KVKK Aydınlatma Metni
Prepared under Article 10 of Law No. 6698 on the Protection of Personal Data.
1. Data Controller and Scope
| Data controller | innclude Bilet Dağıtım ve Bilişim Teknolojileri A.Ş. |
|---|---|
| Address | Fenerbahçe Mah. İğrip Sok. No: 13/1, 34726 Kadıköy / İstanbul |
| MERSİS | 0478121800000001 |
| Tax office and number | Göztepe Vergi Dairesi, 4781218000 |
| info@innclude.com |
1.1. This notice covers individual users who visit the innclude website, use the mobile application, or obtain a ticket or admission registration through innclude.
1.2. A separate information notice applies to business account holders and their authorised representatives.
2. Personal Data Processed
| Category | Data |
|---|---|
| Identity | Name, surname, username. Where required for invoicing, Turkish identity number or tax identification number |
| Contact | Telephone number, e-mail address, invoice address |
| Customer transaction | Ticket and admission records, entry code, refund and cancellation records, support correspondence |
| Transaction security | IP address, device and application information, session and error logs |
| Financial | Transaction amount, date and status, invoice records |
| Personal information (optional) | Sex, date of birth, occupation, short bio, website address and social media links. None of these is mandatory |
| Permission-based | Location, the names and telephone numbers of the people in your contacts, camera and photo access |
| Marketing | Notification preferences and consent records |
2.1. The card number, expiry date and security code are transmitted through innclude's servers to the authorised payment institution in order to collect the payment. innclude does not record or store this information. From a card stored at the payment institution, only the card brand and the last four digits are returned to innclude.
2.2. When you give contacts permission, the name and first telephone number of the people in your contacts are uploaded to our servers and matched against users registered with innclude. When you give location permission, your location is recorded only while the application is open in the foreground, and at most once every thirty minutes or upon movements of one hundred metres. The details are set out in Article 3 of the Privacy Policy.
2.3. innclude does not use any advertising network; no advertising identifier is processed and no tracking for advertising purposes is carried out.
2.4. Records of the event's organiser. The brand organising an event for which you have bought a ticket or made an admission registration adds you to its own participant records and can see which of its events you have attended. This record is for the conduct and reporting of the event and is not dependent on marketing consent. For the brand to be able to send you commercial electronic messages, your separate consent is required; not giving consent does not prevent the record from being kept, it only prevents messages from being sent. In respect of these records, the data controller is the brand concerned.
3. Purposes of Processing and Legal Grounds
| Purpose | Legal ground (Law No. 6698, Art. 5) | Data |
|---|---|---|
| Opening an account and identity verification | Establishment and performance of the contract | Identity, contact |
| Issuing and delivering the ticket, verification at entry | Performance of the contract | Identity, contact, customer transaction |
| Payment and invoicing | Legal obligation; performance of the contract | Financial, identity, contact |
| Security, prevention of fraud, troubleshooting | Legitimate interest | Transaction security |
| Management of requests and complaints | Performance of the contract; legitimate interest | Contact, customer transaction |
| Meeting legal requests, protection of rights | Legal obligation; establishment and protection of a right | All relevant data |
| Location-based content, contact matching, promotional messages | Explicit consent | Permission-based data, marketing |
4. Method of Collection
Data is collected electronically, through the information you enter via the application and the website, the records generated automatically during your transactions, and the transaction results returned by the payment institution.
5. Transfers
| To whom | Why |
|---|---|
| The event organiser | Entry to the event, participant management, invoicing |
| Payment institutions and banks | Collection and refund of payments |
| SMS, WhatsApp, e-mail and push notification providers | Delivery of tickets, invitations and notifications |
| Error and crash reporting provider | Detection and resolution of application errors |
| Map, place search and weather providers | Venue search, maps, directions and event weather |
| Cloud and infrastructure providers | Operation and backup of the system |
| Legal and financial advisers, auditors | Legal obligations, protection of rights |
| Competent public authorities and institutions | Requests arising from legislation |
5.1. Transfers abroad are made in the order set out in Article 9 of Law No. 6698: an adequacy decision; where there is none, appropriate safeguards such as a standard contract or binding corporate rules; and where these are also absent, the exceptional circumstances set out in the Law.
5.2. Today, transfers abroad take place in respect of the following services: error and crash reporting (Germany), push notifications (United States of America), maps and place search (United States of America), weather (Europe), and package payments made in foreign currency (United States of America and Ireland). Which data is transferred is set out in the table in Article 8 of the Privacy Policy. No transfer abroad is made for payments in Turkish lira.
6. Retention Periods
| Data | Period | Basis |
|---|---|---|
| Account and profile data | For as long as the account is open | Performance of the contract |
| Payment, invoice and accounting records | Ten years | Tax and commercial legislation |
| Ticket and admission records | For as long as the event record remains in the system | Evidence in possible claims |
| Traffic and access logs | The period prescribed by legislation | Law No. 5651 |
| Consent records | The evidentiary period following withdrawal of consent | Burden of proof |
| Names and numbers uploaded from contacts | For as long as the account is open; within thirty days upon a deletion request | Explicit consent |
| Location records | For as long as the account is open | Explicit consent |
| Error and crash logs | Ninety days at most | Legitimate interest |
| Account for which a deletion request has been made | Thirty days from the request; if you log in within that period the account is restored | So that the request can be withdrawn |
| Frozen account | Until you restore it; data is not deleted | Performance of the contract |
| Support correspondence | A reasonable period from closure of the request | Legitimate interest |
| Cookies and browser storage | Written separately for each entry in the table in the Cookie Policy | Legitimate interest for the mandatory ones, explicit consent for the others |
7. Your Rights
7.1. Under Article 11 of Law No. 6698 you may request the following:
- To learn whether your personal data is processed and, if it is, to request information about it.
- To learn the purpose of processing and whether the data is used in accordance with that purpose.
- To know the third parties to whom the data is transferred, in Türkiye or abroad.
- To request that data processed incompletely or incorrectly be corrected.
- To request that the data be erased or destroyed where the conditions are met.
- To request that correction, erasure and destruction operations be notified to the third parties to whom the data has been transferred.
- To object to an adverse outcome arising from analysis carried out solely by automated systems.
- To request compensation where you suffer loss as a result of unlawful processing.
7.2. You can request a copy of your data from Settings › Download my data in the application; the copy is sent to your registered e-mail address, and for this reason an e-mail address must be registered on your account. You can delete or freeze your account from Settings › Account; a deletion request becomes permanent after thirty days.
7.3. You can submit other applications from info@innclude.com or in writing to our company address. The application must include information identifying you together with the subject of your request. Applications are concluded within thirty days at the latest; if the operation also entails a cost, the fee set out in the tariff determined by the Board may be charged.
8. Security
Technical and administrative measures are applied to protect personal data against unlawful access, loss and processing. These measures include encryption of data in transit and at rest, authorisation and access control, the keeping of access logs, backups and confidentiality obligations for personnel.
9. Children's Data
innclude's services are for persons who have completed eighteen years of age. Age is not verified during registration; the condition rests on the user's own declaration. If it is established that data belonging to a person under eighteen is being processed, the account is closed and the data is erased without delay, except where legislation makes retention mandatory. You can report such a situation to info@innclude.com.
10. Changes
This notice may be updated. The current version is published at innclude.com.