INFORMATION ON PERSONAL DATA PROTECTION

(Last Update: 5 June 2022)

Taking into account the data security of yours - our distinguished customers -, we as Biletix Bilet Dağıtım Basım ve Tic. A.Ş. (“Biletix”) would like to inform you on the "Personal Data Protection Law" regarding personal data in order to protect your personal data, particularly confidentiality of your private life, and to inform you on our "Obligation to Inform" set forth in the related laws and regulations within this context.

Our aim; is to inform you - to the most transparent extent - on the methods your personal data is collected, the purposes of processing, legal reasons and your rights thereon. As per Personal Data Protection Law (the "PDPL") No. 6698, put into effect on April 7, 2016 an-d pursuant to the provisions of other related laws and regulations in terms of any personal data (“Data”) you have transmitted to Biletix; our Company Biletix A.Ş., with the capacity of Data Controller and, if necessary, as Data Processor, can obtain, save, store, preserve, update, change, rearrange the personal data in order to continue its services; disclose, transfer, transmit, share, classify, anonymize and process the same in other ways specified in the law, in cases and to the extent permitted by the related laws and regulations and subject to the terms and limits explained below.

Data Controller: It refers to Biletix Bilet Dağıtım Basım ve Ticaret A.Ş. the contact details of which are given below.

Purposes and legal reasons for processing your personal data ; Identity information, access/contact information, information on consumer habits, any information and document obtained as a result of transactions conducted by voice and video calls or within the scope of contracts established, which serve to make the identities of our customers specific or identifiable, are all within the scope of personal data as per Article 3/d of the PDPL.

	Data Category	Data Retention Period (Extraordinary regulations stipulated in the legislation as well as the rights of data owners regarding the deletion-destruction of their data within the scope of PDPL are separate and reserved)
1	Data on Identity	Legal Relations + 10 Years
2	Contact Information	Legal Relations + 10 Years
3	Location Information	5 Years
4	Personal Information	Termination of employment + 10 Years
5	Legal Procedural Information	Legal Relations + 10 Years
6	Customer Transaction Information	Legal Relations + 10 Years
7	Physical Premises Security	1 Year
8	Transaction Security Information	Legal Relations + 10 Years
9	Financial Information	Legal Relations + 10 Years
10	Occupational Information	Employment + 10 Years
11	Marketing Information	1 Year
12	Visual and Auditory Records	1 Year
13	Foundation Membership	Legal Relations + 10 Years
14	Foundation Membership Information	Legal Relations + 10 Years
15	Health Information	Legal Relations + 10 Years
16	Sentence penalty and Security Measures Information	Legal Relations + 10 Years
17	Other Information-Employees, Employee Candidate and Trainee Information	Legal Relations + 10 Years
18	Other Information-Demands and Complaints Information	Legal Relations + 10 Years
19	Other Information-Vehicle Information	5 Years

Your personal data can be processed for the purposes of fulfilling the requirements of the contracts concluded with you and performing the contracted services, selling the event tickets and other services and delivering the tickets to you or the people you have designated - depending on the delivery method you prefer-, effectuating your payments, returning them if necessary, e-invoicing, e-archive invoicing and if necessary, completing refund and change transactions, information-communication sharing with you through the communication channel you prefer within the scope of the events you purchased or the campaigns /sweepstakes you participate in, determining transaction information, to let you log in Biletix membership - depending on your request - and storing your records, if you have given communication permission / information, conducting marketing and campaign activities, sending event bulletins, data analysis-research, conducting insurance transactions if you have preferred to have insurance while purchasing tickets and for transmitting to our Company and following up of your complaints/demands and performing your combined membership and loyalty program membership transactions and accreditation transactions depending on your request, and informing you within the scope of these memberships, backing up/archiving, storing and keeping the transaction records, complying with the information storage, reporting and retention obligations in accordance with the provisions of the related laws and regulations and for the purposes of fulfilling our legal liabilities. Biletix shall not use, process, transfer and/or disclose your personal data to third parties without your express consent-approval or for the reasons stipulated in the related laws and regulations, except for the processing purposes specified here. The cases that do not require explicit consent, as regulated in Article 5/2 of the PDPL and explained below, are separate and reserved.

Persons/organizations to whom your personal data can be transferred for the below-mentioned purposes: Your Personal Data may be transferred to the relevant Banks, depending on the payment method you prefer, the relevant online payment systems, to the relevant insurance company and intermediary institutions if you have preferred to have insurance while purchasing the ticket, to the relevant distribution/cargo-courier companies within the scope of your preferred delivery choice, and a special subscription such as combined membership and loyalty program membership for e-invoicing/e-archive invoicing, if you have purchased a membership, to the relevant sports clubs and related foundations/companies that are members of the program; to the relevant institutions/organizations and infrastructure providers within the scope of the transactions, to the relevant server hosting, archiving, storage and software services providers that we work with in the country and abroad for the backup / storage / archiving / storage of the transaction records, to the main shareholder of our Company, if necessary, directly /indirectly to the relevant domestic/foreign affiliates; to the relevant employees, legal, financial and tax consultants, relevant auditors, and relevant persons, institutions and organizations allowed by the provisions of the related laws and regulations, within the allowed scope and only to the extent necessary, for the elimination of your complaints or a problem or fulfillment of our legal obligations. When transferring your personal data to the relevant third parties specified in this article, a data transfer shall be made only as much as necessary and within the scope of its relevance. The cases that do not require explicit consent, as regulated in Article 5/2 of the PDPL and explained below, are separate and reserved.

What are my rights regarding personal data?

Your Rights and Exceptions under Article 11 of the Law ;

You are entitled to request the following by applying to our company in writing or by other methods to be determined by the Board;
a) To learn whether your personal data is processed or not,
b) If your personal data has been processed, to request information about it,
c) To learn the purpose for processing your personal data and whether they are used in accordance with its purpose,
d) To learn about the third parties to whom your personal data is transferred in the country or abroad,
e) To request correction of your personal data if it is incomplete or incorrectly processed,
f) To request deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the Law,
g) To request notification of the transactions made pursuant to clauses d and e to the third parties to whom your personal data has been transferred,
h) Objection to a result emerged against you by analyzing your processed data exclusively through automated systems, and
i) Remedy of losses in case you suffer damage or loss due to unlawful processing of your personal data,

For more detailed information with regard to the above items and your requests about your personal data, please fill out the form.

You may transmit your requests regarding personal data, adding the necessary information/documents to identify you, together with your explanations about your right that you intend to exercise, filling out the form on the relevant help pages at our Company's Help address electronically and/or sending the same to our Company’s address at Ayazağa mah. Azerbaijan Cad No: 3B Floor. 2 Interior Door: 2-3 34396 Sariyer/İstanbul enclosed with a signed petition/application letter. In addition, in case the Board determines other methods for transmission of the request, it will be possible for you to convey your request by these methods. Our company will satisfy your requests set forth in the application, free of charge, as soon as possible within no later than thirty days, depending on the nature of the request.

However, if the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged. Our Company shall be entitled to accept the request or reject it by explaining the reason and notify the relevant person in writing or electronically. In case the request in the application is accepted, our Company shall fulfill your request within the time specified in the related laws and regulations. In case the application is filed due to the fault of our Company and there is a fee charged, then the fee shall be returned to the person concerned. In cases where the application is rejected, the answer given is insufficient or the application is not answered in due time, then the person concerned shall be entitled to file a complaint with the Board within thirty days from the date of our Company's response, and in any case within sixty days from the date of application. Pursuant to the provision of Article 14/2 of the PDPL, no complaint can be raised with the Board before exhausting the above-mentioned application with our Company, acting as the data controller. The right to compensation according to the general provisions of those whose personal rights are violated is reserved.

However, as per Article 28/2 of the PDPL; we hereby state Article 10, which sets forth the data controller's obligation to inform and Article 11, which sets forth the data owner's rights, excluding the right to claim for compensation of the loss shall not be applicable to a) necessity of personal data processing for prevention or investigation of crimes, b) processing of personal data made public by the person concerned c) requirement of personal data processing for execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations in the nature of public institution, based on the authority given by the law d) requirement of processing of personal data in cases where it is necessary for protection of the economic and financial interests of the State with regard to budget, tax and financial matters; provided that it is proportionate and in accordance with the purpose and basic principles of the PDPL.

Circumstances not Requiring Explicit Consent : Pursuant to paragraph 2 of Article 5 of the PDPL, it is possible to process personal data without explicit consent of the relevant person in the following cases: a) In case it is clearly stipulated in the laws, b) in case it is obligatory for protection of life or physical integrity of the person or another person, being unable to express his consent due to actual impossibility or whose consent is not legally validated, c) it is necessary to process the personal data of the parties to the contract, provided that it is directly related to the conclusion or performance of a contract, d) in case it is mandatory for the data controller to fulfill its legal obligation, e) in case it has been made public by the relevant person himself, e) in case the data processing is required for establishment and exercise of a right, f) in case data processing is obligatory for legal interests of the data controller; provided that it does not prejudice the fundamental rights and freedoms of the relevant data owner.

Commercial Title : Biletix Bilet Dağıtım Basım ve Ticaret A.Ş.

Notification Address : Ayazağa Mah. Azerbaycan Cad. Blok:1B, No:3B İç kapı:2, 34396 Sarıyer - İstanbul, Türkiye

MERSİS No : 0171009936100018

Contact Telephone : 0850 755 55 55

Headquarters : 0212 365 00 00

Contact Fax No : 0212 285 15 25

Web Address for Communication : Help and Support