting obligations. They contain no personal data.
• Contact form messages, including the hashed IP address stored with them: 24 months from the day we receive them.
• Administrator audit records, including the hashed IP address of the sign-in: 12 months.
• Search logs, and the security log entries written when a request is blocked: no automatic expiry is set on these, and we delete them by hand.
• Administrator accounts: until the end of the project plus five years, to meet Erasmus+ audit requirements.

Write to info@eunvcgames.com to exercise any of these, free of charge. We reply within 30 days. If our reply does not satisfy you, you can complain to a supervisory authority.

• Access — confirmation of whether we hold your data, and a copy of it.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion, where no overriding reason to keep it applies.
• Restriction and objection — limiting processing, or objecting to processing based on our legitimate interests.
• Portability — the data you gave us, in a structured, machine-readable form.
• Withdrawal of consent — decline analytics at any time by clearing the cookie-consent entry in your browser. Withdrawal does not undo processing already carried out.
• Complaint — in Türkiye, the Personal Data Protection Authority (kvkk.gov.tr); in the EEA, your national data protection authority.

Technical and organisational measures guard the data we hold.

• The site is served over HTTPS only.
• IP addresses are never stored as they are. Each is hashed with a secret salt before it is written, and the original is discarded.
• The administration area requires authentication, limits what each role can do, and supports two-factor authentication.
• Administrator sign-ins and sign-outs are written to an audit log, as are most changes made in the administration area — who made each one, what it affected, and when. The log is not exhaustive: issuing or revoking an API token, for instance, does not appear in it.

The NVC Games mobile app published by the project works without an account. It collects no personal data and sends none to us or to anyone else.

• No account or sign-in: the app asks for no name, email address or other details about you.
• No advertising or tracking. The one exception is an anonymous play counter, so that we can show in our Erasmus+ reports how much the games are used: when a game starts or ends (and the device is online), the app sends only the game, its language, the mode (individual or team) and the number of players or teams. No team names, scores or anything that identifies you or your device are sent. The games on this website use the same counter in the browser, without cookies.
• Game results — the team names you enter and the scores — are stored only on your device, and you can delete them in the app at any time.
• Links to this website open in your device's own browser; this policy then applies to that visit as it does to any other.
• Questions about the app can be sent to the contact address under “Who we are” above.

If we change how we handle personal data we will update this page and the date at the top of it. Changes that materially affect your rights will be announced on the homepage.